{
  "@id": "urn:uuid:a14428a2-dd62-48c7-aae8-e3248314c0b6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-06T13:35:00.223833+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T13:35:00.223833+00:00",
      "status_notes": "Vulnerability CVE-2026-41242 is fixed in version 8.0.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-41242"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T13:35:00.223833+00:00",
      "status_notes": "Vulnerability CVE-2026-44288 is fixed in version 8.0.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44288"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T13:34:01.072065+00:00",
      "status_notes": "Vulnerability CVE-2026-44289 is fixed in version 8.0.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44289"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T13:35:00.223833+00:00",
      "status_notes": "Vulnerability CVE-2026-44290 is fixed in version 8.0.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44290"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T13:35:00.223833+00:00",
      "status_notes": "Vulnerability CVE-2026-44291 is fixed in version 8.0.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44291"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T13:34:01.072065+00:00",
      "status_notes": "Vulnerability CVE-2026-44292 is fixed in version 8.0.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44292"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T13:34:01.072065+00:00",
      "status_notes": "Vulnerability CVE-2026-44293 is fixed in version 8.0.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44293"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T13:35:00.223833+00:00",
      "status_notes": "Vulnerability CVE-2026-44294 is fixed in version 8.0.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-44294"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T13:34:01.072065+00:00",
      "status_notes": "Vulnerability CVE-2026-45740 is fixed in version 8.0.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-45740"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T13:35:00.223833+00:00",
      "status_notes": "Vulnerability CVE-2026-48712 is fixed in version 8.0.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-48712"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T13:35:00.223833+00:00",
      "status_notes": "Vulnerability CVE-2026-54269 is fixed in version 8.0.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-54269"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T13:34:01.072065+00:00",
      "status_notes": "Vulnerability CVE-2026-54270 does not affect version 8.0.0-tuxcare.1 of protobufjs. not_affected \u2014 Target version 8.0.0 predates the vulnerability introduction. CVE-2026-54270 affects protobufjs 8.2.0-8.6.1 where unknown field preservation was enabled by default. Version 8.0.0 does not contain the unknown field storage feature introduced in 8.2.0 (commit 76fa03c2). The decoder simply skips unknown fields via Reader.skipType() without retaining them in memory, preventing the memory amplificat...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54270"
      },
      "impact_statement": "not_affected \u2014 Target version 8.0.0 predates the vulnerability introduction. CVE-2026-54270 affects protobufjs 8.2.0-8.6.1 where unknown field preservation was enabled by default. Version 8.0.0 does not contain the unknown field storage feature introduced in 8.2.0 (commit 76fa03c2). The decoder simply skips unknown fields via Reader.skipType() without retaining them in memory, preventing the memory amplificat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T13:34:01.072065+00:00",
      "status_notes": "Vulnerability CVE-2026-59876 does not affect version 8.0.0-tuxcare.1 of protobufjs. not_affected \u2014 CVE-2026-59876 affects the protobuf.js Text Format extension (ext/textformat.js), which does not exist in version 8.0.0. The textformat extension was added after version 8.0.0 (in May 2026, commit 4639e296), while the target version 8.0.0 was released in December 2025. The vulnerable code path is absent from this version entirely.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59876"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-59876 affects the protobuf.js Text Format extension (ext/textformat.js), which does not exist in version 8.0.0. The textformat extension was added after version 8.0.0 (in May 2026, commit 4639e296), while the target version 8.0.0 was released in December 2025. The vulnerable code path is absent from this version entirely."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/protobufjs@8.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/protobufjs@8.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T13:35:00.223833+00:00",
      "status_notes": "Vulnerability CVE-2026-59877 is fixed in version 8.0.0-tuxcare.1 of protobufjs.",
      "vulnerability": {
        "name": "CVE-2026-59877"
      }
    }
  ]
}