CVE-2026-89418 in protobuf-javascript
Riassunto
di MITRE • 17/09/2026
google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.
If you want to get best quality of vulnerability data, you may have to visit VulDB.