protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1,
    protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON.
    This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A
    crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack
    to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.
    (CVE-2026-48712)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0643 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-48712:
    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1,     protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON.
    This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A     crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack     to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.

    CVE-2026-10601:
    The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input     into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-     configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled     endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate     internal service data via Loki's CallResource which returns full HTTP response bodies.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
462195	Echo: protobufjs: security update to 7.6.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
462195	Echo: protobufjs: security update to 7.6.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
328381	TencentOS Server 4: grafana (TSSA-2026:0643)	Nessus	Tencent Local Security Checks	Local	medium
443192	SCA: security update for protobufjs (GHSA-wcpc-wj8m-hjx6)	Tenable Cloud Security	SCA Checks	Local	high
443192	SCA: security update for protobufjs (GHSA-wcpc-wj8m-hjx6)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-48712

high

Tenable Plugins

high

high

medium

high

high