CVE-2026-59877: Parser Hang Affects Splunk and protobufjs; Fixed Versions Released

CVE-2026-59877 concerns a parsing flaw in protobufjs-based schema handling, where a malformed option declaration can cause the parser to stall and block a Node.js event loop. The vulnerable APIs named in the advisory are parse, Root.load, and Root.loadSync, and the reported trigger is an option line that ends before an equals sign. Splunk Enterprise branches 10.4.0 through 10.4.3, 10.2.0 through 10.2.7, 10.0.0 through 10.0.10, and 9.4.0 through 9.4.15 are affected, with fixed builds 10.4.4, 10.2.8, 10.0.11, and 9.4.16. Upstream protobufjs versions 7.5.0 through 7.6.4 and 8.0.0 through 8.6.5 are affected, with fixes in 7.6.5 and 8.6.6, and standalone applications embedding older releases need separate remediation. The available record does not establish widespread exploitation, so responders are advised to treat the issue as a denial-of-service risk and assess whether untrusted input could reach the parser.