The protobufjs library, which compiles protobuf definitions into JavaScript functions, improperly validates input by not escaping certain control characters in field and oneof names before embedding them into generated function bodies. This leads to failures in generated encode, decode, verify, or conversion functions during compilation when processing maliciously crafted schemas or JSON descriptors. The vulnerability affects versions prior to 7.5.6 and versions from 8.0.0 up to but not including 8.0.2. It is addressed in versions 7.5.6 and 8.0.2.

This vulnerability can cause denial of service by making generated protobuf functions fail during compilation. There is no indication of confidentiality or integrity impact. The CVSS score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Upgrade protobufjs to version 7.5.6 or later, or to version 8.0.2 or later, where this vulnerability is fixed. Patch status is not explicitly confirmed in a vendor advisory but the description states the issue is fixed in these versions. Users should verify they are running a patched version to mitigate this issue.