Denial of Service in protobufjs

GHSA-762f-c2wg-m8c8 · CVE-2018-3738

Published Oct 9, 2018 · Modified Nov 8, 2023

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Versions of protobufjs before 5.0.3 and 6.8.6 are vulnerable to a regular expression denial of service when parsing crafted invalid *.proto files.

Recommendation

Update to version 5.0.3, 6.8.6 or later.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2018-3738
WEB https://hackerone.com/reports/319576
ADVISORY https://github.com/advisories/GHSA-762f-c2wg-m8c8
WEB https://github.com/dcodeIO/protobuf.js/blob/6.8.5/src/parse.js#L27
WEB https://www.npmjs.com/advisories/605

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes