Skip to content
fr Sign in
7.5 High

CVE-2026-44289 protobufjs compiles protobuf definitions into JavaScript (JS) functions

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

Affected products and versions

Product Affected versions Fixed in
protobuf.js 8.0 8.0.0 → < 8.0.2 8.0.2
protobuf.js 7.5 earliest → < 7.5.6 7.5.6
OpenShift Pipelines Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Build of Podman Desktop Versions not published
Red Hat Ceph Storage 9 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Show the 8 other branches
Product Affected versions Fixed in
Self-service automation portal 2 Versions not published
OpenShift Service Mesh 3 Versions not published
Red Hat Developer Hub Versions not published
Red Hat Hardened Images Versions not published
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat Ansible Automation Platform 2.2 1784622951 earliest → < 1784622951 1784622951
Red Hat OpenShift AI 3.4 1787250617 earliest → < 1787250617 1787250617

References

Timeline

  1. Published
  2. Last modified

Other CVEs of protobuf.js

The 16 CVEs of protobuf.js →
CVE-2026-59876 protobufjs compiles protobuf definitions into JavaScript (JS) functions 4.8 Medium CVE-2026-59877 protobufjs compiles protobuf definitions into JavaScript (JS) functions 5.3 Medium CVE-2026-54269 protobufjs compiles protobuf definitions into JavaScript (JS) functions 5.3 Medium CVE-2026-48712 protobufjs compiles protobuf definitions into JavaScript (JS) functions 7.5 High
Track this CVE