CVE-2026-44289: Protobufjs Project Protobufjs

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

Affected products

• Protobufjs Project Protobufjs: before 7.5.6 (fixed in 7.5.6); from 8.0.0, before 8.0.2 (fixed in 8.0.2)

Published 2026-05-13. Last modified 2026-08-28.