# CVE-2026-41242: protobufjs has an arbitrary code execution issue

- Exploited (CISA KEV): no
- Published: 2026-04-18
- CVSS: 9.4 CRITICAL (v4.0)
- EPSS: 0.8% (56th percentile)
- CWE: CWE-94

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2026-07-07 | 80 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2026-07-07 · new · rule 200204070
  > Added: signature 200204070 "protobufjs Remote Code Execution" (Server Side Code Injection, risk High), systems: Other Web Server. References: CVE-2026-41242.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

## Social

1 posts seen since 2026-11-03.

- x 2026-11-03: 🚨 Critical vulnerability  io.github.ihubanov/squire  Newly listed carrying an unpatched critical vulnerability (CVE-2026-41242). A fixed version is available. (https://x.com/MCPScores/status/2117582935943467384)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-41242 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-41242