{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f5dbad53-e284-52de-91ad-f27046be985f",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3",
      "type": "library",
      "name": "dcodeIO_dcodeIO_protobuf.js",
      "version": "6.10.2-tuxcare.3",
      "purl": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:bf5d6d55-9edc-5e63-bdd0-15afbe1eca3f",
      "id": "CVE-2022-25878",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-25878 is fixed in version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0652b075-5f7a-5228-93e6-e746cd462c3d",
      "id": "CVE-2023-36665",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-36665 is fixed in version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:23bcab8d-4dbb-5fbb-a7d0-20247fcdac3d",
      "id": "CVE-2026-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41242 is fixed in version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fc62ea43-b785-54c7-8641-34bfee513eb7",
      "id": "CVE-2026-44288",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44288 is fixed in version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ea8ba411-dfe9-5fd0-9c37-a853b3155a74",
      "id": "CVE-2026-44289",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44289 is fixed in version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d42367bd-1826-51cf-8116-17518bc05161",
      "id": "CVE-2026-44290",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-44290 does not affect version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js. CVE-2026-44290 fix already exists in commit f87c65fb1bedc7be0ee2504542878b86ee943218"
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:989a73d9-12be-592b-9a45-d7567ae37b8e",
      "id": "CVE-2026-44291",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44291 is fixed in version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:70c48e7c-348d-562d-8bfc-07a3e83e81e1",
      "id": "CVE-2026-44292",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44292 is fixed in version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c13156d9-1992-564c-880b-ca1bf8b1525f",
      "id": "CVE-2026-44293",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44293 is fixed in version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:61e249b7-07ee-5cf4-bc6e-354c04ba6cb3",
      "id": "CVE-2026-44294",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44294 is fixed in version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5fea7614-1010-5216-abab-9c81eb6035f6",
      "id": "CVE-2026-45740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45740 is fixed in version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cbd08df1-2d8b-58dd-bc7f-7dce8e94d6e7",
      "id": "CVE-2026-48712",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-48712 is fixed in version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d08c0826-a416-5a52-a223-9ab27737e97c",
      "id": "CVE-2026-54269",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54269 affects version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:de9a9b2b-fb94-5719-b961-18ee7d66708c",
      "id": "CVE-2026-54270",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54270 does not affect version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js. not_affected \u2014 Target version 6.10.2 is not affected by CVE-2026-54270. The vulnerability concerns excessive memory retention from unknown field preservation, a feature introduced in protobufjs 8.2.0. Version 6.10.2 does not implement unknown field preservation; unknown fields are simply skipped during decode without storing them in memory."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:777d61d9-08d4-5e1e-beed-7128a7451436",
      "id": "CVE-2026-59876",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59876 does not affect version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js. not_affected \u2014 CVE-2026-59876 specifically affects the optional Text Format extension (ext/textformat.js) which does not exist in protobufjs version 6.10.2. This extension was introduced as a new feature in version 8.x. Without the Text Format extension, the attack vector described in the CVE cannot be exploited."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2711bcd2-1f64-5fa2-80f5-55b829920ebb",
      "id": "CVE-2026-59877",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59877 does not affect version 6.10.2-tuxcare.3 of dcodeIO_dcodeIO_protobuf.js. not_affected \u2014 Version 6.10.2 is not affected by CVE-2026-59877. The vulnerable code pattern (a while loop advancing through tokens looking for '=' without EOF checking) does not exist in this version. Version 6.10.2 uses a different architecture with skip('=') that properly handles EOF by throwing an error."
      },
      "affects": [
        {
          "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/dcodeIO_dcodeIO_protobuf.js@6.10.2-tuxcare.3"
    }
  ]
}