CVE-2026-44289

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.5.6 protobufjs versions prior to 8.0.2

Description An issue exists in the decoding process of nested protobuf data where the library can recurse without a depth limit. This affects the generated decoding of nested message fields and the skipping of unknown group fields. A remote attacker can exploit this by sending a specially crafted protobuf binary payload, which leads to the exhaustion of the JavaScript call stack and results in a Denial of Service (DoS).

Recommendations Update to version 7.5.6. Update to version 8.0.2. Avoid decoding untrusted protobuf binary data. Reject excessively nested messages at an outer protocol boundary where feasible. Isolate protobuf decoding in a process that can be safely restarted.