PT-2026-40535 · Npm · Protobufjs

Published 2026-05-12 · Updated 2026-05-13 · CVE-2026-44289

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.5.6 protobufjs versions prior to 8.0.2

Description protobufjs can recurse without a depth limit while decoding nested protobuf data, specifically when skipping unknown group fields and during the generated decoding of nested message fields. A crafted protobuf binary payload can exhaust the JavaScript call stack, leading to a process crash or decoding failure due to a stack overflow. This occurs when an application decodes untrusted protobuf binary input containing deeply nested structures, such as nested group tags or nested message fields.

Recommendations Update to version 7.5.6. Update to version 8.0.2. Avoid decoding untrusted protobuf binary data. Reject excessively nested messages at an outer protocol boundary where feasible. Isolate protobuf decoding in a process that can be safely restarted.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2026-44289

GHSA-685M-2W69-288Q

Affected Products

Protobufjs

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-44289 · Security Note
• https://osv.dev/vulnerability/GHSA-685m-2w69-288q · Vendor Advisory
• https://github.com/protobufjs/protobuf.js · Note
• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-685m-2w69-288q · Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2 · Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6 · Note