CVE-2026-41242 — Vulnerability intelligence

protobufjs project — protobufjs

Published: 2026-04-18T16:18:10.652Z

CVSS

9.4

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue.

Sources

• CVE-2026-41242
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Patch
• Patch
• Product, Release Notes
• Product, Release Notes
• Exploit, Vendor Advisory
• Original advisory
• Original advisory
• CVE-2026-41242