{"id":"EUVD-2026-42310","revision":"e84ec79b78ca40a58cc6f3370230307c","records":[{"revision":"e84ec79b78ca40a58cc6f3370230307c","observedAt":"2026-10-30T10:51:58.387+00:00","statement":{"source":"euvd","id":"EUVD-2026-42310","aliases":["CVE-2026-59877","GHSA-j3f2-48v5-ccww"],"title":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .…","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww","https://github.com/protobufjs/protobuf.js/pull/2352","https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217","https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f","https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5","https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42310","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 8, 2026, 3:28:07 PM","dateUpdated":"Jul 8, 2026, 3:49:27 PM"},"relatedAdvisories":[{"id":"RHSA-2026:57590","title":"Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2026-9595","CVE-2026-12143","CVE-2026-13149","CVE-2026-13676","CVE-2026-14257","CVE-2026-34986","CVE-2026-42338","CVE-2026-42570","CVE-2026-44705","CVE-2026-45623","CVE-2026-45736","CVE-2026-45740","CVE-2026-48068","CVE-2026-48779","CVE-2026-48801","CVE-2026-49978","CVE-2026-56876","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59877","CVE-2026-69152","CVE-2026-69153","CVE-2026-69192"]},{"id":"RHSA-2026:60477","title":"Red Hat Security Advisory: OpenShift Container Platform 4.21.31 bug fix and security update","vulnerabilityIds":["CVE-2026-12143","CVE-2026-33814","CVE-2026-39829","CVE-2026-42151","CVE-2026-46597","CVE-2026-48801","CVE-2026-54423","CVE-2026-59869","CVE-2026-59877","CVE-2026-66138","CVE-2026-69152","CVE-2026-73086"]},{"id":"RHSA-2026:52768","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.8 release.","vulnerabilityIds":["CVE-2026-5038","CVE-2026-5079","CVE-2026-13149","CVE-2026-46625","CVE-2026-48068","CVE-2026-48069","CVE-2026-48712","CVE-2026-49978","CVE-2026-59869","CVE-2026-59877","CVE-2026-59892"]},{"id":"RHSA-2026:71179","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update","vulnerabilityIds":["CVE-2025-57847","CVE-2025-66418","CVE-2026-12564","CVE-2026-14257","CVE-2026-15307","CVE-2026-33818","CVE-2026-42215","CVE-2026-42284","CVE-2026-42504","CVE-2026-44244","CVE-2026-49825","CVE-2026-53488","CVE-2026-53492","CVE-2026-54284","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59877","CVE-2026-59893","CVE-2026-67322","CVE-2026-67323","CVE-2026-67325","CVE-2026-69152","CVE-2026-69153","CVE-2026-69244","CVE-2026-71458","CVE-2026-71459","CVE-2026-71460","CVE-2026-71462","CVE-2026-71463","CVE-2026-71464","CVE-2026-71465","CVE-2026-71491","CVE-2026-73086","CVE-2026-73620","CVE-2026-73622","CVE-2026-73623","CVE-2026-73624","CVE-2026-73625","CVE-2026-75884","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-76218","CVE-2026-76219","CVE-2026-76220","CVE-2026-76221","CVE-2026-76222","CVE-2026-78676","CVE-2026-78679","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84470","CVE-2026-84474","CVE-2026-84486","CVE-2026-84499","CVE-2026-84502","CVE-2026-84638","CVE-2026-84643","CVE-2026-84644","CVE-2026-84679","CVE-2026-84680","CVE-2026-84683","CVE-2026-84684","CVE-2026-84686","CVE-2026-84689","CVE-2026-84691","CVE-2026-84692","CVE-2026-84703","CVE-2026-84706","CVE-2026-84707","CVE-2026-84708","CVE-2026-84709","CVE-2026-84711","CVE-2026-84712","CVE-2026-84714","CVE-2026-84716","CVE-2026-84717","CVE-2026-84718","CVE-2026-84719","CVE-2026-84720","CVE-2026-84724","CVE-2026-85393","CVE-2026-87817"]},{"id":"RHSA-2026:49642","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 release.","vulnerabilityIds":["CVE-2026-5038","CVE-2026-5079","CVE-2026-13149","CVE-2026-13676","CVE-2026-42504","CVE-2026-45740","CVE-2026-46625","CVE-2026-48068","CVE-2026-48069","CVE-2026-48801","CVE-2026-49978","CVE-2026-59869","CVE-2026-59877","CVE-2026-59892"]},{"id":"RHSA-2026:51162","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update","vulnerabilityIds":["CVE-2026-13149","CVE-2026-44902","CVE-2026-45740","CVE-2026-48068","CVE-2026-48801","CVE-2026-59873","CVE-2026-59877"]},{"id":"RHSA-2026:57365","title":"Red Hat Security Advisory: OpenShift Container Platform 4.22.11 bug fix and security update","vulnerabilityIds":["CVE-2026-14257","CVE-2026-27136","CVE-2026-33186","CVE-2026-33814","CVE-2026-39829","CVE-2026-59869","CVE-2026-59877","CVE-2026-66138","CVE-2026-69152","CVE-2026-73086"]},{"id":"RHSA-2026:68333","title":"Red