Skip to content
fr Sign in
9.4 Critical

CVE-2026-41242 protobufjs compiles protobuf definitions into JavaScript (JS) functions

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue.

Affected products and versions

Product Affected versions Fixed in
protobuf.js 8.0 8.0.0-experimental → < 8.0.1 8.0.1
protobuf.js 7.0 7.0.0 → < 7.5.5 7.5.5
protobuf.js 6.11 earliest → < 6.11.6 6.11.6
Red Hat Developer Hub 1.8 1779841586 earliest → < 1779841586 1779841586
Red Hat Developer Hub 1.9 1781187342 earliest → < 1781187342 1781187342
Red Hat OpenShift AI 2.25 1780467147 earliest → < 1780467147 1780467147
OpenShift Pipelines Versions not published
Red Hat build of Apicurio Registry 3 Versions not published
Red Hat Build of Podman Desktop Versions not published
Show the 16 other branches
Product Affected versions Fixed in
Red Hat Developer Hub Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Self-service automation portal 2 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Hardened Images Versions not published
Cryostat 4 Versions not published
OpenShift Service Mesh 3 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Ceph Storage 9 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat OpenShift AI 3.3 1783082680 earliest → < 1783082680 1783082680
Red Hat OpenShift Dev Spaces Versions not published
Red Hat OpenShift Dev Spaces 3.30 1787762793 earliest → < 1787762793 1787762793

References

Timeline

  1. Published
  2. Last modified

Other CVEs of protobuf.js

The 16 CVEs of protobuf.js →
CVE-2026-59876 protobufjs compiles protobuf definitions into JavaScript (JS) functions 4.8 Medium CVE-2026-59877 protobufjs compiles protobuf definitions into JavaScript (JS) functions 5.3 Medium CVE-2026-54269 protobufjs compiles protobuf definitions into JavaScript (JS) functions 5.3 Medium CVE-2026-48712 protobufjs compiles protobuf definitions into JavaScript (JS) functions 7.5 High
Track this CVE