CVE-2026-89418
Published: September 17th, 2026
google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.
Unknown
CVSS v2:
CVSS v2:
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| daily | protobuf (3.0.0) | Needs Triage | ||
| 26.3 | protobuf (3.0.0) | Needs Triage | ||
| 26.2 | protobuf (3.0.0) | Needs Triage | ||
| 26.1 | protobuf (3.0.0) | Needs Triage | ||
| 25.4 | protobuf (3.0.0) | Needs Triage | ||
| 25.3 | protobuf (3.0.0) | Needs Triage | ||
| 25.2 | protobuf (3.0.0) | Needs Triage | ||
| 25.1 | protobuf (3.0.0) | Needs Triage | ||
| 24.4 | protobuf (3.0.0) | Needs Triage | ||
| 24.4.0 | protobuf (3.0.0) | Needs Triage | ||
| 24.3 | protobuf (3.0.0) | Needs Triage | ||
| 24.2 | protobuf (3.0.0) | Needs Triage | ||
| 24.1 | protobuf (3.0.0) | Needs Triage | ||
| 23.3 | protobuf (3.0.0) | Needs Triage | ||
| 23.2 | protobuf (3.0.0) | Needs Triage | ||
| 23.1 | protobuf (3.0.0) | Needs Triage | ||
| 22.4 | protobuf (3.0.0) | Needs Triage | ||
| 22.3 | protobuf (3.0.0) | Needs Triage | ||
| 22.2 | protobuf (3.0.0) | Needs Triage | ||
| 22.1 | protobuf (3.0.0) | Needs Triage | ||
| 21.11 | protobuf (3.0.0) | Needs Triage | ||
| 21.8 | protobuf (3.0.0) | Needs Triage | ||
| 21.5.0 | protobuf (3.0.0) | Needs Triage | ||
| 21.2.0 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.19.3667 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.18.3599 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.16.3445 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.15.3368 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.14.3263 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.13.3179 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.12.3054 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.11.3040 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.11.2990 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.10.2934 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.9.2878 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.8.2822 | protobuf (3.0.0) | Needs Triage |