Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-41242: protobufjs may execute malicious code during data decoding
CVE-2026-41242 · published today
Summary
Versions of protobufjs before 8.0.1 and 7.5.5 can run attacker‑supplied code when processing certain data fields. This could let a hacker take control of the system handling the data. Update to version 8.0.1 or later (or 7.5.5 or later) to stop the risk.
What to do
- Update GitHub Actions protobufjs to version 8.0.1-aikido.7.
- Update fenster protobufjs to version 8.0.1.
- Update fenster protobufjs to version 7.5.5.
- Update GitHub Actions protobufjs to version 8.0.1.
- Update GitHub Actions protobufjs to version 7.5.5.
- Update rootio @rootio/protobufjs to version 7.4.0-root.io.2.
- Update rootio @rootio/protobufjs to version 7.5.4-root.io.2.
- Update rootio @rootio/protobufjs to version 6.11.6-root.io.1.
- Update rootio @rootio/protobufjs to version 7.5.4-root.io.5.
- Update GitHub Actions protobufjs to version 7.5.4-aikido.5.
- Update rootio @rootio/protobufjs to version 7.4.0-root.io.4.
- Update GitHub Actions protobufjs to version 7.4.0-aikido.4.
- Update rootio @rootio/protobufjs to version 8.0.1-root.io.6.
- Update GitHub Actions protobufjs to version 8.0.1-aikido.6.
- Update rootio @rootio/protobufjs to version 8.0.1-root.io.7.
- Update rootio @rootio/protobufjs to version 8.0.1-root.io.8.
- Update GitHub Actions protobufjs to version 8.0.1-aikido.8.
- Update GitHub Actions protobufjs to version 8.0.1-aikido.9.
- Update rootio @rootio/protobufjs to version 8.0.1-root.io.9.
- Update protobufjs to version 8.0.1.
- Update protobufjs to version 7.5.5.
- Update protobufjs to version 8.0.1-aikido.9.
- Update protobufjs_project protobufjs to version 7.5.5 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Root:npm | GitHub Actions | protobufjs |
< 8.0.1-aikido.7 < 7.5.4-aikido.5 < 7.4.0-aikido.4 < 8.0.1-aikido.6 < 8.0.1-aikido.8 < 8.0.1-aikido.9 Fix: upgrade to 8.0.1-aikido.7
|
| npm | fenster | protobufjs |
>= 8.0.0, < 8.0.1 < 7.5.5 Fix: upgrade to 8.0.1
|
| npm | GitHub Actions | protobufjs |
>= 8.0.0, < 8.0.1 < 7.5.5 Fix: upgrade to 8.0.1
|
| Root:npm | rootio | @rootio/protobufjs |
< 7.4.0-root.io.2 < 7.5.4-root.io.2 < 6.11.6-root.io.1 < 7.5.4-root.io.5 < 7.4.0-root.io.4 < 8.0.1-root.io.6 < 8.0.1-root.io.7 < 8.0.1-root.io.8 < 8.0.1-root.io.9 Fix: upgrade to 7.4.0-root.io.2
|
| – | protobufjs_project | protobufjs |
< 7.5.5 8.0.0 cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:* |
| – | protobufjs | protobuf.js | < 7.5.5 |
| npm | – | protobufjs |
>= 8.0.0, < 8.0.1 < 7.5.5 Fix: upgrade to 8.0.1
|
| Root:npm | – | protobufjs |
< 8.0.1-aikido.9 Fix: upgrade to 8.0.1-aikido.9
|
Original advisory text
CVE-2026-41242 in protobufjs - Patched by Root
Root has patched CVE-2026-41242 in the protobufjs package for Root:npm. Multiple fixed versions available.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-41242 Vendor Advisory
- https://github.com/advisories/GHSA-xq3m-2v4x-88gg
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41242... Vendor Advisory
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88g... Exploit Vendor Advisory
- https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205... Patch
- https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd11... Patch
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5 Product Release Notes
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1 Product Release Notes
- https://access.redhat.com/errata/RHSA-2026:26234
- https://github.com/protobufjs/protobuf.js Product
- https://access.redhat.com/errata/RHSA-2026:21338
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:37275
- https://access.redhat.com/errata/RHSA-2026:62260
- https://access.redhat.com/security/cve/CVE-2026-41242
- https://bugzilla.redhat.com/show_bug.cgi?id=2459442
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41242.json
Severity
9.4
Critical
CVSS 4.0: 9.4 (GHSA)
CVSS 3.1: 9.8 (OSV)
CVSS 4.0: 9.4 (NVD)
Exploitation
EPSS <1%
Type
CWE-94Code Injection
Timeline
Published25 Sep 2026
Updated25 Sep 2026
First seen16 Apr 2026
Track software like this
Free during beta