← Database

CVE-2026-41242

CRITICAL CVSS: 9.8 Published: 2026-04-18 Modified: 2026-07-15

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

Affected Platforms

Protobufjs Project Protobufjs

Weakness Type

CWE-94, CWE-94

References