{
  "@id": "urn:uuid:8399cb5e-d30c-4c0f-a421-38b2a56535ca",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-05T16:51:12.300267+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:49:00.176827+00:00",
      "status_notes": "Vulnerability CVE-2026-41242 is fixed in version 7.4.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-41242"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:49:00.176827+00:00",
      "status_notes": "Vulnerability CVE-2026-44288 is fixed in version 7.4.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44288"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:49:00.176827+00:00",
      "status_notes": "Vulnerability CVE-2026-44289 is fixed in version 7.4.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44289"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:49:00.176827+00:00",
      "status_notes": "Vulnerability CVE-2026-44290 is fixed in version 7.4.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44290"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:49:00.176827+00:00",
      "status_notes": "Vulnerability CVE-2026-44291 is fixed in version 7.4.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44291"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:49:00.176827+00:00",
      "status_notes": "Vulnerability CVE-2026-44292 is fixed in version 7.4.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44292"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:49:00.176827+00:00",
      "status_notes": "Vulnerability CVE-2026-44293 is fixed in version 7.4.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44293"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:49:00.176827+00:00",
      "status_notes": "Vulnerability CVE-2026-44294 is fixed in version 7.4.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44294"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:49:00.176827+00:00",
      "status_notes": "Vulnerability CVE-2026-45740 is fixed in version 7.4.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-45740"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:49:00.176827+00:00",
      "status_notes": "Vulnerability CVE-2026-48712 is fixed in version 7.4.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-48712"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:49:00.176827+00:00",
      "status_notes": "Vulnerability CVE-2026-54269 is fixed in version 7.4.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-54269"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:49:00.176827+00:00",
      "status_notes": "Vulnerability CVE-2026-54270 does not affect version 7.4.0-tuxcare.1 of protobufjs. not_affected \u2014 CVE-2026-54270 affects protobufjs 8.2.0+ where unknown field preservation was introduced. The target (protobufjs 7.4.0-tuxcare.1) predates this feature and never preserves unknown fields in message.$unknowns. The decoder simply skips unknown fields without retention, eliminating the attack path for excessive memory allocation via crafted payloads with many unknown fields.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54270"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-54270 affects protobufjs 8.2.0+ where unknown field preservation was introduced. The target (protobufjs 7.4.0-tuxcare.1) predates this feature and never preserves unknown fields in message.$unknowns. The decoder simply skips unknown fields without retention, eliminating the attack path for excessive memory allocation via crafted payloads with many unknown fields."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:49:00.176827+00:00",
      "status_notes": "Vulnerability CVE-2026-59876 does not affect version 7.4.0-tuxcare.1 of protobufjs. not_affected \u2014 Version 7.4.0 of protobufjs is not affected by CVE-2026-59876. The vulnerability exists exclusively in the optional Text Format extension (ext/textformat.js), which was not added to the protobufjs codebase until May 9, 2026\u2014approximately 21 months after version 7.4.0 was released (August 22, 2024). The CVE explicitly states \"This affected the optional Text Format extension. Other protobufjs inp...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59876"
      },
      "impact_statement": "not_affected \u2014 Version 7.4.0 of protobufjs is not affected by CVE-2026-59876. The vulnerability exists exclusively in the optional Text Format extension (ext/textformat.js), which was not added to the protobufjs codebase until May 9, 2026\u2014approximately 21 months after version 7.4.0 was released (August 22, 2024). The CVE explicitly states \"This affected the optional Text Format extension. Other protobufjs inp..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:51:12.300267+00:00",
      "status_notes": "Vulnerability CVE-2026-59877 does not affect version 7.4.0-tuxcare.1 of protobufjs. not_affected \u2014 Version 7.4.0-tuxcare.1 does not contain the vulnerable code pattern described in CVE-2026-59877. The vulnerability involves an infinite loop in a `while (token !== \"=\")` construct within the parseOption function, which was introduced in a later development branch (editions/aggregate options support) that diverged after version 7.4.0 was released. The target uses a simpler parseOption implement...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59877"
      },
      "impact_statement": "not_affected \u2014 Version 7.4.0-tuxcare.1 does not contain the vulnerable code pattern described in CVE-2026-59877. The vulnerability involves an infinite loop in a `while (token !== \"=\")` construct within the parseOption function, which was introduced in a later development branch (editions/aggregate options support) that diverged after version 7.4.0 was released. The target uses a simpler parseOption implement..."
    }
  ]
}