{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:cb5249d9-0a17-52f0-b99f-0fee60a415ae",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2",
      "type": "library",
      "name": "dcodeIO_dcodeIO_protobuf.js",
      "version": "6.10.2-tuxcare.2",
      "purl": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:51cc95f2-d105-55dc-b1cc-c8d447ba775f",
      "id": "CVE-2022-25878",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-25878 is fixed in version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2da96fa8-04a6-5f76-8474-da87707f485c",
      "id": "CVE-2023-36665",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-36665 is fixed in version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d90aa8c1-5463-50a9-bfd4-592ef8d4925e",
      "id": "CVE-2026-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41242 is fixed in version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:70204ec9-4935-5017-8f7e-fffd69f62b76",
      "id": "CVE-2026-44288",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44288 is fixed in version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:70b02132-a490-5e1e-b8fe-fab0c24e65b4",
      "id": "CVE-2026-44289",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44289 is fixed in version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d66abaa7-4650-5009-869b-781470dc2a5c",
      "id": "CVE-2026-44290",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-44290 does not affect version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js. CVE-2026-44290 fix already exists in commit f87c65fb1bedc7be0ee2504542878b86ee943218"
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f32f7f12-da23-55ae-a484-720dd4f200d5",
      "id": "CVE-2026-44291",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44291 is fixed in version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a090d8c0-8d3a-5667-9931-173d26fcf705",
      "id": "CVE-2026-44292",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44292 is fixed in version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:add9f473-ce27-5b7f-9333-752fa0e747fc",
      "id": "CVE-2026-44293",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44293 is fixed in version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6fc12a8e-9d9b-57a3-8fd4-7bf65c4733ca",
      "id": "CVE-2026-44294",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44294 is fixed in version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8c6759f8-5ae0-5611-ad9e-65961ed09788",
      "id": "CVE-2026-45740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45740 is fixed in version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a891a9e6-f56a-5fe6-99e2-517fd0901362",
      "id": "CVE-2026-48712",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-48712 is fixed in version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9fe823b1-94e5-5b47-9a75-0cb1b0a6ec13",
      "id": "CVE-2026-54269",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54269 affects version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:be15586b-cf7f-5296-bf12-dba0dca82992",
      "id": "CVE-2026-54270",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54270 does not affect version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js. not_affected \u2014 Target version 6.10.2 is not affected by CVE-2026-54270. The vulnerability concerns excessive memory retention from unknown field preservation, a feature introduced in protobufjs 8.2.0. Version 6.10.2 does not implement unknown field preservation; unknown fields are simply skipped during decode without storing them in memory."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:08ce9c6c-4295-5a06-9a92-4c1910a023cc",
      "id": "CVE-2026-59876",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59876 does not affect version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js. not_affected \u2014 CVE-2026-59876 specifically affects the optional Text Format extension (ext/textformat.js) which does not exist in protobufjs version 6.10.2. This extension was introduced as a new feature in version 8.x. Without the Text Format extension, the attack vector described in the CVE cannot be exploited."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2346982c-ef17-50d0-834e-dd0ba11aad65",
      "id": "CVE-2026-59877",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59877 does not affect version 6.10.2-tuxcare.2 of dcodeIO_dcodeIO_protobuf.js. not_affected \u2014 Version 6.10.2 is not affected by CVE-2026-59877. The vulnerable code pattern (a while loop advancing through tokens looking for '=' without EOF checking) does not exist in this version. Version 6.10.2 uses a different architecture with skip('=') that properly handles EOF by throwing an error."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.2"
    }
  ]
}