CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2026-44289
High (7.5) in protobufjs project protobufjs. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in protobufjs 7.5.6, 8.0.2.
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-674, CWE-606
- Published
- Modified
- Record from
- the NVD, synced
Affected
- protobufjs_project:protobufjs
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-685m-2w69-288q | npm | protobufjs | <7.5.6 | 7.5.6 |
| GHSA-685m-2w69-288q | npm | protobufjs | >=8.0.0 <8.0.2 | 8.0.2 |