CVE-2026-41242

A vulnerability in the protobufjs library allows infinite looping when parsing specially crafted .proto files. The lack of end-of-input checking when processing options causes parse, Root.load, or Root.loadSync to loop indefinitely.

A vulnerability in the protobufjs library (versions 8.2.0 to 8.6.5) allows prototype pollution via parsing map entries in Text Format. An attacker can inject a map key named __proto__, which modifies the object prototype instead of creating a map entry.

Versions of protobufjs from 8.2.0 to 8.4.2 lacked options to discard unknown fields during decoding, which could lead to excessive memory usage by decoded messages. Version 8.5.0 introduced options to disable unknown field retention, and version 8.6.2 defaults to discarding unknown fields.

In versions prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. This could lead to deterministic exceptions or recursive calls in various operations related to decoding and serialization.

protobufjs before versions 7.5.6 and 8.0.2 generates JavaScript for the toObject function that may include an unsafe expression from a schema-controlled bytes field default value. A crafted descriptor can lead to arbitrary code execution.

Protobufjs before versions 7.5.6 and 8.0.2 lacks a depth limit when decoding nested protobuf data. A crafted binary payload can exhaust the JavaScript call stack, causing a crash.