Log in Start free

Vulnerability · Published May 13, 2026 · Assigned by GitHub_M

CVE-2026-44289protobufjs: Denial of service through unbounded protobuf recursion

High 7.5

In plain English

A high-severity security flaw in protobuf.js from protobufjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 49.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmprotobufjs7.5.6GHSA-685m-2w69-288q
npmprotobufjs8.0.2GHSA-685m-2w69-288q

Affected products (as reported)

VendorProductVersions
protobufjs protobuf.js < 7.5.6>= 8.0.0, < 8.0.2

Weakness: CWE-674, CWE-606 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References