CVE-2026-89418: Google Protobuf-JavaScript Aka Google-Protobuf Npm Package

High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days.

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.

Affected products

• Google Protobuf-JavaScript Aka Google-Protobuf Npm Package: any version

Published 2026-09-17. Last modified 2026-09-18.