The protobuf.js library versions 8.2.0 through 8.4.2 preserved unknown wire elements in the message.$unknowns property without providing a decode-time option to discard these unknown fields. This could cause a decoded message to consume significantly more memory than the input payload size, constituting an allocation of resources without limits or throttling (CWE-770). Starting in version 8.5.0, decode-time options were added to allow disabling unknown-field retention, and in 8.6.2 the default behavior was changed to discard unknown fields unless explicitly opted into, mitigating this issue.

An attacker can craft protobuf payloads containing many unknown fields that cause the protobuf.js decoder to retain large amounts of memory, potentially leading to denial of service due to excessive memory consumption. There is no impact on confidentiality or integrity, only availability due to resource exhaustion.

Upgrade protobuf.js to version 8.5.0 or later to gain decode-time options to disable unknown-field retention. For best protection, use version 8.6.2 or later, where unknown fields are discarded by default unless explicitly enabled. Patch status is not explicitly confirmed by the vendor advisory, but these version changes indicate remediation. Check the protobuf.js project releases for official patch details.