Protobufjs compiles protobuf schema definitions into JavaScript functions. In versions prior to 7.5.6 and 8.0.2 the decoder does not enforce a recursion depth limit when parsing nested protobuf messages. An attacker can construct a deeply nested protobuf binary that causes the JavaScript call stack to overflow during decoding, terminating or unresponsively consuming server resources. This results in a denial‑of‑service condition and interrupts legitimate traffic.

The vulnerability affects the protobufjs library under the name protobuf.js. All releases before 7.5.6 and before 8.0.2 are vulnerable. Systems that include this library in any JavaScript or Node.js application are at risk if they process external protobuf data.

The CVSS v3 score of 7.5 reflects a high impact while the lack of an EPSS value means no current exploitation data is available. Because the attack requires an attacker to supply a malicious protobuf payload, the most likely vector is through network interfaces, file uploads or any API that accepts protobuf messages. The vulnerability is not listed in the CISA KEV catalog; however, the risk of service interruption remains significant if the library is used in exposed services.