Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 9.4 | Critical | 4.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0077, the 56th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 16 Apr 2026, 22:34 UTC Confirmed by GitHub Advisory Database
- 18 Apr 2026, 16:18 UTC Confirmed by the CVE List
- 18 Apr 2026, 17:16 UTC Confirmed by NVD
- 4 Nov 2026, 17:28 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-xq3m-2v4x-88gg
- OSV: GHSA-xq3m-2v4x-88gg
- github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg
- nvd.nist.gov/vuln/detail/CVE-2026-41242
- github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956
- github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75
- github.com/protobufjs/protobuf.js/commit/086916b4a52c9f73ce88956edbb38fc902e54bbf
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41242.json
- github.com/protobufjs/protobuf.js/tree/v6.11.6
- github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1
- github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5
- github.com/protobufjs/protobuf.js
- bugzilla.redhat.com/show_bug.cgi?id=2459442
- access.redhat.com/security/cve/CVE-2026-41242