VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Apr 18, 2026· Updated Apr 23, 2026

CVE-2026-41242

CVE-2026-41242

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
protobufjsnpm
>= 8.0.0, < 8.0.18.0.1
protobufjsnpm
< 7.5.57.5.5

Affected products

2
  • Protobufjs Project/Protobufjs2 versions
    cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*+ 1 more
    • cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*range: <7.5.5
    • cpe:2.3:a:protobufjs_project:protobufjs:8.0.0:*:*:*:*:node.js:*:*

Patches

2
ff7b2afef875

fix: filter invalid characters from the type name (#2127)

https://github.com/protobufjs/protobuf.jsAlexander FensterMar 11, 2026via ghsa
commit
1 file changed · +1 −0
  • src/type.js+1 −0 modified
    @@ -29,6 +29,7 @@ var Enum      = require("./enum"),
  * @param {Object.<string,*>} [options] Declared options
  */
 function Type(name, options) {
+    name = name.replace(/\W/g, "");
     Namespace.call(this, name, options);
 
     /**
535df444ac06

fix: filter invalid characters from the type name (#2127)

https://github.com/protobufjs/protobuf.jsAlexander FensterMar 11, 2026via ghsa
commit
1 file changed · +1 −0
  • src/type.js+1 −0 modified
    @@ -29,6 +29,7 @@ var Enum      = require("./enum"),
  * @param {Object.<string,*>} [options] Declared options
  */
 function Type(name, options) {
+    name = name.replace(/\W/g, "");
     Namespace.call(this, name, options);
 
     /**

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.