CVE-2026-89418 in protobuf-javascript
Summary
by MITRE • 09/17/2026
google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in google-protobuf represents a critical denial-of-service risk stemming from unbounded recursion during the parsing of Protocol Buffer messages. Specifically, the flaw resides within the handling of unknown protobuf group fields when processed by Node.js services utilizing the generated deserializeBinary API. The core technical issue is that the parser does not enforce depth limits on nested START_GROUP wire bytes, allowing an attacker to construct a payload with arbitrarily deep nesting levels. When such a crafted message is received and parsed, the recursive nature of the parsing logic causes the JavaScript call stack to grow exponentially until it exceeds the maximum allowed size defined by the V8 engine or Node.js runtime environment. This results in a RangeError indicating that the maximum call stack size has been exceeded, which inevitably leads to an unhandled exception and the immediate termination of the process hosting the service.
From a security operations perspective, this vulnerability is particularly dangerous because it requires no authentication and does not depend on prior knowledge of the specific protobuf schema being used by the target application. The attacker only needs to understand the binary wire format of Protocol Buffers, specifically how group fields are encoded using START_GROUP markers. This low barrier to entry makes the exploit widely applicable against any service that accepts raw Protobuf data without strict input validation or depth limiting mechanisms in place. The impact is a complete denial of service for the affected Node.js instance, as the crash prevents further processing of legitimate requests until the process is restarted by an external supervisor or orchestration layer.
This flaw aligns with CWE-674, which describes uncontrolled recursion that can lead to stack overflow conditions. In terms of offensive security frameworks, this vulnerability facilitates attacks categorized under MITRE ATT&CK technique T1499, specifically Endpoint Denial of Service via resource exhaustion. The attacker leverages the application's own parsing logic against it, consuming computational resources and memory through deep call stacks rather than attempting to execute arbitrary code or exfiltrate data directly. While the immediate impact is service disruption, repeated exploitation could also contribute to broader availability issues in distributed systems if multiple nodes are targeted simultaneously.
Mitigation strategies must focus on implementing strict limits on parsing depth within the Protobuf library configuration or by wrapping the deserializeBinary calls with try-catch blocks that gracefully handle stack overflow errors without crashing the entire process. Upgrading to a patched version of google-protobuf where this recursion limit is enforced is the primary remediation path. Additionally, network-level defenses such as rate limiting and payload size restrictions can help mitigate the frequency of attacks, although they do not address the root cause within the application logic itself. Security teams should also monitor for sudden spikes in error logs related to RangeError or process crashes to detect potential exploitation attempts early.