CVE-2026-41242

CVSS 9.8 · CRITICAL

1 public PoC

Proof-of-concept code linked in references

EPSS p43

Lower risk — in the top 57% least-likely-to-be-exploited CVEs.

Patch available

Vendor advisory or patch linked

Published 4/18/2026 · updated 4/23/2026 · CWE-94

Get asset-aware triage

Summary

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

CVSS 9.8 — CRITICAL

9.8 / 10

AV: Network
AC: Low complexity
PR: No privileges
UI: No user interaction
S: Scope unchanged
C: Confidentiality: High
I: Integrity: High
A: Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS exploitation probability

0.6%

Percentile p43 — Lower risk — in the top 57% least-likely-to-be-exploited CVEs.

Affected products

1 vendor/product entries

Protobufjs Project Protobufjs< 7.5.5

Do you run any of these? Sign in to match this CVE against your SBOM and asset inventory automatically.

Timeline

Apr 18, 2026 · Disclosed / published in NVD
Apr 23, 2026 · Intel last updated

Intel sources

Which upstream feeds returned data for this CVE, and when they were last fetched.

NVD· 47 days ago
CVE.org· no data
FIRST EPSS· 47 days ago
CISA KEV· no data
OSV· 47 days ago

References

Patches & mitigations2

Proof-of-concept / exploit1

https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg

Other2

Unlock the full report

See how CVE-2026-41242 hits your stack.

Free public data ends here. Sign in to correlate this CVE against your SBOM and assets, get an AI-grounded exploit chain, generate a ModSecurity virtual patch, and share findings with your team.

· Asset-aware CVSS & priority
· Grounded AI analysis (A–D graded)
· Auto-generated WAF / IPS rules
· Jira, SIEM, Slack, Teams delivery

No credit card · 100 free enrichments · analyst-grade citations.