Every CVE Search/ Get API key

CVE-2026-44289

protobufjs: Denial of service through unbounded protobuf recursion

7.5 HighFix available

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.63%Up 0.6 points since May 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

protobufjs: Denial of service through unbounded protobuf recursion

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

Record
CVE-2026-44289
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-674, CWE-606
Updated
2026-11-02
EUVDEUVD-2026-30027 7.5

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

Record
EUVD-2026-30027
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-685m-2w69-288q 7.5

protobuf.js: Denial of service through unbounded protobuf recursion

Summary

protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields.

A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding.

Impact

An attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause decoding to fail with a stack overflow.

This affects applications that decode untrusted protobuf binary input with affected versions.

Preconditions

  • The application must decode protobuf binary data influenced by an attacker.
  • The crafted input must contain deeply nested protobuf structures, such as nested group tags or nested message fields.
  • The affected decoder path must process the crafted input.

Workarounds

Avoid decoding untrusted protobuf binary data with affected versions. If immediate upgrade is not possible, reject excessively nested messages at an outer protocol boundary where feasible, or isolate protobuf decoding in a process that can be safely restarted.

Record
GHSA-685m-2w69-288q
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-674
Updated
2026-11-02
NVD 7.5

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

Record
CVE-2026-44289
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-674, CWE-606
Updated
2026-11-02
OSV 7.5

protobufjs: Denial of service through unbounded protobuf recursion

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

Record
CVE-2026-44289
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-674
Updated
2026-11-02
OSVGHSA-685m-2w69-288q 7.5

protobuf.js: Denial of service through unbounded protobuf recursion

Summary

protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields.

A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding.

Impact

An attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause decoding to fail with a stack overflow.

This affects applications that decode untrusted protobuf binary input with affected versions.

Preconditions

  • The application must decode protobuf binary data influenced by an attacker.
  • The crafted input must contain deeply nested protobuf structures, such as nested group tags or nested message fields.
  • The affected decoder path must process the crafted input.

Workarounds

Avoid decoding untrusted protobuf binary data with affected versions. If immediate upgrade is not possible, reject excessively nested messages at an outer protocol boundary where feasible, or isolate protobuf decoding in a process that can be safely restarted.

Record
GHSA-685m-2w69-288q
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-674
Updated
2026-11-02
Show 13 moreShow less
OSVROOT-APP-NPM-CVE-2026-44289 7.5

CVE-2026-44289 in protobufjs - Patched by Root

Root has patched CVE-2026-44289 in the protobufjs package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-44289
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1779670111 No score

TuxCare security update for protobufjs (3 CVEs)

TuxCare rebuilt protobufjs to address 3 CVEs. Fixed in 6.11.6-tuxcare.3.

Record
CLSA-2026-1779670111
Updated
2026-11-02
OSVCLSA-2026-1784769544 No score

TuxCare security update for protobufjs (8 CVEs)

TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 2.2.1-tuxcare.1.

Record
CLSA-2026-1784769544
Updated
2026-11-02
OSVCLSA-2026-1785380788 No score

TuxCare security update for protobufjs (3 CVEs)

TuxCare rebuilt protobufjs to address 3 CVEs. Fixed in 1.5.1-tuxcare.1.

Record
CLSA-2026-1785380788
Updated
2026-11-02
OSVCLSA-2026-1785380800 No score

TuxCare security update for protobufjs (4 CVEs)

TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 0.12.13-tuxcare.1.

Record
CLSA-2026-1785380800
Updated
2026-11-02
OSVCLSA-2026-1785468075 No score

TuxCare security update for protobufjs (11 CVEs)

TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 6.8.8-tuxcare.1.

Record
CLSA-2026-1785468075
Updated
2026-11-02
OSVCLSA-2026-1785468077 No score

TuxCare security update for protobufjs (7 CVEs)

TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 5.0.0-tuxcare.2.

Record
CLSA-2026-1785468077
Updated
2026-11-02
OSVCLSA-2026-1791218903 No score

TuxCare security update for protobufjs (11 CVEs)

TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 7.4.0-tuxcare.1.

Record
CLSA-2026-1791218903
Updated
2026-11-02
OSVCLSA-2026-1791293603 No score

TuxCare security update for protobufjs (12 CVEs)

TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 8.0.0-tuxcare.1.

Record
CLSA-2026-1791293603
Updated
2026-11-02
OSVCLSA-2026-1791362263 No score

TuxCare security update for protobufjs (11 CVEs)

TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 8.0.1-tuxcare.1.

Record
CLSA-2026-1791362263
Updated
2026-11-02
OSVCLSA-2026-1792184156 No score

TuxCare security update for protobufjs (8 CVEs)

TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 6.11.3-tuxcare.2.

Record
CLSA-2026-1792184156
Updated
2026-11-02
OSVCLSA-2026-1792411164 No score

TuxCare security update for protobufjs (4 CVEs)

TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 7.5.4-tuxcare.1.

Record
CLSA-2026-1792411164
Updated
2026-11-02
OSVCLSA-2026-1792490720 No score

TuxCare security update for protobufjs (12 CVEs)

TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 3.8.2-tuxcare.1.

