PT-2026-40535 · Npm · Protobufjs

Osidb Bzimport · CVE-2026-44289 · Published 2026-05-12 · Updated 2026-07-03

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.5.6 protobufjs versions prior to 8.0.2

Description protobufjs can recurse without a depth limit while decoding nested protobuf data, specifically when skipping unknown group fields and during the generated decoding of nested message fields. A crafted protobuf binary payload can exhaust the JavaScript call stack, leading to a process crash or decoding failure due to a stack overflow. This occurs when an application decodes untrusted protobuf binary input containing deeply nested structures, such as nested group tags or nested message fields.

Recommendations Update to version 7.5.6. Update to version 8.0.2. Avoid decoding untrusted protobuf binary data. Reject excessively nested messages at an outer protocol boundary where feasible. Isolate protobuf decoding in a process that can be safely restarted.

Exploit

Fix

RCE

Uncontrolled Recursion

Weakness Enumeration

CWE-606

CWE-674

Related Identifiers

BDU:2026-09107

CVE-2026-44289

GHSA-685M-2W69-288Q

Affected Products

Protobufjs

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44289.json · Exploit
• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-685m-2w69-288q · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-09107 · Security Note
• https://osv.dev/vulnerability/CVE-2026-44289 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44289 · Security Note
• https://osv.dev/vulnerability/GHSA-685m-2w69-288q · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44289 · Vendor Advisory
• https://github.com/protobufjs/protobuf.js · Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2 · Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6 · Note
• https://twitter.com/dartilesm/status/2065419918829379883 · Twitter Post
• https://sentinelone.com/vulnerability-database/cve-2026-44289 · Note
• https://access.redhat.com/security/cve/CVE-2026-44289 · Note
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44289.json · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2477130 · Note