{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:501ec417-a674-556f-a561-04daba729f06", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1", "type": "library", "name": "protobufjs", "version": "0.12.13-tuxcare.1", "purl": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:045fb06a-bf1e-5040-9aa1-71f766216fca", "id": "CVE-2018-3738", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-3738 does not affect version 0.12.13-tuxcare.1 of protobufjs. not_affected \u2014 Target version 0.12.13 uses a fundamentally different regex pattern that does not contain the nested quantifier vulnerability present in versions 5.0.0-5.0.2 and 6.0.0-6.8.5. The vulnerable pattern emerged in the 5.x/6.x architecture rewrite and does not exist in this earlier 0.x version." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d1e6361d-a3e1-5a96-9baf-b6c8ebb70960", "id": "CVE-2026-41242", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41242 does not affect version 0.12.13-tuxcare.1 of protobufjs. not_affected \u2014 Version 0.12.13 is not affected by CVE-2026-41242. While the codebase uses eval() with type names (Reflect.js:345), all protobuf definition entry points validate type names using the Lang.NAME regex (/[a-zA-Z][a-zA-Z_0-9]*/) which blocks special characters required for code injection. The attack vector described in the CVE (injection via 'type fields of protobuf definitions') is mitigated by co..." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f1bddecb-7150-5ea4-af1a-ff239e3d362a", "id": "CVE-2026-44288", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44288 does not affect version 0.12.13-tuxcare.1 of protobufjs. not_affected \u2014 Target repository protobufjs version 0.12.13 is not affected by CVE-2026-44288. The vulnerability concerns protobufjs's minimal UTF-8 decoder in lib/utf8/index.js (introduced in version 6.x/7.x). Version 0.12.13 uses a fundamentally different architecture that delegates all UTF-8 decoding to the external ByteBuffer.js library, and does not contain the vulnerable component." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:742b0427-e52b-55d2-a524-f28ea25ad7c0", "id": "CVE-2026-44289", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44289 is fixed in version 0.12.13-tuxcare.1 of protobufjs." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a02e64b8-c949-5dd2-919c-eeb38a0d7d83", "id": "CVE-2026-44290", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44290 does not affect version 0.12.13-tuxcare.1 of protobufjs. not_affected \u2014 The target repository (protobufjs 0.12.13) uses a fundamentally different architecture from the modern protobuf.js versions targeted by the security patches. While it processes option names from schemas without validating against dangerous property names like '__proto__', it lacks the option path traversal mechanism that enables prototype pollution in the modern codebase. The vulnerability requ..." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:56de7d8e-d280-5fa3-9dc8-12867256aa3b", "id": "CVE-2026-44291", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44291 is fixed in version 0.12.13-tuxcare.1 of protobufjs." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:20b3264b-4ea9-59f6-a561-658ad10b9154", "id": "CVE-2026-44292", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44292 does not affect version 0.12.13-tuxcare.1 of protobufjs. not_affected \u2014 The target repository (protobufjs version 0.12.13) is NOT affected by CVE-2026-44292. While the target is the same product lineage as the patched modern protobuf.js (6.x/7.x), version 0.12.13 uses a fundamentally different architecture that includes field validation, preventing the prototype pollution attack vector described in the CVE." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c0a31be4-1d83-592f-874d-f5d7c12b2cdb", "id": "CVE-2026-44293", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44293 does not affect version 0.12.13-tuxcare.1 of protobufjs. not_affected \u2014 The target protobufjs version 0.12.13 is not affected by CVE-2026-44293. The vulnerability requires toObject code generation functionality that does not exist in this version. Version 0.12.13 uses a reflection-based architecture without code generation for conversion functions." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a7679a2b-d752-578b-8ff2-3edbd884baa1", "id": "CVE-2026-44294", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44294 is fixed in version 0.12.13-tuxcare.1 of protobufjs." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:29fb5f7b-76b0-5715-8e57-7bb8c67b3452", "id": "CVE-2026-45740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45740 is fixed in version 0.12.13-tuxcare.1 of protobufjs." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2b7fa9eb-e22e-578f-9c89-9a5298eb2b32", "id": "CVE-2026-48712", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-48712 does not affect version 0.12.13-tuxcare.1 of protobufjs. not_affected \u2014 Version 0.12.13 is not affected by CVE-2026-48712. The vulnerability requires google.protobuf.Any support and JSON/object conversion methods (toObject, toJSON) that do not exist in this version. The target uses a completely different architecture (2013 monolithic codebase) that predates the 6.x/7.x rewrite where these features were introduced." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b4954806-7231-5bba-a446-b7d4d4ca7bd7", "id": "CVE-2026-54269", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54269 does not affect version 0.12.13-tuxcare.1 of protobufjs. not_affected \u2014 Protobufjs version 0.12.13 is not affected by CVE-2026-54269. This version predates the 6.x rewrite and uses a fundamentally different architecture that does not contain the vulnerable code patterns (hasOwnProperty method calls, $type property access, or rpcCall service helper invocation)." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:03de603e-6c59-5ec1-b39e-46d3d4d07783", "id": "CVE-2026-54270", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54270 does not affect version 0.12.13-tuxcare.1 of protobufjs. not_affected \u2014 Version 0.12.13 is not affected by CVE-2026-54270. This version predates the introduction of unknown field preservation (added in version 8.2.0). When encountering unknown fields, version 0.12.13 throws an error and terminates the decode operation, preventing any memory accumulation. The vulnerability requires the presence of code that preserves unknown fields in message.$unknowns, which does n..." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f4b7536d-7106-5037-b3fd-c726e9247c64", "id": "CVE-2026-59876", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59876 does not affect version 0.12.13-tuxcare.1 of protobufjs. not_affected \u2014 Version 0.12.13 does not contain the Text Format extension (ext/textformat.js) that is affected by CVE-2026-59876. The vulnerability requires the optional Text Format extension to parse text-format input containing __proto__ as a map key, which does not exist in this early version of protobufjs. The target version only supports binary protobuf decoding and .proto schema parsing, neither of whic..." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:44ee1738-f4ba-573e-839b-bc3e8de1d386", "id": "CVE-2026-59877", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59877 does not affect version 0.12.13-tuxcare.1 of protobufjs. not_affected \u2014 The target version (protobufjs 0.12.13) is not affected by CVE-2026-59877. The vulnerability requires a specific code pattern - a while loop that advances through tokens until '=' is found without checking for EOF - which does not exist in version 0.12.13's codebase. The target uses a fundamentally different parser architecture with sequential token reading that predates the vulnerable loop str..." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:85e77846-ba47-5ddb-ac73-28dfbea3ae8c", "id": "GHSA-4gpv-cvmq-6526", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4gpv-cvmq-6526 is a false positive for protobufjs 0.12.13-tuxcare.1." }, "affects": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/protobufjs@0.12.13-tuxcare.1" } ] }