GHSA-762f-c2wg-m8c8MediumCVSS 5.5

Denial of Service in protobufjs

Published
October 9, 2018
Last Modified
April 11, 2023

🔗 CVE IDs covered (1)

CVE-2018-3738 →

📋 Description

Versions of protobufjs before 5.0.3 and 6.8.6 are vulnerable to a regular expression denial of service when parsing crafted invalid *.proto files.

Recommendation

Update to version 5.0.3, 6.8.6 or later.

🎯 Affected products2

  • npm/protobufjs:>= 6.0.0, < 6.8.6
  • npm/protobufjs:< 5.0.3

🔗 References (5)