protobufjs is a JavaScript library that compiles Protocol Buffers definitions into executable code. The vulnerability allows a practitioner to craft a JSON descriptor with deeply nested namespace definitions that, when passed to Root.fromJSON() or Namespace.addJSON(), causes the library to recurse without a depth limit. The uncontrolled recursion exhausts the JavaScript call stack during descriptor loading, effectively halting the application that relies on protobuf.js and resulting in a denial of service. The flaw is a classic case of unbounded recursion (CWE‑674).

The issue affects the protobuf.js library distributed by the protobufjs organisation. All versions of protobuf.js released before 7.5.8 and before 8.2.0 are susceptible to this defect. Applying any later release of either 7.x or 8.x that incorporates the fix mitigates the risk.

The CVSS score of 5.3 indicates moderate severity. No EPSS information is available, so the exploitation likelihood is uncertain, and the vulnerability is not catalogued in the CISA KEV. The most probable attack vector is that an application issuing or accepting a malicious JSON descriptor—such as a user‑provided schema or a configuration payload—could trigger the recursion. If an attacker controls the descriptor content, the application could be rendered unavailable, compromising availability for end users.