Hat Security Advisory: Red Hat build of Cryostat security update","vulnerabilityIds":["CVE-2026-15075","CVE-2026-15076","CVE-2026-16308","CVE-2026-33818","CVE-2026-41178","CVE-2026-45112","CVE-2026-48586","CVE-2026-49978","CVE-2026-54399","CVE-2026-54428","CVE-2026-55831","CVE-2026-55833","CVE-2026-55851","CVE-2026-55874","CVE-2026-55969","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-56854","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-58372","CVE-2026-59869","CVE-2026-59877","CVE-2026-59899","CVE-2026-68494","CVE-2026-69152","CVE-2026-69192"]},{"id":"RHSA-2026:62260","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.0 Release.","vulnerabilityIds":["CVE-2025-55163","CVE-2026-8286","CVE-2026-9277","CVE-2026-9547","CVE-2026-9563","CVE-2026-10050","CVE-2026-10051","CVE-2026-12143","CVE-2026-12151","CVE-2026-13149","CVE-2026-15075","CVE-2026-15076","CVE-2026-27136","CVE-2026-34986","CVE-2026-39820","CVE-2026-39831","CVE-2026-39835","CVE-2026-40898","CVE-2026-40983","CVE-2026-40984","CVE-2026-41242","CVE-2026-41695","CVE-2026-41716","CVE-2026-42264","CVE-2026-42499","CVE-2026-44705","CVE-2026-45149","CVE-2026-45416","CVE-2026-45623","CVE-2026-45674","CVE-2026-46597","CVE-2026-46681","CVE-2026-47691","CVE-2026-48020","CVE-2026-48068","CVE-2026-48491","CVE-2026-49978","CVE-2026-50010","CVE-2026-50193","CVE-2026-53488","CVE-2026-53492","CVE-2026-53622","CVE-2026-54399","CVE-2026-54428","CVE-2026-54512","CVE-2026-54513","CVE-2026-54763","CVE-2026-55831","CVE-2026-55833","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-59296","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59877","CVE-2026-59888","CVE-2026-59899","CVE-2026-65600","CVE-2026-65601","CVE-2026-67213","CVE-2026-67214","CVE-2026-68494","CVE-2026-69152","CVE-2026-69153","CVE-2026-73086","CVE-2026-73566","CVE-2026-73646","CVE-2026-75838"]},{"id":"WID-SEC-W-2026-2618","title":"IBM App Connect Enterprise: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-11525","CVE-2026-12151","CVE-2026-13676","CVE-2026-53550","CVE-2026-54285","CVE-2026-59869","CVE-2026-59877","CVE-2026-6733","CVE-2026-6734","CVE-2026-9675","CVE-2026-9678","CVE-2026-9679","CVE-2026-9697"]},{"id":"RHSA-2026:50839","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update","vulnerabilityIds":["CVE-2026-48068","CVE-2026-59877"]},{"id":"RHSA-2026:67279","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update","vulnerabilityIds":["CVE-2025-57847","CVE-2026-12564","CVE-2026-14257","CVE-2026-15307","CVE-2026-42215","CVE-2026-42284","CVE-2026-42504","CVE-2026-44244","CVE-2026-49825","CVE-2026-54284","CVE-2026-59877","CVE-2026-59893","CVE-2026-67322","CVE-2026-67323","CVE-2026-67325","CVE-2026-69152","CVE-2026-69153","CVE-2026-69243","CVE-2026-69244","CVE-2026-71491","CVE-2026-73620","CVE-2026-73622","CVE-2026-73623","CVE-2026-73624","CVE-2026-73625","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-78679","CVE-2026-84375"]},{"id":"RHSA-2026:49680","title":"Red Hat Security Advisory: Kiali 2.22.8 for Red Hat OpenShift Service Mesh 3.3","vulnerabilityIds":["CVE-2026-49978","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59877"]},{"id":"RHSA-2026:49735","title":"Red Hat Security Advisory: Kiali 2.27.2 for Red Hat OpenShift Service Mesh 3.4","vulnerabilityIds":["CVE-2026-49978","CVE-2026-59877"]},{"id":"RHSA-2026:50850","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 security update","vulnerabilityIds":["CVE-2026-9277","CVE-2026-43997","CVE-2026-43998","CVE-2026-43999","CVE-2026-44000","CVE-2026-44001","CVE-2026-44002","CVE-2026-44003","CVE-2026-44004","CVE-2026-44005","CVE-2026-44006","CVE-2026-44007","CVE-2026-44008","CVE-2026-44009","CVE-2026-45411","CVE-2026-47131","CVE-2026-47135","CVE-2026-47137","CVE-2026-47139","CVE-2026-47140","CVE-2026-47141","CVE-2026-47209","CVE-2026-48068","CVE-2026-48801","CVE-2026-59877"]},{"id":"RHSA-2026:48126","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.","vulnerabilityIds":["CVE-2026-5038","CVE-2026-5079","CVE-2026-13149","CVE-2026-13676","CVE-2026-45740","CVE-2026-46625","CVE-2026-48068","CVE-2026-48069","CVE-2026-48801","CVE-2026-49978","CVE-2026-59869","CVE-2026-59877"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-42310","identifiers":["EUVD-2026-42310","CVE-2026-59877","GHSA-j3f2-48v5-ccww"]},"retained":false,"historicalAffected":[]}],"coverage":[]}