Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| protobufjs | protobuf.js | >= 7.0.0, < 7.5.5, >= 8.0.0-experimental, < 8.0.1, < 6.11.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jitsucom-jitsu-console | 2.11.0-r22 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.10.0-r20 | — |
| Wolfi rolling | langfuse-3 +1 | 3.164.0-r6 | — |
| Wolfi rolling | pulumi-language-nodejs | 3.229.0-r5 | — |
| Wolfi rolling | renovate | 43.138.3-r1 | — |
| Wolfi rolling | vitess-23 | 23.0.3-r15 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
Giangdurian/CVE-2026-41242 ★ 0 · Aug 7, 2026
-
4chech/CVE-2026-41242 ★ 0 · Apr 26, 2026
some simple node.js web app with PoC code for CVE-2026-41242
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | protobufjs | >= 8.0.0, < 8.0.1 | 8.0.1 | GHSA-xq3m-2v4x-88gg |
| npm | protobufjs | >= 7.0.0, < 7.5.5 | 7.5.5 | GHSA-xq3m-2v4x-88gg |
| npm | protobufjs | < 6.11.6 | 6.11.6 | GHSA-xq3m-2v4x-88gg |
Advisories 1
- WID-SEC-2026-1654 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 28, 2026
References
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg
- https://github.com/protobufjs/protobuf.js/commit/086916b4a52c9f73ce88956edbb38fc902e54bbf
- https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75
- https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956
- https://access.redhat.com/errata/RHSA-2026:21338
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:26234
- https://access.redhat.com/errata/RHSA-2026:37275
- https://access.redhat.com/errata/RHSA-2026:62260
- https://access.redhat.com/security/cve/CVE-2026-41242
- https://bugzilla.redhat.com/show_bug.cgi?id=2459442
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1
- https://github.com/protobufjs/protobuf.js/tree/v6.11.6
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41242.json