protobufjs was known to parse option names in a .proto file by advancing through tokens until encountering an '=' character, without checking for the end of the input. An attacker can craft a .proto schema that opens an option declaration but ends prematurely, causing the parser, Root.load or Root.loadSync to enter an infinite loop. This infinite loop consumes CPU cycles and can tie up application resources, resulting in a denial‑of‑service condition. The underlying weakness is classified as CWE‑835, an uncontrolled loop condition.

protobuf.js prior to versions 7.6.5 and 8.6.6 is affected. Any JavaScript or Node.js application that imports protobuf.js and loads .proto files from untrusted sources could be impacted, as the library will attempt to parse the malformed schema and risk resource exhaustion.

The 5.3 places the issue in the moderate severity range. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through input supplied to the protobuf.js parser; an attacker would need to deliver a specially crafted .proto file to a loading function. If successful, the infinite loop would tie up CPU resources and potentially interrupt the application, leading to service disruption.