CVE-2026-89418

HighCVSS 8.7

Published: 17/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

31th percentile - higher than 31% of all known CVEs

Summary

google-protobuf contains unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to a Node.js service calling deserializeBinary(), causing a RangeError: Maximum call stack size exceeded and crashing the process.

Risk Assessment

A remote unauthenticated attack can cause denial of service, affecting application availability.

Recommendation

Upgrade google-protobuf to a patched version. Limit access to services processing untrusted protobuf data.

Other vulnerabilities in google-protobuf

CVE-2024-24786High
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This can occur when unmarshaling into a message containing a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

Original NVD description (English source)

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS