CVE-2018-3738 Denial of Service in protobufjs
Attackers can cause denial of service in applications using protobufjs by supplying crafted invalid .proto files that trigger excessive CPU consumption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-3738?
CVE-2018-3738 is a medium-severity denial of service vulnerability in HackerOne protobufjs node module, published on 7 Jun 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
Which versions are affected by CVE-2018-3738?
4 open source packages ship an affected version, including protobufjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
protobufjs npm | All versions | 5.0.3 |
protobufjs npm | All versions | 5.0.3 |
protobufjs npm | From 6.0.0 | 6.8.6 |
protobufjs npm | From 6.0.0 | 6.8.6 |
Products include Protobufjs Project Protobufjs.
How do I fix CVE-2018-3738?
Upgrade protobufjs to a fixed version for your release line: 5.0.3 or 6.8.6.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-3738 being exploited?
There is no known exploitation of CVE-2018-3738 in the wild and no public exploit code.
Other vulnerabilities in HackerOne protobufjs node module
- CVE-2023-36665 protobufjs Prototype Pollution vulnerability
- CVE-2026-41242 protobufjs has an arbitrary code execution issue
- CVE-2022-25878 Prototype Pollution
- CVE-2026-44291 protobufjs: Code generation gadget after prototype pollution
- CVE-2026-44293 protobufjs: Code injection through bytes field defaults in generated toObject code
Sources
Also known as CLSA-2026-1785291242, GHSA-762f-c2wg-m8c8.