PT-2026-33607 · Protobufjs · Protobufjs

Published 2026-04-18 · Updated 2026-04-18 · CVE-2026-41242

Mitre

CVSS v4.0

9.4

Critical

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-41242

Affected Products

Protobufjs

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-41242 · Security Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5 · Note
• https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75 · Note
• https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956 · Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1 · Note
• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg · Note