CVE-2026-41242: protobufjs code injection in protobuf type fields
protobufjs, a JavaScript library that compiles protobuf definitions into functions, has a code injection weakness (CWE-94) where attacker-controlled content in type fields can run during object decoding. The NVD base score is 9.8, and the record lists fixed releases 7.5.5 and 8.0.1. The record shows no KEV listing and the consulted sources confirm no active exploitation.
Overview
protobufjs turns protobuf schema definitions into JavaScript functions used to encode and decode messages. The record describes a code injection weakness (CWE-94) in the type fields of those definitions, where injected content can execute when an object is decoded with the affected definition.
Impact
- The NVD assessment rates confidentiality, integrity and availability impact as high, with a base score of 9.8.
- GitHub, as a CNA, lists a score of 9.4 for the same issue.
- Inference: applications that accept protobuf definitions from untrusted sources, or decode data with such definitions, are the most exposed.
Affected products and versions
- The record lists two product entries. For Protobufjs Protobuf.js, the ranges are before 7.5.5 and from 8.0.0-experimental up to before 8.0.1.
- For Protobufjs Project Protobufjs, the record lists before 7.5.5 and version 8.0.0.
- The description states that the issue is fixed in 8.0.1 and 7.5.5.
- Unknown: the record does not clarify whether 8.0.0 is fully affected; verify the exact build in use.
Exploitation status
- The record shows the CISA KEV entry as not listed. The consulted sources do not confirm active exploitation.
- The SSVC data in the record carries an exploitation value of poc, and one GitHub advisory reference is tagged as exploit-related. These fields do not, by themselves, confirm exploitation in the wild.
Remediation and mitigation
- Upgrade to 7.5.5 on that branch or to 8.0.1 on the 8.x line, according to the fixed versions in the record.
- Where an upgrade is delayed, limit decoding to protobuf definitions from trusted sources and do not accept schema content from untrusted users.
- Review vendor errata listed in the record, such as the Red Hat advisories, for downstream packaging status.
Detection guidance
- Inventory protobufjs across package manifests, lockfiles, container images and SBOMs, including transitive dependencies.
- Review where protobuf definitions are obtained, and flag unexpected or unvetted schema changes.
- Monitor application logs for unusual decoding errors or behavior in services that process protobuf input.
Limitations of the available information
- The record does not describe the precise trigger conditions, the code path involved or the exact content that makes the injection work.
- Unknown: whether the 8.0.0 entry in the record is affected in every build.
- EPSS data is present in the record, but it estimates likelihood only and does not confirm exploitation.
- The analysis relies on the consulted sources; no independent validation was performed.
Frequently asked questions
Which versions are fixed?
According to the record, the fixed releases are 7.5.5 and 8.0.1, and the description states that versions prior to 8.0.1 and 7.5.5 are affected.
Is this vulnerability listed in CISA KEV?
No. The record shows the KEV entry as not listed, and the consulted sources do not confirm active exploitation.
What should teams with delayed upgrades do?
Limit protobuf decoding to definitions from trusted sources, avoid accepting schema content from untrusted users, and plan the upgrade to the fixed releases.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.