CVE-2026-44289
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Protobufjs before versions 7.5.6 and 8.0.2 lacks a depth limit when decoding nested protobuf data. A crafted binary payload can exhaust the JavaScript call stack, causing a crash.
Risk Assessment
An attacker can remotely crash an application using protobufjs, leading to denial of service.
Recommendation
Update protobufjs to version 7.5.6 or 8.0.2, which contain the fix.
Other vulnerabilities in protobufjs
See all- CVE-2026-41242Critical
A vulnerability in the protobufjs library allows arbitrary JavaScript code injection via 'type' fields in protobuf definitions. The code executes during object decoding. The issue is fixed in versions 8.0.1 and 7.5.5.
- CVE-2026-59877Medium
A vulnerability in the protobufjs library allows infinite looping when parsing specially crafted .proto files. The lack of end-of-input checking when processing options causes parse, Root.load, or Root.loadSync to loop indefinitely.
- CVE-2026-59876Medium
A vulnerability in the protobufjs library (versions 8.2.0 to 8.6.5) allows prototype pollution via parsing map entries in Text Format. An attacker can inject a map key named __proto__, which modifies the object prototype instead of creating a map entry.
- CVE-2026-54270Medium
Versions of protobufjs from 8.2.0 to 8.4.2 lacked options to discard unknown fields during decoding, which could lead to excessive memory usage by decoded messages. Version 8.5.0 introduced options to disable unknown field retention, and version 8.6.2 defaults to discarding unknown fields.
- CVE-2026-54269Medium
In versions prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. This could lead to deterministic exceptions or recursive calls in various operations related to decoding and serialization.
- CVE-2026-44293High
protobufjs before versions 7.5.6 and 8.0.2 generates JavaScript for the toObject function that may include an unsafe expression from a schema-controlled bytes field default value. A crafted descriptor can lead to arbitrary code execution.
Original NVD description (English source)
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.