{
  "@id": "urn:uuid:439d3f18-2d2c-44a1-8ed5-b5f527484e41",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T14:07:32.765766+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:07:32.765766+00:00",
      "status_notes": "Vulnerability CVE-2018-3738 does not affect version 7.5.4 of protobufjs. not_affected \u2014 The target repository protobufjs v7.5.4-tuxcare.3 is NOT AFFECTED by CVE-2018-3738. The vulnerable ReDoS regex pattern /^(?:\\.?[a-zA-Z_][a-zA-Z_0-9]*)+$/ with nested quantifiers does not exist in the codebase. The fixed pattern /^(?:\\.?[a-zA-Z_][a-zA-Z_0-9]*)(?:\\.[a-zA-Z_][a-zA-Z_0-9]*)*$/ is present at src/util/patterns.js:6 (imported by src/parse.js:28). The fix was introduced by upstream com...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-3738"
      },
      "impact_statement": "not_affected \u2014 The target repository protobufjs v7.5.4-tuxcare.3 is NOT AFFECTED by CVE-2018-3738. The vulnerable ReDoS regex pattern /^(?:\\.?[a-zA-Z_][a-zA-Z_0-9]*)+$/ with nested quantifiers does not exist in the codebase. The fixed pattern /^(?:\\.?[a-zA-Z_][a-zA-Z_0-9]*)(?:\\.[a-zA-Z_][a-zA-Z_0-9]*)*$/ is present at src/util/patterns.js:6 (imported by src/parse.js:28). The fix was introduced by upstream com..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:22:22.249146+00:00",
      "status_notes": "Vulnerability CVE-2022-25878 affects version 7.5.4 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2022-25878"
      },
      "action_statement": "Vulnerability CVE-2022-25878 affects version 7.5.4 of protobufjs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:19:13.603542+00:00",
      "status_notes": "Vulnerability CVE-2023-36665 affects version 7.5.4 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2023-36665"
      },
      "action_statement": "Vulnerability CVE-2023-36665 affects version 7.5.4 of protobufjs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-23T12:54:53.491265+00:00",
      "status_notes": "Vulnerability CVE-2026-41242 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-41242"
      },
      "action_statement": "Vulnerability CVE-2026-41242 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-23T12:54:53.491265+00:00",
      "status_notes": "Vulnerability CVE-2026-44288 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-44288"
      },
      "action_statement": "Vulnerability CVE-2026-44288 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-23T12:54:53.491265+00:00",
      "status_notes": "Vulnerability CVE-2026-44289 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44289"
      },
      "action_statement": "Vulnerability CVE-2026-44289 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-23T12:54:53.491265+00:00",
      "status_notes": "Vulnerability CVE-2026-44290 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-44290"
      },
      "action_statement": "Vulnerability CVE-2026-44290 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-23T12:54:53.491265+00:00",
      "status_notes": "Vulnerability CVE-2026-44291 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-44291"
      },
      "action_statement": "Vulnerability CVE-2026-44291 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-23T12:54:53.491265+00:00",
      "status_notes": "Vulnerability CVE-2026-44292 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-44292"
      },
      "action_statement": "Vulnerability CVE-2026-44292 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-23T12:54:53.491265+00:00",
      "status_notes": "Vulnerability CVE-2026-44293 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-44293"
      },
      "action_statement": "Vulnerability CVE-2026-44293 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-23T12:54:53.491265+00:00",
      "status_notes": "Vulnerability CVE-2026-44294 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-44294"
      },
      "action_statement": "Vulnerability CVE-2026-44294 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-23T12:54:53.491265+00:00",
      "status_notes": "Vulnerability CVE-2026-45740 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-45740"
      },
      "action_statement": "Vulnerability CVE-2026-45740 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-23T12:54:53.491265+00:00",
      "status_notes": "Vulnerability CVE-2026-48712 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-48712"
      },
      "action_statement": "Vulnerability CVE-2026-48712 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-23T12:54:53.491265+00:00",
      "status_notes": "Vulnerability CVE-2026-54269 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-54269"
      },
      "action_statement": "Vulnerability CVE-2026-54269 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-23T12:54:53.491265+00:00",
      "status_notes": "Vulnerability CVE-2026-54270 does not affect version 7.5.4 of protobufjs. not_affected \u2014 Target version 7.5.4 is NOT AFFECTED by CVE-2026-54270. The vulnerability was introduced in protobufjs v8.2.0 when unknown field preservation was added. Version 7.5.4 predates this feature and simply skips unknown fields without retaining them in memory, breaking the attack chain from INPUT (protobuf binary with unknown fields) to GOAL (unbounded memory accumulation). Exhaustive searches confir...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54270"
      },
      "impact_statement": "not_affected \u2014 Target version 7.5.4 is NOT AFFECTED by CVE-2026-54270. The vulnerability was introduced in protobufjs v8.2.0 when unknown field preservation was added. Version 7.5.4 predates this feature and simply skips unknown fields without retaining them in memory, breaking the attack chain from INPUT (protobuf binary with unknown fields) to GOAL (unbounded memory accumulation). Exhaustive searches confir..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-23T12:54:53.491265+00:00",
      "status_notes": "Vulnerability CVE-2026-59876 does not affect version 7.5.4 of protobufjs. not_affected \u2014 Target version 7.5.4 does not contain the vulnerable text format extension. CVE-2026-59876 specifically affects the optional Text Format extension (ext/textformat.js), which was added in version 8.2.0 and fixed in 8.6.5. The target version predates the introduction of this feature. The CVE explicitly states: \"This affected the optional Text Format extension. Other protobufjs input paths, includ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59876"
      },
      "impact_statement": "not_affected \u2014 Target version 7.5.4 does not contain the vulnerable text format extension. CVE-2026-59876 specifically affects the optional Text Format extension (ext/textformat.js), which was added in version 8.2.0 and fixed in 8.6.5. The target version predates the introduction of this feature. The CVE explicitly states: \"This affected the optional Text Format extension. Other protobufjs input paths, includ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-23T12:54:53.491265+00:00",
      "status_notes": "Vulnerability CVE-2026-59877 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-59877"
      },
      "action_statement": "Vulnerability CVE-2026-59877 affects version 7.5.4 of protobufjs, and is fixed in 7.5.4-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.5.4",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.5.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:19:13.603542+00:00",
      "status_notes": "Vulnerability GHSA-4gpv-cvmq-6526 is a false positive for protobufjs 7.5.4.",
      "vulnerability": {
        "name": "GHSA-4gpv-cvmq-6526"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}