CVE-2026-41242
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
protobufjs versions prior to 8.0.1, 7.5.5, and 6.11.6 allow attackers to inject arbitrary code into the "type" fields of protobuf definitions. The injected code executes during object decoding using that definition.
Risk Assessment
If an application processes untrusted protobuf definitions, an attacker can execute arbitrary code in the Node.js process context, leading to application or server compromise.
Recommendation
Upgrade protobufjs to version 8.0.1, 7.5.5, or 6.11.6 (or later) and avoid compiling untrusted protobuf definitions.
Other vulnerabilities in protobufjs
See all- CVE-2026-59877Medium
A vulnerability in the protobufjs library allows infinite looping when parsing specially crafted .proto files. The lack of end-of-input checking when processing options causes parse, Root.load, or Root.loadSync to loop indefinitely.
- CVE-2026-59876Medium
A vulnerability in the protobufjs library (versions 8.2.0 to 8.6.5) allows prototype pollution via parsing map entries in Text Format. An attacker can inject a map key named __proto__, which modifies the object prototype instead of creating a map entry.
- CVE-2026-54270Medium
Versions of protobufjs from 8.2.0 to 8.4.2 lacked options to discard unknown fields during decoding, which could lead to excessive memory usage by decoded messages. Version 8.5.0 introduced options to disable unknown field retention, and version 8.6.2 defaults to discarding unknown fields.
- CVE-2026-54269Medium
In versions prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. This could lead to deterministic exceptions or recursive calls in various operations related to decoding and serialization.
- CVE-2026-44293High
protobufjs before versions 7.5.6 and 8.0.2 generates JavaScript for the toObject function that may include an unsafe expression from a schema-controlled bytes field default value. A crafted descriptor can lead to arbitrary code execution.
- CVE-2026-44289High
Protobufjs before versions 7.5.6 and 8.0.2 lacks a depth limit when decoding nested protobuf data. A crafted binary payload can exhaust the JavaScript call stack, causing a crash.
Original NVD description (English source)
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS