protobufjs Project protobufjs 8.0.0 for Node.js
Approved changes feed: RSS · Atom
cpe:2.3:a:protobufjs_project:protobufjs:8.0.0:*:*:*:*:node.js:*:*
part: a version: 8.0.0 update: *
| Vendor | Protobufjs Project (651d57f6-c57d-5d8d-9053-8ea8f767ba40) |
|---|---|
| Product | Protobufjs (a161b990-b58d-5aa6-9249-e29ce55bc08a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/protobufjs/protobuf.js |
purl2cpe | 2026-06-01 10:16:07.715222 |
pkg:maven/org.webjars.npm/protobufjs |
purl2cpe | 2026-06-01 10:16:07.715223 |
pkg:npm/protobufjs |
purl2cpe | 2026-06-01 10:16:07.715225 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-41242 |
vulnerable | 2026-06-08 08:03:15.102159 |
protobufjs has an arbitrary code execution issue
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
Published: 2026-04-18T16:18:10.652Z
Updated: 2026-09-09T12:05:00.268Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.