Cyber Resilience

CVE-2026-45740

Medium

Published: 13 May 2026

Published
13 May 2026
Modified
13 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0006 18.6th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-45740 is a medium-severity Uncontrolled Recursion (CWE-674) vulnerability in Protobufjs Project Protobufjs. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 18.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause…

more

the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.

CWE(s)
CWE-674

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Uncontrolled recursion in descriptor parsing enables direct application DoS via crafted input (CWE-674).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-44289Same product: Protobufjs Project Protobufjs
CVE-2026-44293Same product: Protobufjs Project Protobufjs
CVE-2026-44290Same product: Protobufjs Project Protobufjs
CVE-2026-41242Same product: Protobufjs Project Protobufjs
CVE-2026-44291Same product: Protobufjs Project Protobufjs
CVE-2026-34211Shared CWE-674
CVE-2026-39376Shared CWE-674
CVE-2026-32141Shared CWE-674
CVE-2026-32944Shared CWE-674
CVE-2025-70957Shared CWE-674

Affected Assets

protobufjs project
protobufjs
≤ 7.5.8 · 8.0.0 — 8.2.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CP-7 Alternate Processing Site
addresses: CWE-674

Supports resumption at alternate site when uncontrolled recursion causes primary site failure or crash.

SC-5 Denial-of-service Protection
addresses: CWE-674

Prevents uncontrolled recursion that exhausts stack or CPU resources.

References