CVE-2026-89418
Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.
| CWE | CWE-674 |
| Vendor | |
| Product | protobuf-javascript (aka google-protobuf npm package) |
| Ecosystems | |
| Industries | Technology |
| Published | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for google protobuf-javascript (aka google-protobuf npm package)
Be the first to know when new unknown vulnerabilities affecting google protobuf-javascript (aka google-protobuf npm package) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Google / protobuf-javascript (aka google-protobuf npm package)
All versions
References
Credits
EQSTLab&@232-323