Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-44289

protobufjs: Denial of service through unbounded protobuf recursion

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

protobufjs protobuf.js

  • < 7.5.6affected
  • >= 8.0.0, < 8.0.2affected

References