CVE-2026-41242
criticalprotobufjs compiles protobuf definitions into JavaScript (JS) functions.
Vendor / product: Protobufjs Project — protobufjs
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-04-18 17:16
Modified: 2026-09-09 13:19
NVD status: Modified
Last synced 3 days ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
protobufjs_project / protobufjs <7.5.5, 8.0.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75 security-advisories@github.com
- https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956 security-advisories@github.com
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5 security-advisories@github.com
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1 security-advisories@github.com
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg security-advisories@github.com
- https://access.redhat.com/errata/RHSA-2026:21338 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:24977 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:26234 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:37275 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:62260 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/security/cve/CVE-2026-41242 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://bugzilla.redhat.com/show_bug.cgi?id=2459442 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41242.json 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