{
  "@id": "urn:uuid:6d50d42f-a5d0-4bc5-84df-8ede2fddf10e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T14:05:55.116892+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:05:55.116892+00:00",
      "status_notes": "Vulnerability CVE-2018-3738 does not affect version 6.8.8-tuxcare.1 of protobufjs. not_affected \u2014 CVE-2018-3738 does not affect this target. The ReDoS vulnerability in the typeRefRe regex pattern was fixed in upstream protobuf.js version 6.8.6 (commit 2ee1028d), which was already present in the upstream release that TuxCare onboarded. The target version 6.8.8-tuxcare.1 contains the fixed regex pattern that avoids catastrophic backtracking.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-3738"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-3738 does not affect this target. The ReDoS vulnerability in the typeRefRe regex pattern was fixed in upstream protobuf.js version 6.8.6 (commit 2ee1028d), which was already present in the upstream release that TuxCare onboarded. The target version 6.8.8-tuxcare.1 contains the fixed regex pattern that avoids catastrophic backtracking."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:22:22.249146+00:00",
      "status_notes": "Vulnerability CVE-2022-25878 affects version 6.8.8-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2022-25878"
      },
      "action_statement": "Vulnerability CVE-2022-25878 affects version 6.8.8-tuxcare.1 of protobufjs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:22:22.249146+00:00",
      "status_notes": "Vulnerability CVE-2023-36665 affects version 6.8.8-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2023-36665"
      },
      "action_statement": "Vulnerability CVE-2023-36665 affects version 6.8.8-tuxcare.1 of protobufjs."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41242 is fixed in version 6.8.8-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-41242"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44288 is fixed in version 6.8.8-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44288"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44289 is fixed in version 6.8.8-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44289"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44290 is fixed in version 6.8.8-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44290"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44291 is fixed in version 6.8.8-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44291"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44292 is fixed in version 6.8.8-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44292"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44293 is fixed in version 6.8.8-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44293"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44294 is fixed in version 6.8.8-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44294"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-45740 is fixed in version 6.8.8-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-45740"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48712 is fixed in version 6.8.8-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-48712"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-54269 is fixed in version 6.8.8-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-54269"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-54270 does not affect version 6.8.8-tuxcare.1 of protobufjs. not_affected \u2014 Version 6.8.8 does not contain the vulnerable unknown-field preservation feature. The CVE describes a vulnerability in the $unknowns array accumulation mechanism added in protobufjs 8.2.0, but version 6.8.8 predates this feature entirely and simply discards unknown fields during decode without retaining them in memory.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54270"
      },
      "impact_statement": "not_affected \u2014 Version 6.8.8 does not contain the vulnerable unknown-field preservation feature. The CVE describes a vulnerability in the $unknowns array accumulation mechanism added in protobufjs 8.2.0, but version 6.8.8 predates this feature entirely and simply discards unknown fields during decode without retaining them in memory."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59876 does not affect version 6.8.8-tuxcare.1 of protobufjs. not_affected \u2014 Version 6.8.8 is not affected by CVE-2026-59876. The vulnerable Text Format extension (ext/textformat.js) did not exist in this version - it was first introduced in version 8.2.0 released on 2026-05-09, approximately 8 years after version 6.8.8 was released (2018-07-19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59876"
      },
      "impact_statement": "not_affected \u2014 Version 6.8.8 is not affected by CVE-2026-59876. The vulnerable Text Format extension (ext/textformat.js) did not exist in this version - it was first introduced in version 8.2.0 released on 2026-05-09, approximately 8 years after version 6.8.8 was released (2018-07-19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59877 does not affect version 6.8.8-tuxcare.1 of protobufjs. not_affected \u2014 Version 6.8.8 is not affected by CVE-2026-59877. The vulnerable code (an infinite loop in option name parsing) was introduced in protobufjs v7.5.0 (September 2024) and does not exist in version 6.8.8. This version uses a different, safe implementation that throws an error immediately when encountering incomplete option declarations rather than looping indefinitely.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59877"
      },
      "impact_statement": "not_affected \u2014 Version 6.8.8 is not affected by CVE-2026-59877. The vulnerable code (an infinite loop in option name parsing) was introduced in protobufjs v7.5.0 (September 2024) and does not exist in version 6.8.8. This version uses a different, safe implementation that throws an error immediately when encountering incomplete option declarations rather than looping indefinitely."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@6.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@6.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:19:13.603542+00:00",
      "status_notes": "Vulnerability GHSA-4gpv-cvmq-6526 is a false positive for protobufjs 6.8.8-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-4gpv-cvmq-6526"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}