{"id":"CVE-2026-44289","aliases":["CLSA-2026-1779670111","CLSA-2026-1784769544","CLSA-2026-1785380788","CLSA-2026-1785380800","CLSA-2026-1785468075","CLSA-2026-1785468077","CLSA-2026-1791218903","CLSA-2026-1791293603","CLSA-2026-1791362263","CLSA-2026-1792184156","CLSA-2026-1792411164","CLSA-2026-1792490720","EUVD-2026-30027","GHSA-685m-2w69-288q","ROOT-APP-NPM-CVE-2026-44289"],"status":"published","title":"protobufjs: Denial of service through unbounded protobuf recursion","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0063,"percentile":0.5065,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-606","CWE-674"],"published":"2026-05-12T15:01:05Z","modified":"2026-10-28T02:31:03Z","fixes":[{"ecosystem":"npm","package":"protobufjs","fixed_in":["7.5.6","8.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"protobufjs","fixed_in":["6.11.2-aikido.1","7.4.0-aikido.3","7.5.5-aikido.3","7.5.4-aikido.4","8.0.1-aikido.4","6.11.4-aikido.2","6.11.6-aikido.2","7.5.5-aikido.4","7.5.4-aikido.5","8.0.1-aikido.5","7.4.0-aikido.4","8.0.1-aikido.6","7.5.4-aikido.6","7.4.0-aikido.5","7.4.0-aikido.6","6.11.4-aikido.3","6.11.6-aikido.3","6.11.6-aikido.4","6.11.4-aikido.4","6.11.6-aikido.5","7.5.5-aikido.5","8.0.1-aikido.7","7.5.4-aikido.7","7.4.0-aikido.7","7.5.5-aikido.6","8.0.1-aikido.8","7.5.4-aikido.8","6.11.4-aikido.5","7.5.5-aikido.7","8.0.1-aikido.9","6.11.6-aikido.6","7.5.5-aikido.8","7.5.3-aikido.1","7.2.0-aikido.3","7.3.2-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/protobufjs","fixed_in":["7.4.0-root.io.2","7.5.5-root.io.1","8.0.1-root.io.1","7.5.4-root.io.2","8.0.1-root.io.2","7.5.4-root.io.3","7.5.5-root.io.2","8.0.1-root.io.3","6.11.4-root.io.1","6.11.6-root.io.1","6.11.2-root.io.1","7.4.0-root.io.3","7.5.5-root.io.3","7.5.4-root.io.4","8.0.1-root.io.4","6.11.4-root.io.2","6.11.6-root.io.2","7.5.5-root.io.4","7.5.4-root.io.5","8.0.1-root.io.5","7.4.0-root.io.4","8.0.1-root.io.6","7.5.4-root.io.6","7.4.0-root.io.5","7.4.0-root.io.6","6.11.4-root.io.3","6.11.6-root.io.3","6.11.6-root.io.4","6.11.4-root.io.4","6.11.6-root.io.5","7.5.5-root.io.5","8.0.1-root.io.7","7.5.4-root.io.7","7.4.0-root.io.7","7.5.5-root.io.6","8.0.1-root.io.8","7.5.4-root.io.8","6.11.4-root.io.5","7.5.5-root.io.7","8.0.1-root.io.9","6.11.6-root.io.6","7.5.5-root.io.8","7.5.3-root.io.1","7.2.0-root.io.3","7.3.2-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"7.5.5"},{"fixed":"7.5.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"last_affected":"8.0.1"},{"fixed":"8.0.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.6-tuxcare.0"},{"fixed":"6.11.6-tuxcare.3"}]}],"versions":["6.11.6","6.11.6-tuxcare.1","6.11.6-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.1-tuxcare.0"},{"fixed":"2.2.1-tuxcare.1"}]}],"versions":["2.2.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.1-tuxcare.0"},{"fixed":"1.5.1-tuxcare.1"}]}],"versions":["1.5.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.13-tuxcare.0"},{"fixed":"0.12.13-tuxcare.1"}]}],"versions":["0.12.13"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.8-tuxcare.0"},{"fixed":"6.8.8-tuxcare.1"}]}],"versions":["6.8.8"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-tuxcare.0"},{"fixed":"5.0.0-tuxcare.2"}]}],"versions":["5.0.0","5.0.0-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.0-tuxcare.0"},{"fixed":"7.4.0-tuxcare.1"}]}],"versions":["7.4.0"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-tuxcare.0"},{"fixed":"8.0.0-tuxcare.1"}]}],"versions":["8.0.0"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.1-tuxcare.0"},{"fixed":"8.0.1-tuxcare.1"}]}],"versions":["8.0.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.3-tuxcare.0"},{"fixed":"6.11.3-tuxcare.2"}]}],"versions":["6.11.3","6.11.3-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.4-tuxcare.0"},{"fixed":"7.5.4-tuxcare.1"}]}],"versions":["7.5.