CVE-2026-89418CWE-674

CVE-2026-89418

published September 17, 2026

CVSS
8.7
EPSS
0%
Percentile
19.1
In the wild
Unconfirmed
What it is

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00277 · 19.1th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-09-17T18:17Z
References (2)
https://github.com/protocolbuffers/protobuf-javascript/security/advisories/GHSA-5h29-r2cp-hfmr · [email protected]https://github.com/protocolbuffers/protobuf-javascript/security/advisories/GHSA-5h29-r2cp-hfmr · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 SEP 03:54Z
    EPSS moved — → 0%
    epss
  • 17 SEP 13:27Z
    Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)
    cvelistv5