{
  "@id": "urn:uuid:3d036605-96af-40c2-bd32-6d6fcf7e7cb5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-15T11:26:31.076689+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2018-3738 does not affect version 6.8.8 of protobufjs. not_affected \u2014 CVE-2018-3738 does not affect this target. The ReDoS vulnerability in the typeRefRe regex pattern was fixed in upstream protobuf.js version 6.8.6 (commit 2ee1028d), which was already present in the upstream release that TuxCare onboarded. The target version 6.8.8-tuxcare.1 contains the fixed regex pattern that avoids catastrophic backtracking.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-3738"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-3738 does not affect this target. The ReDoS vulnerability in the typeRefRe regex pattern was fixed in upstream protobuf.js version 6.8.6 (commit 2ee1028d), which was already present in the upstream release that TuxCare onboarded. The target version 6.8.8-tuxcare.1 contains the fixed regex pattern that avoids catastrophic backtracking."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2022-25878 affects version 6.8.8 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2022-25878"
      },
      "action_statement": "Vulnerability CVE-2022-25878 affects version 6.8.8 of protobufjs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2023-36665 affects version 6.8.8 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2023-36665"
      },
      "action_statement": "Vulnerability CVE-2023-36665 affects version 6.8.8 of protobufjs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2026-41242 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-41242"
      },
      "action_statement": "Vulnerability CVE-2026-41242 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2026-44288 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44288"
      },
      "action_statement": "Vulnerability CVE-2026-44288 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2026-44289 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44289"
      },
      "action_statement": "Vulnerability CVE-2026-44289 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2026-44290 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44290"
      },
      "action_statement": "Vulnerability CVE-2026-44290 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2026-44291 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44291"
      },
      "action_statement": "Vulnerability CVE-2026-44291 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2026-44292 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44292"
      },
      "action_statement": "Vulnerability CVE-2026-44292 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2026-44293 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44293"
      },
      "action_statement": "Vulnerability CVE-2026-44293 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2026-44294 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44294"
      },
      "action_statement": "Vulnerability CVE-2026-44294 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2026-45740 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-45740"
      },
      "action_statement": "Vulnerability CVE-2026-45740 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2026-48712 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-48712"
      },
      "action_statement": "Vulnerability CVE-2026-48712 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2026-54269 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-54269"
      },
      "action_statement": "Vulnerability CVE-2026-54269 affects version 6.8.8 of protobufjs, and is fixed in 6.8.8-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2026-54270 does not affect version 6.8.8 of protobufjs. not_affected \u2014 Version 6.8.8 does not contain the vulnerable unknown-field preservation feature. The CVE describes a vulnerability in the $unknowns array accumulation mechanism added in protobufjs 8.2.0, but version 6.8.8 predates this feature entirely and simply discards unknown fields during decode without retaining them in memory.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54270"
      },
      "impact_statement": "not_affected \u2014 Version 6.8.8 does not contain the vulnerable unknown-field preservation feature. The CVE describes a vulnerability in the $unknowns array accumulation mechanism added in protobufjs 8.2.0, but version 6.8.8 predates this feature entirely and simply discards unknown fields during decode without retaining them in memory."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2026-59876 does not affect version 6.8.8 of protobufjs. not_affected \u2014 Version 6.8.8 is not affected by CVE-2026-59876. The vulnerable Text Format extension (ext/textformat.js) did not exist in this version - it was first introduced in version 8.2.0 released on 2026-05-09, approximately 8 years after version 6.8.8 was released (2018-07-19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59876"
      },
      "impact_statement": "not_affected \u2014 Version 6.8.8 is not affected by CVE-2026-59876. The vulnerable Text Format extension (ext/textformat.js) did not exist in this version - it was first introduced in version 8.2.0 released on 2026-05-09, approximately 8 years after version 6.8.8 was released (2018-07-19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability CVE-2026-59877 does not affect version 6.8.8 of protobufjs. not_affected \u2014 Version 6.8.8 is not affected by CVE-2026-59877. The vulnerable code (an infinite loop in option name parsing) was introduced in protobufjs v7.5.0 (September 2024) and does not exist in version 6.8.8. This version uses a different, safe implementation that throws an error immediately when encountering incomplete option declarations rather than looping indefinitely.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59877"
      },
      "impact_statement": "not_affected \u2014 Version 6.8.8 is not affected by CVE-2026-59877. The vulnerable code (an infinite loop in option name parsing) was introduced in protobufjs v7.5.0 (September 2024) and does not exist in version 6.8.8. This version uses a different, safe implementation that throws an error immediately when encountering incomplete option declarations rather than looping indefinitely."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8"
          }
        }
      ],
      "timestamp": "2026-11-15T11:26:31.076689+00:00",
      "status_notes": "Vulnerability GHSA-4gpv-cvmq-6526 is a false positive for protobufjs 6.8.8.",
      "vulnerability": {
        "name": "GHSA-4gpv-cvmq-6526"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}