HIGH 8.7 NVD

CVE-2026-89418

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.

References

https://github.com/protocolbuffers/protobuf-javascript/security/advisories/GHSA-5h29-r2cp-

Published: 2026-09-17 · Source: NVD · Feed updated: 2026-09-17

This high severity vulnerability with a CVSS score of 8.7 was published on 2026-09-17 via NVD.

vulnfeed aggregates 12865 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.