CVE-2026-44289: protobufjs: Denial of service through unbounded protobuf recursion
Summary
protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields.
A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding.
Impact
An attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause decoding to fail with a stack overflow.
This affects applications that decode untrusted protobuf binary input with affected versions.
Preconditions
- The application must decode protobuf binary data influenced by an attacker. - The crafted input must contain deeply nested protobuf structures, such as nested group tags or nested message fields. - The affected decoder path must process the crafted input.
Workarounds
Avoid decoding untrusted protobuf binary data with affected versions. If immediate upgrade is not possible, reject excessively nested messages at an outer protocol boundary where feasible, or isolate protobuf decoding in a process that can be safely restarted.
Other sources
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/protobufjsto a version that resolves this vulnerability.Fixed in 8.0.2 - Upgrade
Upgrade
npm/protobufjsto a version that resolves this vulnerability.Fixed in 7.5.6 - Upgrade
Upgrade
protobufjsto a version that resolves this vulnerability.Fixed in 7.5.6 - Upgrade
Upgrade
protobufjsto a version that resolves this vulnerability.Fixed in 8.0.2 - Configuration
Ensure the outer protocol boundary applies a maximum allowed nesting depth for protobuf structures so crafted deeply nested group tags or nested message fields are rejected before protobufjs decoding.
Application protocol boundary that receives protobuf binary data Nested protobuf message depth limits (reject excessively nested inputs) = enforce a depth limit by rejecting excessively nested messages - Compensating control
If immediate upgrade is not possible, reject excessively nested protobuf messages at an outer protocol boundary where feasible to prevent unbounded recursion during protobufjs decoding.
- Compensating control
If immediate upgrade is not possible, isolate protobuf decoding in a separate process that can be safely restarted to limit impact from stack overflow.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44289?
CVE-2026-44289 is considered a high severity vulnerability due to potential stack exhaustion during decoding.
How do I fix CVE-2026-44289?
To fix CVE-2026-44289, upgrade to protobufjs version 8.0.2 or 7.5.6.
What types of applications are affected by CVE-2026-44289?
Applications that utilize protobufjs versions from 8.0.0 to 8.0.1 and up to 7.5.5 are affected by CVE-2026-44289.
What can happen if CVE-2026-44289 is exploited?
Exploitation of CVE-2026-44289 can lead to a denial of service due to JavaScript call stack exhaustion.
Who should be concerned about CVE-2026-44289?
Developers and application maintainers using vulnerable versions of protobufjs should be concerned about CVE-2026-44289.