What’s Vulnerable › Vulnerabilities

CVE-2026-41242: protobufjs has an arbitrary code execution issue

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-18 · updated 2026-09-09
• Weakness: CWE-94

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

Affected products

• protobufjs: before 7.5.5; 8.0.0 — fixed in 7.5.5

How to fix

Upgrade to a fixed version: protobufjs 7.5.5. Check the vendor advisory for mitigations.

References

• https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75
• https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1
• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg
• https://access.redhat.com/errata/RHSA-2026:21338
• https://access.redhat.com/errata/RHSA-2026:24977
• https://access.redhat.com/errata/RHSA-2026:26234
• https://access.redhat.com/errata/RHSA-2026:37275
• https://access.redhat.com/errata/RHSA-2026:62260
• https://access.redhat.com/security/cve/CVE-2026-41242
• https://bugzilla.redhat.com/show_bug.cgi?id=2459442

Get alerted when CVE-2026-41242 or the next vulnerability affects your stack