GHSA-762f-c2wg-m8c8

GitHub Security Advisory

Denial of Service in protobufjs

✓ GitHub Reviewed MODERATE Has CVE

Versions of `protobufjs` before 5.0.3 and 6.8.6 are vulnerable to a regular expression denial of service when parsing crafted invalid *.proto files.

## Recommendation

Update to version 5.0.3, 6.8.6 or later.

npm protobufjs

Affected versions: 6.0.0 (fixed in 6.8.6)

npm protobufjs

Affected versions: 0 (fixed in 5.0.3)

CVE-2018-3738

GHSA ID

GHSA-762f-c2wg-m8c8

Published

October 9, 2018 12:27 AM

Last Modified

April 11, 2023 12:32 AM

CVSS Score

5.0 /10

Primary Ecosystem

npm

Primary Package

protobufjs

GitHub Reviewed

✓ Yes

Last updated: July 2, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.