Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-41242
9.8
CRITICALCVSS v3
Published
April 18, 2026
Affected
4 projects
Assigned by
GitHub
Severity scale
010
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
@types/protobufjs
NPMStub TypeScript definitions entry for ProtoBuf.js, which provides its own types definitions
NPMStub TypeScript definitions entry for ProtoBuf.js, which provides its own types definitions< 7.5.5, = 8.0.0, >= 8.0.0, < 8.0.1NVD
GitHub