CyberRota Analysis
AI-GeneratedThe vulnerability in google-protobuf allows an attacker to exploit unbounded recursion when parsing unknown protobuf group fields, leading to a RangeError that can crash any Node.js service using the deserializeBinary() API. This issue poses a significant risk as it does not require authentication or knowledge of the schema, making it accessible for exploitation. Organizations utilizing Node.js services that rely on google-protobuf should prioritize addressing this vulnerability to prevent potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.