Prototype Pollution DoS in protobufjs Schema Option Handling

This repository is a small standalone Python proof-of-concept for CVE-2026-44289, with the README also listing related CVEs affecting protobuf.js. The repository contains 6 files: a README, license, requirements, a CVE naming template, and one executable Python PoC file. The main and only code file, cve-2026-44289.py, implements a simplified recursive protobuf decoder class and a payload generator. Core capability: the PoC creates a deeply nested length-delimited protobuf-style payload using generate_deep_nested_payload(), then feeds it into VulnerableProtobufDecoder.decode(), which recursively decodes nested messages without a depth limit when run in vulnerable mode. This demonstrates uncontrolled recursion leading to RecursionError / simulated stack overflow, i.e., a denial-of-service condition. In safe mode, the same decoder is instantiated with a max_depth limit to show how the issue can be mitigated. Exploit structure: - VulnerableProtobufDecoder.decode(): recursively parses varint tags and length-delimited nested fields; the recursive self.decode(nested_data, depth + 1) call is the vulnerable behavior. - generate_deep_nested_payload(depth): constructs attacker-controlled nested binary input by repeatedly wrapping the previous payload in field 1, wire type 2. - _encode_varint(value): helper for protobuf-style varint encoding. - main(): CLI interface supporting payload generation and decode testing. Operationally, this is not a remote exploit and contains no shell, command execution, callback, or persistence logic. It is a local PoC / lab demonstrator for parser denial of service. No network services, IPs, or C2 endpoints are present. The only fingerprintable runtime artifact is the default payload file path payload.bin. The requirements file mentions protobuf and google-api-python-client, but the PoC itself relies only on Python standard library modules (argparse, sys, struct, typing). Overall, the repository’s purpose is educational demonstration of uncontrolled recursion in protobuf decoding rather than weaponized exploitation.