← CVE Intelligence

CVE-2026-89418

Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf) PUBLISHED

Description (CNA)

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.

Affected (CNA)

Vendor / productVersions
Google / protobuf-javascript (aka google-protobuf npm package)affected All versions

CWE

CWE-674

References

ADP enrichment

CISA-ADP

No English description supplied.