protobuf-javascript_aka_google-protobuf_npm_package vulnerabilities

CVEs whose affected-version data names the protobuf-javascript_aka_google-protobuf_npm_package package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-89418High· 8.7PoC

6d ago

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeB…

▾ MidnightGoogle · protobuf-javascript (aka google-protobuf npm package)EPSS 0.37%via NVD