Saint Proto6

Technical record

Disclosed on

June 5 2026

CVE

CVE-2026-44289CVE-2026-44290CVE-2026-44291CVE-2026-44292CVE-2026-44294CVE-2026-44295

CVSS

8.7

Product

protobufjs · protobuf.js

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

Sources: cyera.com · youtube.com