Node.js protobufjs Dynamic Type Compilation RCE (CVE-2026-41242)

Metadata

Affected Target

Summary

The demo Express service accepts a JSON protobuf descriptor from an HTTP request body and passes it straight to protobuf.Root.fromJSON(), then looks up and decodes a message type from that attacker-controlled descriptor. Because protobufjs compiles field/type names into generated JavaScript for performance, a maliciously crafted type name can break out of the generated code context and inject arbitrary JavaScript that executes when the message is decoded. The included payload.json embeds a type name containing a closing function body plus process.mainModule.require('child_process').execSync('id'), so simply decoding a message of that type runs an OS command. This is a self-contained “trusted input assumed, attacker input received” deserialization RCE.

Vulnerability Details

Root Cause

protobufjs builds its runtime type/codec objects from field and type names taken from the JSON descriptor without validating that they are safe JavaScript identifiers, allowing a crafted name to inject and execute arbitrary code when the type is compiled/decoded.

Attack Vector

1. Attacker sends a POST request to /create_user with a JSON body representing a protobuf schema (descriptor).
2. The crafted descriptor defines a field/type whose “name” is actually a JavaScript payload (e.g. closing a generated function and defining a new one that calls child_process.execSync).
3. The server calls protobuf.Root.fromJSON(descriptor) and looks up the type, then calls .decode() on sample bytes.
4. During compilation/decoding, the injected JavaScript executes in the Node.js process, running the attacker’s OS command.

Impact

Remote code execution in the context of the Node.js server process for any application that builds protobuf types/schemas from untrusted, request-supplied JSON.

Environment / Lab Setup

Target:   Node.js + Express app (server.js) using protobufjs ^7.5.4, listening on port 3000
Attacker: curl / any HTTP client to POST payload.json to /create_user

Proof of Concept

PoC Script

See server.js and payload.json in this folder.

1
2
3
4
5

npm install
node server.js
curl -X POST http://localhost:3000/create_user \
  -H "Content-Type: application/json" \
  --data @payload.json

server.js implements the vulnerable /create_user endpoint that builds a protobuf Root from the request body and decodes a fixed byte buffer against it; payload.json supplies a User/Data type descriptor whose type name is a crafted JavaScript fragment that, once compiled by protobufjs, executes child_process.execSync('id') on the server as soon as the message is decoded.

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected child processes spawned by the Node.js application
• Protobuf descriptor payloads in request logs containing JavaScript syntax (function, require, process.mainModule) inside type/field names
• Anomalous execSync/exec calls surfaced by runtime application security monitoring

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/4chech/CVE-2026-41242 on 2026-07-05.