7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48712

CVE-2026-48712: protobufjs: Denial of service through unbounded Any expansion during JSON conversion

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48712

CVE-2026-48712:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
protobufjs	npm	<= 7.6.0	7.6.1
protobufjs	npm	>= 8.0.0, <= 8.4.0	8.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the lack of recursion depth control when converting protobuf messages to JSON or plain JavaScript objects. Specifically, when a message contains a google.protobuf.Any field, the library attempts to unpack and convert it recursively. An attacker could craft a message with deeply nested Any fields pointing to other Any messages, leading to an infinite recursion and causing a denial of service through a stack overflow.

The patch addresses this by introducing a recursion depth counter (depth or q) to the relevant conversion functions: wrappers['.google.protobuf.Any'].toObject, the dynamically generated toObject methods (created by converter.toObject), and the Type.prototype.toObject entry point. This counter is incremented with each level of recursion, and if it exceeds a predefined recursionLimit, the operation is aborted, preventing the stack overflow.

Vulnerable functions

wrappers[\'.google.protobuf.Any\'].toObject

src/wrappers.js

The `toObject` function for `google.protobuf.Any` did not have a recursion depth check, allowing a crafted message with deeply nested `Any` values to cause a stack overflow during JSON conversion.

Type.prototype.toObject

src/type.js

This function is the entry point for converting a message to a plain object. The patch modifies it to correctly pass down the recursion depth argument to the underlying generated `toObject` method, which was vulnerable. Without this change, the depth check would not be applied.

converter.toObject

src/converter.js

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.