CVE-2026-41242

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41242
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41242.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41242
Aliases
Downstream
Related
Published
2026-04-18T16:18:10.652Z
Modified
2026-07-16T03:30:56.751321402Z
Severity
  • 9.4 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
protobufjs has an arbitrary code execution issue
Details

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41242.json",
    "cwe_ids": [
        "CWE-94"
    ]
}
References

Affected packages

Git / github.com/protobufjs/protobuf.js

Affected ranges

Type
GIT
Repo
https://github.com/protobufjs/protobuf.js
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b7bdfaf91d7bf279326f2d043b633da0a2dbfe47
Introduced
933e8750dcd000c16a621a7344a4beaa034c4019
Fixed
535df444ac060243722ac5d672db205e5c531d75
Fixed
ff7b2afef8754837cc6dc64c864cd111ab477956
Fixed
6559b3df799abe061a8e3f0313972d60ad9e24a4
Database specific 
{
    "cpe": [
        "cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*",
        "cpe:2.3:a:protobufjs_project:protobufjs:8.0.0:*:*:*:*:node.js:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.5.5"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "last_affected": "8.0.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

6.*
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.3.0
6.3.1
6.4.0
6.4.1
6.4.2
6.4.3
6.4.4
6.4.5
6.4.6
6.5.0
6.5.1
6.5.2
6.5.3
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
8.*
8.0.0
protobufjs-cli-v1.*
protobufjs-cli-v1.0.0
protobufjs-cli-v1.0.1
protobufjs-cli-v1.0.2
protobufjs-cli-v1.1.0
protobufjs-cli-v1.1.1
protobufjs-cli-v1.1.2
protobufjs-cli-v1.1.3
protobufjs-cli-v1.1.4
protobufjs-cli-v1.2.0
protobufjs-cli-v2.*
protobufjs-cli-v2.0.0
protobufjs-v7.*
protobufjs-v7.0.0
protobufjs-v7.1.0
protobufjs-v7.1.1
protobufjs-v7.1.2
protobufjs-v7.2.0
protobufjs-v7.2.1
protobufjs-v7.2.2
protobufjs-v7.2.3
protobufjs-v7.2.4
protobufjs-v7.2.5
protobufjs-v7.2.6
protobufjs-v7.3.0
protobufjs-v7.3.1
protobufjs-v7.3.2
protobufjs-v7.3.3
protobufjs-v7.4.0
protobufjs-v7.5.0
protobufjs-v7.5.1
protobufjs-v7.5.2
protobufjs-v7.5.3
protobufjs-v7.5.4
protobufjs-v8.*
protobufjs-v8.0.0
v6.*
v6.10.0
v6.10.0-beta.0
v6.10.0-beta.1
v6.10.0-beta.2
v6.10.1
v6.10.1-beta.0
v6.10.2
v6.9.0
v6.9.0-beta.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41242.json"