EUVD-2026-81523Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Node.js service accepting protobuf
-
DeliveryCraft deeply nested START_GROUP payload
-
ExploitSend small message to deserializeBinary endpoint
-
ExecutionTrigger unbounded recursion in unknown-field parser
-
PersistExceed V8 call stack (RangeError)
-
ImpactCrash process, denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against any Node.js service that calls the generated deserializeBinary() API of the google-protobuf (protobuf-javascript) package on attacker-supplied input. The only prerequisite is an endpoint that deserializes untrusted binary protobuf; a schema is not needed because the flaw is in unknown-group-field parsing. Limiting factors: the target must actually expose protobuf deserialization of external input (services parsing only trusted/internal payloads are not reachable), and impact is confined to process crash (availability), not data exposure or code execution. |
| Impact | This is a genuine, high-priority availability issue despite the absence of exploitation telemetry. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, 8.7) is internally consistent with the description: fully remote, no authentication, no user interaction, low complexity, and pure availability impact (VA:H) with no confidentiality or integrity loss - a classic unauthenticated DoS. CWE-674 (uncontrolled recursion) matches the described stack-overflow-via-nested-START_GROUP mechanism. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so real-world exploitation is 'no public exploit identified at time of analysis' - but the trigger is a trivially craftable wire payload (a stack of nested group markers), so weaponization difficulty is low and the high CVSS is credible rather than inflated. The main risk-lowering factor is impact ceiling: this crashes the process, it does not lead to code execution or data disclosure. Note one caveat: EUVD lists 'All versions' affected with no fixed version identified in the supplied references, so patch availability should be verified directly in the GHSA advisory (GHSA-5h29-r2cp-hfmr). |
| Exploit ScenarioDerived | An attacker sends a small crafted protobuf message consisting of many deeply nested START_GROUP wire-format tags to any internet-facing Node.js endpoint that deserializes untrusted protobuf via the generated deserializeBinary() API. The recursive unknown-field parser exceeds the V8 call-stack limit, throwing an uncaught RangeError that crashes the Node.js process. No authentication, valid schema, or prior knowledge is required, and repeated requests keep the service down; no public exploit code is referenced but the payload is trivial to construct. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Unbounded recursion in google-protobuf (the protobuf-javascript npm package) lets an unauthenticated, remote attacker crash any Node.js service that passes attacker-supplied bytes to a generated deserializeBinary() API - a few bytes encoding deeply nested unknown START_GROUP fields drive the parser into uncontrolled recursion until the call stack is exhausted and a RangeError: Maximum call stack size exceeded terminates the process. All published versions of the package are affected, and no schema knowledge is required because the flaw sits in the handling of unknown group fields rather than in any particular message definition. Impact is confined to availability (process crash) rather than confidentiality or integrity, and no public exploit identified at time of analysis; the practical prerequisite is an endpoint that deserializes untrusted binary protobuf, which makes this a high-priority denial-of-service issue for such deployments.
RemediationAI
No vendor-released patch version is identified in the available data at time of analysis; patch status is tracked in the upstream GitHub advisory GHSA-5h29-r2cp-hfmr (https://github.com/protocolbuffers/protobuf-javascript/security/advisories/GHSA-5h29-r2cp-hfmr), so upgrade google-protobuf to the first fixed release listed there as soon as one is published. Until a fix is deployed, the highest-value control is to stop letting untrusted bytes reach deserializeBinary(): where the endpoint only ever parses internal or otherwise trusted payloads, enforce that restriction, accepting the trade-off of lost functionality for external clients. Where hostile input must be accepted, place a strict wire-level pre-validator in front of the parser that rejects messages whose group nesting depth exceeds a small cap (on the order of 100 levels) and enforces a modest total message size, which neutralizes this payload class at the cost of maintaining a custom scanner and rejecting the rare legitimately deep message. Additionally, isolate parsing in a worker_thread or child process watched by a supervisor that restarts on failure, so a crash affects one request rather than the whole service - a trade-off of added latency, CPU overhead and lost in-flight work. Raising Node's stack size via --stack-size only shifts the depth threshold and does not remove the flaw, and signature-based WAF rules for nested START_GROUP bytes are easily evaded, so treat both as temporary measures. Finally, protect the deserialization endpoint with authentication, mTLS or strict rate limiting, and alert on RangeError and unexpected process exits so repeated crash attempts become visible.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-89418 is rooted in CWE-674 (Uncontrolled Recursion) inside the JavaScript protobuf runtime produced by protobuf-javascript and distributed as the google-protobuf npm package (CPE cpe:2.3:a:google:protobuf-javascript_(aka_google-protobuf_npm_package):*:*:*:*:*:*:*:*). The protobuf wire format encodes each field as a varint key that combines field number and wire type; wire types 3 (START_GROUP) and 4 (END_GROUP) belong to the legacy proto2 group construct, which is delimited by matching tags instead of a length prefix. When the generated deserializeBinary() parser meets a field it does not recognize, it takes the unknown-field path and, for group wire types, recurses into the nested group until it matches the corresponding END_GROUP. Because that recursion depth is controlled entirely by attacker-supplied bytes and the runtime applied no depth limit, a small payload of repeated START_GROUP keys consumes one stack frame per level until V8 throws RangeError: Maximum call stack size exceeded, an exception that is not handled and so terminates the Node.js process. Critically, the trigger does not depend on the service's own .proto schema: the wire type alone routes the input into the vulnerable unknown-group branch, so services that never define groups of their own remain reachable whenever they deserialize external binary protobuf. The vulnerability note is scoped to the JavaScript package identified by the CPE and vendor advisory rather than to other protobuf language implementations.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, low-complexity crafted payload with no user interaction; process crash yields A:H only, scope unchanged as the vulnerable process itself is affected.
Primary rating from Vendor (Google).
CVSS VectorVendor: Google
DescriptionCVE.org
google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.
Technical POC Analysis
CWE-674 (Uncontrolled Recursion) in the npm package google-protobuf, file binary/reader.js.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A flaw in the widely used google-protobuf JavaScript package (protobuf-javascript) allows a remote party to crash any Node.js service that decodes untrusted binary protobuf data, affecting every published version of the library with no vendor fix currently available. Because the defect lives in generic parsing of unknown group fields rather than in any specific message schema, every team that exposes a deserialization endpoint is potentially exposed, regardless of how their messages are defined. Leadership should treat this as an availability risk: a small amount of crafted input can take down production services, causing customer-facing outages and disrupting dependent systems, while confidentiality and integrity of data remain unaffected.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict maximum request/payload sizes at the edge so deeply nested payloads cannot be delivered; filter or reject unknown group START_GROUP wire-type fields in untrusted input before parsing; run deserialization in an isolated, supervised worker/sidecar process with bounded stack and memory so a RangeError crash does not terminate the primary service; apply aggressive rate limiting and monitoring/alerting on malformed protobuf traffic; and migrate affected deserialization paths to an alternative protobuf implementation such as protobufjs until an upstream fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB