Protobuf Javascript Aka Google Protobuf Npm Package
Monthly
Unbounded recursion in google-protobuf (the protobuf-javascript npm package) lets an unauthenticated, remote attacker crash any Node.js service that passes attacker-supplied bytes to a generated deserializeBinary() API - a few bytes encoding deeply nested unknown START_GROUP fields drive the parser into uncontrolled recursion until the call stack is exhausted and a RangeError: Maximum call stack size exceeded terminates the process. All published versions of the package are affected, and no schema knowledge is required because the flaw sits in the handling of unknown group fields rather than in any particular message definition. Impact is confined to availability (process crash) rather than confidentiality or integrity, and no public exploit identified at time of analysis; the practical prerequisite is an endpoint that deserializes untrusted binary protobuf, which makes this a high-priority denial-of-service issue for such deployments.
Unbounded recursion in google-protobuf (the protobuf-javascript npm package) lets an unauthenticated, remote attacker crash any Node.js service that passes attacker-supplied bytes to a generated deserializeBinary() API - a few bytes encoding deeply nested unknown START_GROUP fields drive the parser into uncontrolled recursion until the call stack is exhausted and a RangeError: Maximum call stack size exceeded terminates the process. All published versions of the package are affected, and no schema knowledge is required because the flaw sits in the handling of unknown group fields rather than in any particular message definition. Impact is confined to availability (process crash) rather than confidentiality or integrity, and no public exploit identified at time of analysis; the practical prerequisite is an endpoint that deserializes untrusted binary protobuf, which makes this a high-priority denial-of-service issue for such deployments.