CVE-2026-41242 protobufjs CVE debrief

Who should care

Developers and organizations using protobufjs in their applications should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to versions 8.0.1 or 7.5.5, or applying patches provided by the vendor. Additionally, users of Red Hat products may be affected, as indicated by the presence of Red Hat errata references.

Technical summary

The vulnerability in protobufjs allows for code injection through the 'type' fields of protobuf definitions. This can occur when an attacker can manipulate the protobuf definition used for decoding objects. The issue is due to insufficient validation of user input in the protobufjs library. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

This vulnerability has a high defensive priority due to its critical CVSS score and potential for code execution. Immediate action should be taken to mitigate this vulnerability.

Recommended defensive actions

• Upgrade to protobufjs version 8.0.1 or 7.5.5
• Apply patches provided by the vendor
• Review and update affected Red Hat products using the provided errata references
• Validate and sanitize user input to protobuf definitions
• Monitor for suspicious activity related to protobuf usage

Evidence notes

The CVE-2026-41242 vulnerability was publicly disclosed on April 18, 2026, and has since been modified on June 30, 2026. The vulnerability affects protobufjs versions prior to 8.0.1 and 7.5.5. Multiple sources, including NVD and Red Hat, have documented this vulnerability.

Official resources