The protobuf.js library, used to compile protobuf definitions into JavaScript functions, had a vulnerability (CWE-674) involving uncontrolled recursion during the expansion of nested JSON descriptors via Root.fromJSON() and Namespace.addJSON(). Versions prior to 7.5.8 and from 8.0.0 up to but not including 8.2.0 could be forced to recurse without a depth limit, leading to exhaustion of the JavaScript call stack. This vulnerability can cause application crashes or denial of service when processing maliciously crafted deeply nested JSON descriptors. The issue is resolved in protobuf.js versions 7.5.8 and 8.2.0.

The vulnerability allows an attacker to cause a denial of service by triggering a stack overflow through deeply nested JSON descriptors. There is no impact on confidentiality or integrity, only availability is affected. No known exploits are reported in the wild.

Upgrade protobuf.js to version 7.5.8 or later if using the 7.x branch, or to version 8.2.0 or later if using the 8.x branch. These versions contain fixes that impose recursion depth limits to prevent stack exhaustion. Patch status is confirmed by the vendor advisory indicating these versions resolve the issue.