Executive brief
A vulnerability in a popular JavaScript library used for data serialization can allow an attacker to crash applications. By sending specially crafted, deeply nested data, an attacker can exhaust the system's memory or processing stack, leading to a denial-of-service. This affects any service that uses this library to process untrusted data from the internet.
Technical details
The protobufjs library fails to enforce a recursion depth limit when decoding nested protobuf binary payloads. This issue occurs during the decoding of nested message fields and when skipping unknown group fields. An unauthenticated remote attacker can provide a crafted binary payload containing deeply nested structures to trigger uncontrolled recursion, exhausting the JavaScript call stack and crashing the process. The vulnerability is fixed in versions 7.5.6 and 8.0.2. Red Hat has also identified several downstream products that incorporate the vulnerable library.
Affected products
- protobufjs protobuf.js < 7.5.6, >= 8.0.0 < 8.0.2
- Red Hat OpenShift Pipelines 1
- Red Hat Ansible Automation Platform 2 2
- Red Hat Build of Podman Desktop 1
- Red Hat Ceph Storage 9 9
- Red Hat Enterprise Linux 8 8
- Red Hat Enterprise Linux AI 3 3
- Red Hat OpenShift Container Platform 4 4
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published by dcodeIO
- 2026-05-13: disclosed: CVE-2026-44289 published
- 2026-05-13: patched: Fixes released in versions 7.5.6 and 8.0.2