The protobufjs library, used to compile protobuf definitions into JavaScript functions, had a vulnerability (CWE-674) involving uncontrolled recursion without a depth limit during conversion of decoded messages to plain objects or JSON. Specifically, the generated toObject() method and the custom google.protobuf.Any JSON conversion path could recurse indefinitely if given a crafted protobuf binary payload containing deeply nested Any values. This recursion leads to exhaustion of the JavaScript call stack, resulting in a denial of service. The vulnerability is addressed in protobuf.js versions 7.6.1 and 8.4.1.

An attacker can cause a denial of service by supplying a malicious protobuf binary with deeply nested Any values, triggering uncontrolled recursion and exhausting the JavaScript call stack during conversion to JSON. This does not affect confidentiality or integrity but impacts availability by crashing or hanging the application using vulnerable protobuf.js versions.

Upgrade protobuf.js to version 7.6.1 or later, or 8.4.1 or later, where this uncontrolled recursion vulnerability is fixed. Patch status is confirmed by the vendor advisory indicating fixes in these versions. No other mitigations are specified.