CVE-2026-89418: Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)
google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested STARTGROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Node.js services are exposed if they call the generated deserializeBinary() API on protobuf data that an attacker can supply.
What access does an attacker need to trigger the denial of service?
No authentication is required, and the attacker does not need prior knowledge of the protobuf schema. They need to send a crafted payload containing deeply nested START_GROUP wire bytes to a reachable deserialization path.
How can I tell whether a service may have been affected?
A successful attempt causes the Node.js process to throw "RangeError: Maximum call stack size exceeded" and crash while parsing protobuf input.