CVE-2026-59877

protobufjs: Denial of Service via infinite loop in .proto option parsing

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.

We have discovered 31 live websites that are affected by CVE-2026-59877.

Run a Free Instant Scan



Affected Software

Product  protobufjs
Category JavaScript Libraries
Vulnerable Domains31 live websites (27% of protobufjs install base)
Vulnerable Versions
  • from 7.5 through 7.6.5
  • from 8 through 8.6.6
Vulnerable Versions Count1 versions ( 14% of all versions)


Common Weakness Enumeration

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')



Details

  • Published - Jul 8, 2026
  • Updated - Jul 8, 2026

Website Distribution by Country

Number of websites using CVE-2026-59877
United States6 websites


France25 websites

Website Distribution by TLD

Number of websites using CVE-2026-59877
.com22 websites
.net6 websites
.org1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-59877

Top websites that are affected by CVE-2026-59877. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**********.com France*,***,***
*****.********.com United States*,***,***
****.********.com United States*,***,***
*****.com France**,***,***
*******.********.com United States**,***,***
******.com France**,***,***
*****.com United States**,***,***
********.com France**,***,***
*****.com France**,***,***
*******.com France**,***,***
See full domain list

FAQ

CVE-2026-59877 is Loop with Unreachable Exit Condition ('Infinite Loop') in protobufjs
A total of 31 websites have been identified as vulnerable to CVE-2026-59877, based on global website indexing conducted by WebTechSurvey.
The protobufjs is affected by the CVE-2026-59877 vulnerability.
protobufjs versions up to 8.6.6 are vulnerable to CVE-2026-59877.
CVE-2026-59877 is resolved in version 8.6.6 of protobufjs.