CVE-2026-41242
CVE-2026-41242 · protobufjs has an arbitrary code execution issue
This page contains facts from public vulnerability sources. Check the original advisory before updating.
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
CVSS 9.4 · Critical · EPSS 0.8% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
protobuf.js
- Versions
- < 7.5.5: Affected
- >= 8.0.0-experimental, < 8.0.1: Affected
No fix published
protobufjs npm
- Affected ranges
- SEMVER: ≥ 8.0.0, < 8.0.1
Update to 8.0.1
protobufjs npm
- Affected ranges
- SEMVER: < 7.5.5
Update to 7.5.5
Original sources
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg
- https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75
- https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1
- https://access.redhat.com/security/cve/CVE-2026-41242
- https://bugzilla.redhat.com/show_bug.cgi?id=2459442
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41242.json
- https://access.redhat.com/errata/RHSA-2026:21338
- https://access.redhat.com/errata/RHSA-2026:26234
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:37275
- https://access.redhat.com/errata/RHSA-2026:62260
- https://nvd.nist.gov/vuln/detail/CVE-2026-41242