Unbounded Recursion Vulnerability in Google Protobuf for Node.js Services

CVE-2026-89418

What is CVE-2026-89418?

The Google Protobuf library is susceptible to unbounded recursion triggered during the parsing of unknown protobuf group fields. Attackers can exploit this vulnerability by sending a specifically crafted payload containing deeply nested START_GROUP wire bytes to any Node.js service that utilizes the generated deserializeBinary() API. This can result in a RangeError due to maximum call stack size being exceeded, potentially crashing the server process. Importantly, no authentication or previous knowledge of the schema is necessary for an attacker to exploit this vulnerability, highlighting its serious implications for affected applications.

References