An unauthenticated remote denial of service vulnerability in Google protobuf-javascript allows attackers to crash Node.js services by sending a maliciously crafted protobuf payload.

The library suffers from an uncontrolled recursion (CWE-674) when parsing unknown protobuf group fields. An unauthenticated attacker can trigger a stack overflow by sending a small, deeply nested START_GROUP wire byte sequence to the deserializeBinary() API.

This vulnerability poses a significant risk to availability, as it enables trivial, unauthenticated remote service disruption. With a CVSS score of 8.7, the flaw is classified as High severity. Successful exploitation results in immediate process crashes, which can lead to widespread application downtime and service degradation for any Node.js environment utilizing the affected library.

Immediate Action: Monitor the official GitHub security advisory at the provided reference link for the release of a patched version of the google-protobuf package.

Proactive Monitoring: Review application logs for unexpected crashes or error patterns associated with the deserializeBinary() function and evaluate network traffic for unusual protobuf wire-format payloads.

Compensating Controls: Implement input validation or size limits on incoming protobuf messages to reject deeply nested structures before they reach the deserialization logic.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for unauthenticated service disruption, organizations should prioritize monitoring for vendor updates. Once a fix is released, update the google-protobuf dependency immediately across all production Node.js services to neutralize the risk of process termination.