protobuf-javascript (aka google-protobuf npm package) vulnerabilities

1 known vulnerability in protobuf-javascript (aka google-protobuf npm package) from Google. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  protobuf-javascript (aka google-protobuf npm…: Uncontrolled Recursion

  CVE-2026-89418Sep 17, 2026Google

  google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a