Vulnerability Description
google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.
Related Weaknesses (CWE)
References
- https://github.com/protocolbuffers/protobuf-javascript/security/advisories/GHSA-
- https://github.com/protocolbuffers/protobuf-javascript/security/advisories/GHSA-
FAQ
What is CVE-2026-89418?
CVE-2026-89418 is a documented vulnerability. google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service ...
How severe is CVE-2026-89418?
CVSS scoring is not yet available for CVE-2026-89418. Check NVD for updates.
Is there a patch for CVE-2026-89418?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.