{
  "@id": "urn:uuid:ad637835-42d7-44a5-8185-6f4ee35669da",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T14:02:29.897304+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-11-03T14:02:29.897304+00:00",
      "status_notes": "Vulnerability CVE-2018-3738 does not affect version 8.0.0 of protobufjs. not_affected \u2014 CVE-2018-3738 is not present in protobufjs 8.0.0-tuxcare.1. The ReDoS vulnerability in the typeRefRe regex pattern was fixed in upstream commit 2ee1028d by Daniel Wirtz (dcode@dcode.io) and shipped in the upstream release before TuxCare began maintaining this version. The target contains the secure regex pattern that eliminates catastrophic backtracking.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-3738"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-3738 is not present in protobufjs 8.0.0-tuxcare.1. The ReDoS vulnerability in the typeRefRe regex pattern was fixed in upstream commit 2ee1028d by Daniel Wirtz (dcode@dcode.io) and shipped in the upstream release before TuxCare began maintaining this version. The target contains the secure regex pattern that eliminates catastrophic backtracking."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:22:22.249146+00:00",
      "status_notes": "Vulnerability CVE-2022-25878 affects version 8.0.0 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2022-25878"
      },
      "action_statement": "Vulnerability CVE-2022-25878 affects version 8.0.0 of protobufjs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:22:22.249146+00:00",
      "status_notes": "Vulnerability CVE-2023-36665 affects version 8.0.0 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2023-36665"
      },
      "action_statement": "Vulnerability CVE-2023-36665 affects version 8.0.0 of protobufjs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-20T15:57:00.139026+00:00",
      "status_notes": "Vulnerability CVE-2026-41242 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-41242"
      },
      "action_statement": "Vulnerability CVE-2026-41242 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-20T15:57:00.139026+00:00",
      "status_notes": "Vulnerability CVE-2026-44288 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44288"
      },
      "action_statement": "Vulnerability CVE-2026-44288 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-20T15:57:00.139026+00:00",
      "status_notes": "Vulnerability CVE-2026-44289 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44289"
      },
      "action_statement": "Vulnerability CVE-2026-44289 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-20T15:57:00.139026+00:00",
      "status_notes": "Vulnerability CVE-2026-44290 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44290"
      },
      "action_statement": "Vulnerability CVE-2026-44290 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-20T15:57:00.139026+00:00",
      "status_notes": "Vulnerability CVE-2026-44291 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44291"
      },
      "action_statement": "Vulnerability CVE-2026-44291 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-20T15:57:00.139026+00:00",
      "status_notes": "Vulnerability CVE-2026-44292 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44292"
      },
      "action_statement": "Vulnerability CVE-2026-44292 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-20T15:57:00.139026+00:00",
      "status_notes": "Vulnerability CVE-2026-44293 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44293"
      },
      "action_statement": "Vulnerability CVE-2026-44293 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-20T15:57:00.139026+00:00",
      "status_notes": "Vulnerability CVE-2026-44294 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44294"
      },
      "action_statement": "Vulnerability CVE-2026-44294 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-20T15:57:00.139026+00:00",
      "status_notes": "Vulnerability CVE-2026-45740 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-45740"
      },
      "action_statement": "Vulnerability CVE-2026-45740 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-20T15:57:00.139026+00:00",
      "status_notes": "Vulnerability CVE-2026-48712 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-48712"
      },
      "action_statement": "Vulnerability CVE-2026-48712 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-20T15:57:00.139026+00:00",
      "status_notes": "Vulnerability CVE-2026-54269 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-54269"
      },
      "action_statement": "Vulnerability CVE-2026-54269 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-20T15:57:00.139026+00:00",
      "status_notes": "Vulnerability CVE-2026-54270 does not affect version 8.0.0 of protobufjs. not_affected \u2014 Target version 8.0.0 predates the vulnerability introduction. CVE-2026-54270 affects protobufjs 8.2.0-8.6.1 where unknown field preservation was enabled by default. Version 8.0.0 does not contain the unknown field storage feature introduced in 8.2.0 (commit 76fa03c2). The decoder simply skips unknown fields via Reader.skipType() without retaining them in memory, preventing the memory amplificat...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54270"
      },
      "impact_statement": "not_affected \u2014 Target version 8.0.0 predates the vulnerability introduction. CVE-2026-54270 affects protobufjs 8.2.0-8.6.1 where unknown field preservation was enabled by default. Version 8.0.0 does not contain the unknown field storage feature introduced in 8.2.0 (commit 76fa03c2). The decoder simply skips unknown fields via Reader.skipType() without retaining them in memory, preventing the memory amplificat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-20T15:57:00.139026+00:00",
      "status_notes": "Vulnerability CVE-2026-59876 does not affect version 8.0.0 of protobufjs. not_affected \u2014 CVE-2026-59876 affects the protobuf.js Text Format extension (ext/textformat.js), which does not exist in version 8.0.0. The textformat extension was added after version 8.0.0 (in May 2026, commit 4639e296), while the target version 8.0.0 was released in December 2025. The vulnerable code path is absent from this version entirely.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59876"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-59876 affects the protobuf.js Text Format extension (ext/textformat.js), which does not exist in version 8.0.0. The textformat extension was added after version 8.0.0 (in May 2026, commit 4639e296), while the target version 8.0.0 was released in December 2025. The vulnerable code path is absent from this version entirely."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-20T15:57:00.139026+00:00",
      "status_notes": "Vulnerability CVE-2026-59877 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-59877"
      },
      "action_statement": "Vulnerability CVE-2026-59877 affects version 8.0.0 of protobufjs, and is fixed in 8.0.0-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:19:13.603542+00:00",
      "status_notes": "Vulnerability GHSA-4gpv-cvmq-6526 is a false positive for protobufjs 8.0.0.",
      "vulnerability": {
        "name": "GHSA-4gpv-cvmq-6526"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}