7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44289

CVE-2026-44289: protobufjs: Denial of service through unbounded protobuf recursion

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44289

CVE-2026-44289:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
protobufjs	npm	<= 7.5.5	7.5.6
protobufjs	npm	>= 8.0.0, <= 8.0.1	8.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-44289, is a denial-of-service issue in protobuf.js caused by uncontrolled recursion. The root cause is the lack of a depth check when processing nested protobuf data structures. An attacker can craft a binary protobuf payload with deeply nested messages or groups. When an application using a vulnerable version of protobuf.js attempts to process this payload, several functions can enter into a deep recursion, ultimately exhausting the JavaScript call stack and crashing the process.

The analysis of the security patch identified four primary functions that were vulnerable to this uncontrolled recursion:

Reader.skipType: This function, used for skipping unknown fields, would recursively call itself for nested group fields without any depth limit.
Type.decode: The dynamically generated decoder for each message type would recursively call itself to decode nested messages, lacking a recursion depth check.
Type.verify: The dynamically generated verifier function would recursively verify nested message objects, also without a depth limit.
Type.fromObject: The dynamically generated function to convert a plain object to a message instance would recursively process nested objects without a depth limit.

The patch addresses this vulnerability by introducing a global recursion limit (util.recursionLimit). The identified functions and their underlying code generators were modified to accept a depth parameter, increment it for each level of nesting, and throw an error if the depth exceeds the defined limit. This effectively prevents the call stack from being exhausted by malicious inputs.

Vulnerable functions

Reader.skipType

src/reader.js

The `skipType` function is used to skip over fields that are not recognized during decoding. When skipping a 'group' field (wire type 3), the function recursively calls itself to handle nested fields within the group. Prior to the patch, this recursion was unbounded. An attacker could craft a protobuf message with deeply nested groups, causing `skipType` to recurse indefinitely until the call stack is exhausted, leading to a denial of service.

Type.decode

src/type.js

The `Type.decode` method is responsible for decoding a protobuf message from a binary reader. The actual decoding logic is dynamically generated for each message type. This generated code recursively calls `decode` for any nested messages. The vulnerability lies in this generated code, which, before the patch, did not limit the recursion depth. An attacker could provide a message with excessive nesting of sub-messages, leading to a stack overflow during decoding. The patch adds a depth parameter to the `decode` function and a check against a recursion limit in the code generator (`src/decoder.js`).

Type.verify

src/type.js

The `Type.verify` method checks if a given JavaScript object is a valid message of its type. Similar to `decode`, the verification logic is dynamically generated and recursively calls `verify` for nested message objects. Without a depth limit, verifying a malicious, deeply nested object could exhaust the call stack. The patch introduces a depth parameter and a recursion limit check in the code generator (`src/verifier.js`) to prevent this.

Type.fromObject

src/type.js

The `Type.fromObject` method converts a plain JavaScript object into a message instance. This process is recursive for nested objects that represent sub-messages. The code for this conversion is dynamically generated. Before the fix, there was no limit on the recursion depth, allowing an attacker to cause a stack overflow by providing a deeply nested object. The patch adds a depth counter and a limit to the generated `fromObject` function via the code generator in `src/converter.js`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.