Uncontrolled Recursion in protobuf.js - CVE-2026-44289
Published: May 12, 2026
Vulnerability identifier: #VU131167
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44289
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in the protobuf decoder when decoding nested protobuf binary data. A remote attacker can send a specially crafted protobuf binary payload to cause a denial of service.
This affects applications that decode untrusted protobuf binary input, including decoder paths that skip unknown group fields or decode nested message fields.
Affected software
protobuf.js
How to mitigate CVE-2026-44289
Install security update from vendor's website.
protobuf.js - addressed in versions 7.5.6, 8.0.2