Protobuf.js compiles protocol buffer definitions into JavaScript functions. Prior to releases 7.5.6 and 8.0.2, the compiler inserted field and oneof names directly into generated code without escaping certain control characters. When a crafted schema or JSON descriptor contains these characters, the resulting JavaScript code fails to compile, causing encode, decode, verify, or conversion functions to throw errors during runtime. This failure manifests as a denial‑of‑service condition for any component that relies on the generated code. The weakness is a classic example of CWE‑20, input validation errors.

The vulnerability affects the protobuf.js library distributed under the protobufjs:protobuf.js namespace. Any deployment that uses protobuf.js version prior to 7.5.6 or 8.0.2 and processes user‑supplied schema definitions is at risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is by supplying a crafted schema or JSON descriptor to a system that compiles protobuf definitions at runtime, which would trigger the compile failure and stop the service from functioning normally.