protobuf.js CVE-2026-44289

The application must decode protobuf binary data from attacker-controlled sources such as HTTP request bodies, WebSocket messages, message queue payloads, or uploaded files. The crafted input must contain deeply nested protobuf structures specifically nested group tags or nested message fields that trigger the recursive decoding path in protobuf.js versions 7.5.5 or earlier, or 8.0.0 through 8.0.1. Standard protobuf schema with nested message definitions is sufficient; no exotic language features or non-default configurations are required. Exploitation is NOT limited by authentication (PR:N in CVSS vector) and requires no user interaction (UI:N), meaning any network-accessible protobuf decoding endpoint is vulnerable. Rate limiting or input size restrictions do not prevent exploitation unless they specifically validate nesting depth. Applications using JSON encoding instead of binary protobuf, or those that do not decode external protobuf data, are not affected.

Real-world risk is moderate to high for applications exposing protobuf decoding to untrusted network input. CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates remote unauthenticated exploitation with low complexity targeting availability only. This aligns with a denial-of-service scenario rather than data breach or code execution. No EPSS score provided, no CISA KEV listing, and no public POC identified at time of analysis, suggesting exploitation is not yet widespread. However, the technical barrier is low - crafting deeply nested protobuf payloads is straightforward with standard protobuf libraries. Applications at highest risk include API gateways, microservices using gRPC-like protocols, message queue consumers, and file processing services that decode user-supplied protobuf data. The vulnerability is deterministic and easily weaponized once an attacker identifies a protobuf decoding endpoint. Patch availability in both 7.x and 8.x branches reduces urgency, but unmaintained dependencies downstream may delay fixes. The impact is limited to process crashes (recoverable with orchestration like Kubernetes) rather than persistent compromise, but repeated exploitation can sustain service outages.

An attacker identifies a microservice API endpoint that accepts protobuf-encoded requests for processing sensor data. They craft a malicious protobuf binary containing 10,000 levels of nested message fields using a standard protobuf compiler with custom schema. Sending this payload in an HTTP POST request causes the Node.js service to decode the binary, triggering unbounded recursion in protobuf.js. Within milliseconds, the JavaScript call stack exhausts available memory, crashing the service process with a stack overflow error. If the service lacks auto-restart mechanisms, it remains offline until manual intervention. An attacker can repeat this attack to sustain denial of service against all instances behind a load balancer.