GHSA-685m-2w69-288q CVE-2026-44289
protobuf.js: Denial of service through unbounded protobuf recursion
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.63%
- Chance of exploitation in the next 30 days. Higher than 50.20% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-674 Uncontrolled Recursion
- Fix
7.5.6- Upgrade protobufjs to this version or later
Description
Summary
protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields.
A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding.
Impact
An attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause decoding to fail with a stack overflow.
This affects applications that decode untrusted protobuf binary input with affected versions.
Preconditions
- The application must decode protobuf binary data influenced by an attacker.
- The crafted input must contain deeply nested protobuf structures, such as nested group tags or nested message fields.
- The affected decoder path must process the crafted input.
Workarounds
Avoid decoding untrusted protobuf binary data with affected versions. If immediate upgrade is not possible, reject excessively nested messages at an outer protocol boundary where feasible, or isolate protobuf decoding in a process that can be safely restarted.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| protobufjs | < 7.5.6 |
7.5.6 |
| protobufjs | >= 8.0.0, < 8.0.2 |
8.0.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
protobufjs npm → 7.5.6
- npm
npm install protobufjs@7.5.6- yarn
yarn add protobufjs@7.5.6- pnpm
pnpm add protobufjs@7.5.6
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-674: Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
How to prevent it
- Implementation: Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
- Implementation: Increase the stack size.
References
Advisories
Packages
Other links
- github.com/protobufjs/protobuf.js/security/advisories/GHSA-685m-2w69-288q
- github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6
- github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2
- access.redhat.com/errata/RHSA-2026:42815
- access.redhat.com/errata/RHSA-2026:60520
- access.redhat.com/security/cve/CVE-2026-44289
- bugzilla.redhat.com/show_bug.cgi
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44289.json
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-j3f2-48v5-ccww protobufjs: Denial of Service via infinite loop in .proto option parsing | High | Also affects protobufjs |
| GHSA-jfj6-75fj-8934 protobufjs: Text Format string map parsing can mutate returned map object prototype | Medium | Also affects protobufjs |
| GHSA-94rc-8x27-4472 protobufjs: Memory amplification from preserved unknown fields in binary decode | Medium | Also affects protobufjs |
| GHSA-wcpc-wj8m-hjx6 protobufjs: Denial of service through unbounded Any expansion during JSON conversion | High | Also affects protobufjs |
| GHSA-f38q-mgvj-vph7 protobufjs : Schema-derived names can shadow runtime-significant properties | Medium | Also affects protobufjs |
| GHSA-jggg-4jg4-v7c6 protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion | High | Also affects protobufjs |
| GHSA-2pr8-phx7-x9h3 protobuf.js: Denial of service from crafted field names in generated code | Medium | Also affects protobufjs |
| GHSA-66ff-xgx4-vchm protobuf.js: Code injection through bytes field defaults in generated toObject code | High | Also affects protobufjs |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor