{
  "@id": "urn:uuid:9c5c3d37-3060-4178-a159-20a992280c94",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T14:05:55.116892+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-11-03T14:05:55.116892+00:00",
      "status_notes": "Vulnerability CVE-2018-3738 does not affect version 7.4.0 of protobufjs. not_affected \u2014 CVE-2018-3738 (ReDoS in typeRefRe regex) is NOT present in target protobufjs 7.4.0. The vulnerable regex pattern with nested quantifiers was already fixed by upstream commit 2ee1028d (authored by dcode@dcode.io) which shipped in the upstream release before TuxCare's work began. The target contains the fixed pattern that eliminates catastrophic backtracking.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-3738"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-3738 (ReDoS in typeRefRe regex) is NOT present in target protobufjs 7.4.0. The vulnerable regex pattern with nested quantifiers was already fixed by upstream commit 2ee1028d (authored by dcode@dcode.io) which shipped in the upstream release before TuxCare's work began. The target contains the fixed pattern that eliminates catastrophic backtracking."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:22:22.249146+00:00",
      "status_notes": "Vulnerability CVE-2022-25878 affects version 7.4.0 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2022-25878"
      },
      "action_statement": "Vulnerability CVE-2022-25878 affects version 7.4.0 of protobufjs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:22:22.249146+00:00",
      "status_notes": "Vulnerability CVE-2023-36665 affects version 7.4.0 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2023-36665"
      },
      "action_statement": "Vulnerability CVE-2023-36665 affects version 7.4.0 of protobufjs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:14.777526+00:00",
      "status_notes": "Vulnerability CVE-2026-41242 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-41242"
      },
      "action_statement": "Vulnerability CVE-2026-41242 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:14.777526+00:00",
      "status_notes": "Vulnerability CVE-2026-44288 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44288"
      },
      "action_statement": "Vulnerability CVE-2026-44288 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:14.777526+00:00",
      "status_notes": "Vulnerability CVE-2026-44289 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44289"
      },
      "action_statement": "Vulnerability CVE-2026-44289 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:14.777526+00:00",
      "status_notes": "Vulnerability CVE-2026-44290 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44290"
      },
      "action_statement": "Vulnerability CVE-2026-44290 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:14.777526+00:00",
      "status_notes": "Vulnerability CVE-2026-44291 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44291"
      },
      "action_statement": "Vulnerability CVE-2026-44291 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:14.777526+00:00",
      "status_notes": "Vulnerability CVE-2026-44292 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44292"
      },
      "action_statement": "Vulnerability CVE-2026-44292 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:14.777526+00:00",
      "status_notes": "Vulnerability CVE-2026-44293 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44293"
      },
      "action_statement": "Vulnerability CVE-2026-44293 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:14.777526+00:00",
      "status_notes": "Vulnerability CVE-2026-44294 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44294"
      },
      "action_statement": "Vulnerability CVE-2026-44294 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:14.777526+00:00",
      "status_notes": "Vulnerability CVE-2026-45740 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-45740"
      },
      "action_statement": "Vulnerability CVE-2026-45740 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:14.777526+00:00",
      "status_notes": "Vulnerability CVE-2026-48712 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-48712"
      },
      "action_statement": "Vulnerability CVE-2026-48712 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:14.777526+00:00",
      "status_notes": "Vulnerability CVE-2026-54269 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-54269"
      },
      "action_statement": "Vulnerability CVE-2026-54269 affects version 7.4.0 of protobufjs, and is fixed in 7.4.0-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:14.777526+00:00",
      "status_notes": "Vulnerability CVE-2026-54270 does not affect version 7.4.0 of protobufjs. not_affected \u2014 CVE-2026-54270 affects protobufjs 8.2.0+ where unknown field preservation was introduced. The target (protobufjs 7.4.0-tuxcare.1) predates this feature and never preserves unknown fields in message.$unknowns. The decoder simply skips unknown fields without retention, eliminating the attack path for excessive memory allocation via crafted payloads with many unknown fields.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54270"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-54270 affects protobufjs 8.2.0+ where unknown field preservation was introduced. The target (protobufjs 7.4.0-tuxcare.1) predates this feature and never preserves unknown fields in message.$unknowns. The decoder simply skips unknown fields without retention, eliminating the attack path for excessive memory allocation via crafted payloads with many unknown fields."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:14.777526+00:00",
      "status_notes": "Vulnerability CVE-2026-59876 does not affect version 7.4.0 of protobufjs. not_affected \u2014 Version 7.4.0 of protobufjs is not affected by CVE-2026-59876. The vulnerability exists exclusively in the optional Text Format extension (ext/textformat.js), which was not added to the protobufjs codebase until May 9, 2026\u2014approximately 21 months after version 7.4.0 was released (August 22, 2024). The CVE explicitly states \"This affected the optional Text Format extension. Other protobufjs inp...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59876"
      },
      "impact_statement": "not_affected \u2014 Version 7.4.0 of protobufjs is not affected by CVE-2026-59876. The vulnerability exists exclusively in the optional Text Format extension (ext/textformat.js), which was not added to the protobufjs codebase until May 9, 2026\u2014approximately 21 months after version 7.4.0 was released (August 22, 2024). The CVE explicitly states \"This affected the optional Text Format extension. Other protobufjs inp..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:14.777526+00:00",
      "status_notes": "Vulnerability CVE-2026-59877 does not affect version 7.4.0 of protobufjs. not_affected \u2014 Version 7.4.0-tuxcare.1 does not contain the vulnerable code pattern described in CVE-2026-59877. The vulnerability involves an infinite loop in a `while (token !== \"=\")` construct within the parseOption function, which was introduced in a later development branch (editions/aggregate options support) that diverged after version 7.4.0 was released. The target uses a simpler parseOption implement...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59877"
      },
      "impact_statement": "not_affected \u2014 Version 7.4.0-tuxcare.1 does not contain the vulnerable code pattern described in CVE-2026-59877. The vulnerability involves an infinite loop in a `while (token !== \"=\")` construct within the parseOption function, which was introduced in a later development branch (editions/aggregate options support) that diverged after version 7.4.0 was released. The target uses a simpler parseOption implement..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:19:13.603542+00:00",
      "status_notes": "Vulnerability GHSA-4gpv-cvmq-6526 is a false positive for protobufjs 7.4.0.",
      "vulnerability": {
        "name": "GHSA-4gpv-cvmq-6526"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}