← Vulnerability feed

Vulnerability record · CVE-2026-41242 · published 18 April 2026

CVE-2026-41242: Protobufjs project protobufjs code injection vulnerability

PProtobufjs Project · Protobufjs

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

9.4 CVSS 4.0 Critical EPSS 0.99% · top 39.0% CWE-94 · Code injection
9.4CVSS 4.0 base score
0.99%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
13References, 1 tagged exploit
9 Sep 2026Last modified by NVD

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75 Patch
https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956 Patch
https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5 ProductRelease Notes
https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1 ProductRelease Notes
https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg ExploitVendor Advisory
https://access.redhat.com/errata/RHSA-2026:21338
https://access.redhat.com/errata/RHSA-2026:24977
https://access.redhat.com/errata/RHSA-2026:26234
https://access.redhat.com/errata/RHSA-2026:37275
https://access.redhat.com/errata/RHSA-2026:62260
https://access.redhat.com/security/cve/CVE-2026-41242
https://bugzilla.redhat.com/show_bug.cgi?id=2459442
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41242.json

Track CVE-2026-41242 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-36665Protobufjs project protobufjs prototype pollution vulnerability"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-contr…EPSS 1.7%8.1CVE-2026-44291Protobufjs project protobufjs code injection vulnerabilityprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited proto…EPSS 0.42%7.7CVE-2026-44293Protobufjs project protobufjs code injection vulnerabilityprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conve…EPSS 0.73%7.5CVE-2026-59877Protobufjs project protobufjs vulnerabilityprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing throug…EPSS 0.67%7.5CVE-2026-48712Protobufjs project protobufjs vulnerabilityprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit whi…EPSS 0.46%7.5CVE-2026-45740Protobufjs project protobufjs vulnerabilityprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit whi…EPSS 0.46%7.5CVE-2026-44289Protobufjs project protobufjs vulnerabilityprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit whi…EPSS 0.68%7.5CVE-2026-44290Protobufjs project protobufjs prototype pollution vulnerabilityprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to …EPSS 0.50%

Source: NIST National Vulnerability Database (record CVE-2026-41242), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.