CVE-2026-41242 is a critical code injection flaw (CVSS 9.8) in protobufjs, the widely used JavaScript protobuf library. Versions up to 7.5.4, and 8.0.0, can run attacker JavaScript when a crafted schema is loaded and used. Fixed versions are 7.5.5 and 8.0.1. Update both direct and transitive copies.
What's affected
Per the GitHub advisory for the npm package protobufjs:
- Affected: 7.5.4 and earlier on the 7.x line, and 8.0.0.
- Fixed: 7.5.5 and 8.0.1.
The advisory also lists preconditions. The application must let an attacker control or influence a protobuf definition or JSON descriptor, load it through the reflection APIs, and then reach the generated code path, for example by performing an operation on the loaded type. Applications that only decode messages with trusted, application-defined schemas are not directly affected.
How to check if you're exposed
protobufjs is often a transitive dependency, pulled in by gRPC and cloud client libraries. List every copy:
npm ls protobufjs
pnpm why protobufjs
yarn why protobufjs
Note every version you see. Then ask the second question: does any code path load a schema or descriptor that a user, tenant or remote system supplies? If the answer is no, you are in the lower risk group, but you should still upgrade. Reachability analysis helps here, because it shows whether your code actually calls the schema loading APIs. The free dependency scan is a quick way to see where the package sits.
What to do now
- Upgrade to protobufjs 7.5.5 or 8.0.1 or later.
- For transitive copies, update the parent package, or use your package manager's override feature to force a fixed version, then retest.
- Do not load protobuf definitions or JSON descriptors from untrusted sources on affected versions.
- If you must accept untrusted schemas, validate or restrict them first and process them in an isolated environment, as the advisory suggests.
- Rebuild and redeploy, then confirm the resolved version in the new build.
Why it matters
The record lists CWE-94, improper control of code generation. protobufjs can compile a schema into JavaScript functions for speed. The advisory says schema controlled type names and type references could reach that runtime code generation without enough validation, so text in a schema could end up as code.
The risk sits in a trust assumption. Many teams treat a schema as developer-owned config. Once a service accepts a schema from outside, such as a plugin system or a multi-tenant API gateway, that assumption fails. The record lists a Red Hat errata among its references, which suggests downstream vendors are shipping fixes too. It does not flag the CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
My service only decodes messages with a schema compiled at build time. Affected?
The advisory says applications that only decode with trusted, application-defined schemas are not directly affected. Upgrade anyway so a later change does not open the path.
Why did npm audit show this under another package?
protobufjs is usually pulled in by something else. The fix may need an update to that parent or an override.
Sources
Last reviewed: 19 October 2026.
