{
  "@id": "urn:uuid:d7eabdc6-567f-4d0b-a7e9-330faa0561e3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-07T11:46:00.167649+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-44288 is fixed in version 8.0.1-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44288"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-44289 is fixed in version 8.0.1-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44289"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-44290 is fixed in version 8.0.1-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44290"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-44291 is fixed in version 8.0.1-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44291"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-44292 is fixed in version 8.0.1-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44292"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-44293 is fixed in version 8.0.1-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44293"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-44294 is fixed in version 8.0.1-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44294"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-45740 is fixed in version 8.0.1-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-45740"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-48712 is fixed in version 8.0.1-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-48712"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-54269 is fixed in version 8.0.1-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-54269"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T11:43:00.173804+00:00",
      "status_notes": "Vulnerability CVE-2026-54270 does not affect version 8.0.1-tuxcare.1 of protobufjs. not_affected \u2014 Target version 8.0.1-tuxcare.1 is NOT AFFECTED by CVE-2026-54270. The vulnerability requires unknown field preservation functionality that was introduced in upstream v8.2.0 (commit 76fa03c2, April 2026), which is AFTER the target's base version 8.0.1. The target's decoder simply skips unknown fields without storing them, making the memory accumulation attack path unreachable. Comprehensive sear...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54270"
      },
      "impact_statement": "not_affected \u2014 Target version 8.0.1-tuxcare.1 is NOT AFFECTED by CVE-2026-54270. The vulnerability requires unknown field preservation functionality that was introduced in upstream v8.2.0 (commit 76fa03c2, April 2026), which is AFTER the target's base version 8.0.1. The target's decoder simply skips unknown fields without storing them, making the memory accumulation attack path unreachable. Comprehensive sear..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T11:46:00.167649+00:00",
      "status_notes": "Vulnerability CVE-2026-59876 does not affect version 8.0.1-tuxcare.1 of protobufjs. not_affected \u2014 Version 8.0.1 is not affected by CVE-2026-59876. The vulnerable Text Format extension (ext/textformat.js) does not exist in this version\u2014it was added later in upstream commit 4639e296 (May 9, 2026), which is not an ancestor of the 8.0.1 release line. The CVE explicitly states \"This affected the optional Text Format extension,\" and since this extension is absent from version 8.0.1, the vulnerabi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59876"
      },
      "impact_statement": "not_affected \u2014 Version 8.0.1 is not affected by CVE-2026-59876. The vulnerable Text Format extension (ext/textformat.js) does not exist in this version\u2014it was added later in upstream commit 4639e296 (May 9, 2026), which is not an ancestor of the 8.0.1 release line. The CVE explicitly states \"This affected the optional Text Format extension,\" and since this extension is absent from version 8.0.1, the vulnerabi..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-59877 is fixed in version 8.0.1-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-59877"
      }
    }
  ]
}