fix: bump protobufjs to 8.6.6 (CVE-2026-59877, DoS via infinite loop)

[Copilot]

protobufjs 8.6.3 has a moderate DoS vulnerability where a malformed .proto schema (option declaration without = assignment) causes the parser to loop indefinitely, blocking Node.js's single-threaded event loop until the process is killed.

Changes

• package.json: Bumps overrides.protobufjs from 8.6.3 → 8.6.6
• package-lock.json: Regenerated to resolve the patched version

Reachability Assessment

Not reachable — high confidence. The vulnerable APIs (parse, Root.load, Root.loadSync) are not called anywhere in the application. protobufjs is a transitive dependency used internally by direct dependencies against trusted, bundled schemas. This update addresses the scanner finding rather than an active exploit path.

Original prompt

---

This section details the Dependabot vulnerability alert you should resolve

<alert_title>protobufjs: Denial of Service via infinite loop in .proto option parsing</alert_title>
<alert_description>## Summary

protobufjs parsed option names by advancing through schema tokens until it reached an = token, without checking for end of input. A crafted .proto schema that opens an option declaration but ends prematurely could cause the option parser to loop without ever terminating.

This affects the reflection parsing path (parse, Root.load, Root.loadSync).

Impact

An attacker who can provide or influence .proto schema text parsed by an application may be able to cause the parsing call to never return. Because Node.js is single-threaded, the blocked event loop prevents all other work in the process, resulting in a denial of service that persists until the process is externally terminated.

Applications that only encode or decode protobuf binary data with trusted schemas are not directly affected.

Preconditions

• The application must parse .proto schema text influenced by an attacker.
• The schema must be parsed through APIs such as parse, Root.load, or Root.loadSync.
• The crafted input must begin an option declaration that ends before its = assignment.

Workarounds

Do not parse .proto schemas from untrusted sources with affected versions. If untrusted schema text must be accepted, isolate parsing in a process or worker that can be safely terminated and bound it with a timeout, so a non-returning parse call cannot deny service to the rest of the application.</alert_description>

moderate
GHSA-j3f2-48v5-ccww, CVE-2026-59877
protobufjs
npm
<vulnerable_versions>8.6.3</vulnerable_versions>
<patched_version>8.6.6</patched_version>
<manifest_path>package-lock.json</manifest_path>

https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww https://nvd.nist.gov/vuln/detail/CVE-2026-59877 https://github.com/protobufjs/protobuf.js/pull/2352 https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217 https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5 https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6 https://github.com/advisories/GHSA-j3f2-48v5-ccww

<task_instructions>Resolve this alert by updating the affected package to a non-vulnerable version. Prefer the lowest non-vulnerable version (see the patched_version field above) over the latest to minimize breaking changes. Include a Reachability Assessment section in the PR description. Review the alert_description field to understand which APIs, features, or configurations are affected, then search the codebase for usage of those specific items. If the vulnerable code path is reachable, explain how (which files, APIs, or call sites use the affected functionality) and note that the codebase is actively exposed to this vulnerability. If the vulnerable code path is not reachable, explain why (e.g. the affected API is never called, the vulnerable configuration is not used) and note that the update is primarily to satisfy vulnerability scanners rather than to address an active risk. If the advisory is too vague to determine reachability (e.g. 'improper input validation' with no specific API named), state that reachability could not be determined and explain why. Include a confidence level in the reachability assessment (e.g. high confidence if the advisory names a specific API and you confirmed it is or is not called, low confidence if the usage is indirect and hard to trace). If no patched version is available, check the alert_description field for a Workarounds section — the advisory may describe configuration changes or usage patterns that mitigate the vulnerability without a version update. If a workaround is available, apply it and leave a code comment referencing the advisory identifier explaining it is a temporary mitigation. If neither a patch nor a workaround is available, explain in the PR description why the alert cannot be resolved automatically so a human reviewer can take over. Inspect the repository to determine which package manager is used (e.g. lock files, config files, build scripts) and use that tooling to perform the update — do not edit lock files directly. If the version constraint in the manifest (e.g. package.json, Gemfile, pyproject.toml) caps the version below the fix, update the constraint first. For transitive dependencies, determine whether it is simpler to update the direct dependency that pulls in the vulnerable package or to update the transitive dependency directly, and choose the least disruptive approach. If upgra...

• Resolves github/copilot-survey-engine alert fix: bump protobufjs to 8.6.6 (CVE-2026-59877, DoS via infinite loop) #58

[Copilot]

Pull request overview

Updates protobufjs to the patched version resolving CVE-2026-59877.

Changes:

• Bumps the override from 8.6.3 to 8.6.6.
• Regenerates the lockfile resolution and integrity hash.

Show a summary per file

File	Description
package.json	Updates the protobufjs override.
package-lock.json	Locks protobufjs 8.6.6.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Medium