Excessive Recursion in JavaScript Functions Affects Protobuf.js from Protobuf
CVE-2026-44289

7.5HIGH

Key Information:

Vendor

Protobufjs

Status
Protobuf.js
Vendor
CVE Published:
13 May 2026

What is CVE-2026-44289?

Protobuf.js is designed to compile protobuf definitions into JavaScript functions, enhancing the efficiency of data serialization and deserialization. However, prior to versions 7.5.6 and 8.0.2, the library allowed for excessive recursion when decoding nested protobuf data structures. This flaw could lead to JavaScript's call stack becoming exhausted, especially when processing specially crafted protobuf binary payloads, potentially leading to application instability. Users are advised to upgrade to newer versions to mitigate this risk.

Affected Version(s)

protobuf.js < 7.5.6 < 7.5.6

protobuf.js >= 8.0.0, < 8.0.2 < 8.0.0, 8.0.2

References

https://github.com/protobufjs/protobuf.js/security/adviso...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.