CVE-2026-41242

Fixed in a distro release EPSS <1%CVSS 9.4

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

Published 2026-04-18 · CVE record · OSV

Products: protobufjs protobuf.js, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat OpenShift Dev Spaces 3.30, Red Hat Cryostat 4, Red Hat OpenShift Pipelines, Red Hat OpenShift Service Mesh 3, Red Hat Ansible Automation Platform 2, Red Hat build of Apicurio Registry 3, Red Hat Build of Podman Desktop, Red Hat Ceph Storage 9, Red Hat Developer Hub, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Hardened Images, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4, Red Hat Self-service automation portal 2

Fixed upstream

Distro releases