Record
CLSA-2026-1792490720
Updated
2026-11-02

Affected products

Show 4 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
protobufjs
npm
 through 7.5.5
7.5.6
protobufjs
npm
 8.0.0 to 8.0.1
8.0.2
protobufjs
TuxCare:npm
From an advisory covering 3 CVEs
 6.11.6-tuxcare.0 up to 6.11.6-tuxcare.3, plus listed versions
6.11.66.11.6-tuxcare.16.11.6-tuxcare.2
6.11.6-tuxcare.3
protobufjs
TuxCare:npm
From an advisory covering 8 CVEs
 2.2.1-tuxcare.0 up to 2.2.1-tuxcare.1, plus listed versions
2.2.1
2.2.1-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 3 CVEs
 1.5.1-tuxcare.0 up to 1.5.1-tuxcare.1, plus listed versions
1.5.1
1.5.1-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 4 CVEs
 0.12.13-tuxcare.0 up to 0.12.13-tuxcare.1, plus listed versions
0.12.13
0.12.13-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 11 CVEs
 6.8.8-tuxcare.0 up to 6.8.8-tuxcare.1, plus listed versions
6.8.8
6.8.8-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 7 CVEs
 5.0.0-tuxcare.0 up to 5.0.0-tuxcare.2, plus listed versions
5.0.05.0.0-tuxcare.1
5.0.0-tuxcare.2
protobufjs
TuxCare:npm
From an advisory covering 11 CVEs
 7.4.0-tuxcare.0 up to 7.4.0-tuxcare.1, plus listed versions
7.4.0
7.4.0-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 12 CVEs
 8.0.0-tuxcare.0 up to 8.0.0-tuxcare.1, plus listed versions
8.0.0
8.0.0-tuxcare.1
Show 8 moreShow less
Affected packages
PackageAffectedFixed
protobufjs
TuxCare:npm
From an advisory covering 11 CVEs
 8.0.1-tuxcare.0 up to 8.0.1-tuxcare.1, plus listed versions
8.0.1
8.0.1-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 8 CVEs
 6.11.3-tuxcare.0 up to 6.11.3-tuxcare.2, plus listed versions
6.11.36.11.3-tuxcare.1
6.11.3-tuxcare.2
protobufjs
TuxCare:npm
From an advisory covering 4 CVEs
 7.5.4-tuxcare.0 up to 7.5.4-tuxcare.1, plus listed versions
7.5.4
7.5.4-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 12 CVEs
 3.8.2-tuxcare.0 up to 3.8.2-tuxcare.1, plus listed versions
3.8.2
3.8.2-tuxcare.1
protobufjs
npm
 before 7.5.6
7.5.6
protobufjs
npm
 8.0.0 up to 8.0.2
8.0.2
protobufjs
Root:npm
 before 6.11.2-aikido.1
6.11.2-aikido.17.4.0-aikido.37.5.5-aikido.37.5.4-aikido.48.0.1-aikido.46.11.4-aikido.26.11.6-aikido.27.5.5-aikido.47.5.4-aikido.58.0.1-aikido.57.4.0-aikido.48.0.1-aikido.67.5.4-aikido.67.4.0-aikido.57.4.0-aikido.66.11.4-aikido.36.11.6-aikido.36.11.6-aikido.46.11.4-aikido.46.11.6-aikido.57.5.5-aikido.58.0.1-aikido.77.5.4-aikido.77.4.0-aikido.77.5.5-aikido.68.0.1-aikido.87.5.4-aikido.86.11.4-aikido.57.5.5-aikido.78.0.1-aikido.96.11.6-aikido.67.5.5-aikido.87.5.3-aikido.17.2.0-aikido.37.3.2-aikido.2
@rootio/protobufjs
Root:npm
 before 7.4.0-root.io.2
7.4.0-root.io.27.5.5-root.io.18.0.1-root.io.17.5.4-root.io.28.0.1-root.io.27.5.4-root.io.37.5.5-root.io.28.0.1-root.io.36.11.4-root.io.16.11.6-root.io.16.11.2-root.io.17.4.0-root.io.37.5.5-root.io.37.5.4-root.io.48.0.1-root.io.46.11.4-root.io.26.11.6-root.io.27.5.5-root.io.47.5.4-root.io.58.0.1-root.io.57.4.0-root.io.48.0.1-root.io.67.5.4-root.io.67.4.0-root.io.57.4.0-root.io.66.11.4-root.io.36.11.6-root.io.36.11.6-root.io.46.11.4-root.io.46.11.6-root.io.57.5.5-root.io.58.0.1-root.io.77.5.4-root.io.77.4.0-root.io.77.5.5-root.io.68.0.1-root.io.87.5.4-root.io.86.11.4-root.io.57.5.5-root.io.78.0.1-root.io.96.11.6-root.io.67.5.5-root.io.87.5.3-root.io.17.2.0-root.io.37.3.2-root.io.2

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-44289 is a high vulnerability (CVSS 7.5) in Protobufjs Project Protobufjs, published May 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in protobufjs 7.5.6.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open