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.2-tuxcare.0"},{"fixed":"3.8.2-tuxcare.1"}]}],"versions":["3.8.2"],"bundled":12},{"source":"osv","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.5.6"}]}]},{"source":"osv","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.2-aikido.1"},{"fixed":"7.4.0-aikido.3"},{"fixed":"7.5.5-aikido.3"},{"fixed":"7.5.4-aikido.4"},{"fixed":"8.0.1-aikido.4"},{"fixed":"6.11.4-aikido.2"},{"fixed":"6.11.6-aikido.2"},{"fixed":"7.5.5-aikido.4"},{"fixed":"7.5.4-aikido.5"},{"fixed":"8.0.1-aikido.5"},{"fixed":"7.4.0-aikido.4"},{"fixed":"8.0.1-aikido.6"},{"fixed":"7.5.4-aikido.6"},{"fixed":"7.4.0-aikido.5"},{"fixed":"7.4.0-aikido.6"},{"fixed":"6.11.4-aikido.3"},{"fixed":"6.11.6-aikido.3"},{"fixed":"6.11.6-aikido.4"},{"fixed":"6.11.4-aikido.4"},{"fixed":"6.11.6-aikido.5"},{"fixed":"7.5.5-aikido.5"},{"fixed":"8.0.1-aikido.7"},{"fixed":"7.5.4-aikido.7"},{"fixed":"7.4.0-aikido.7"},{"fixed":"7.5.5-aikido.6"},{"fixed":"8.0.1-aikido.8"},{"fixed":"7.5.4-aikido.8"},{"fixed":"6.11.4-aikido.5"},{"fixed":"7.5.5-aikido.7"},{"fixed":"8.0.1-aikido.9"},{"fixed":"6.11.6-aikido.6"},{"fixed":"7.5.5-aikido.8"},{"fixed":"7.5.3-aikido.1"},{"fixed":"7.2.0-aikido.3"},{"fixed":"7.3.2-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-root.io.2"},{"fixed":"7.5.5-root.io.1"},{"fixed":"8.0.1-root.io.1"},{"fixed":"7.5.4-root.io.2"},{"fixed":"8.0.1-root.io.2"},{"fixed":"7.5.4-root.io.3"},{"fixed":"7.5.5-root.io.2"},{"fixed":"8.0.1-root.io.3"},{"fixed":"6.11.4-root.io.1"},{"fixed":"6.11.6-root.io.1"},{"fixed":"6.11.2-root.io.1"},{"fixed":"7.4.0-root.io.3"},{"fixed":"7.5.5-root.io.3"},{"fixed":"7.5.4-root.io.4"},{"fixed":"8.0.1-root.io.4"},{"fixed":"6.11.4-root.io.2"},{"fixed":"6.11.6-root.io.2"},{"fixed":"7.5.5-root.io.4"},{"fixed":"7.5.4-root.io.5"},{"fixed":"8.0.1-root.io.5"},{"fixed":"7.4.0-root.io.4"},{"fixed":"8.0.1-root.io.6"},{"fixed":"7.5.4-root.io.6"},{"fixed":"7.4.0-root.io.5"},{"fixed":"7.4.0-root.io.6"},{"fixed":"6.11.4-root.io.3"},{"fixed":"6.11.6-root.io.3"},{"fixed":"6.11.6-root.io.4"},{"fixed":"6.11.4-root.io.4"},{"fixed":"6.11.6-root.io.5"},{"fixed":"7.5.5-root.io.5"},{"fixed":"8.0.1-root.io.7"},{"fixed":"7.5.4-root.io.7"},{"fixed":"7.4.0-root.io.7"},{"fixed":"7.5.5-root.io.6"},{"fixed":"8.0.1-root.io.8"},{"fixed":"7.5.4-root.io.8"},{"fixed":"6.11.4-root.io.5"},{"fixed":"7.5.5-root.io.7"},{"fixed":"8.0.1-root.io.9"},{"fixed":"6.11.6-root.io.6"},{"fixed":"7.5.5-root.io.8"},{"fixed":"7.5.3-root.io.1"},{"fixed":"7.2.0-root.io.3"},{"fixed":"7.3.2-root.io.2"}]}]}],"products":[{"vendor":"protobufjs","product":"protobuf.js"},{"vendor":"protobufjs_project","product":"protobufjs"},{"vendor":"red hat","product":"openshift pipelines"},{"vendor":"red hat","product":"openshift service mesh 3"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat ansible automation platform 2.2"},{"vendor":"red hat","product":"red hat build of podman desktop"},{"vendor":"red hat","product":"red hat ceph storage 9"},{"vendor":"red hat","product":"red hat developer hub"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 3.4"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift data foundation 4"}],"references":[{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-685m-2w69-288q","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44289","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477130","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44289.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42815","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6","tags":["web"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44289","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-685m-2w69-288q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44289.json","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-44289","title":"protobufjs: Denial of service through unbounded protobuf recursion","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.","status":"published","published":"2026-05-13T14:39:09.791Z","modified":"2026-08-28T12:04:26.986Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-674","CWE-606"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-30027","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.","status":"published","published":"2026-05-13T14:39:09Z","modified":"2026-08-28T12:04:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:23.608347Z"}],"ghsa":[{"id":"GHSA-685m-2w69-288q","title":"protobuf.js: Denial of service through unbounded protobuf recursion","description":"## Summary\n\nprotobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields.\n\nA crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding.\n\n## Impact\n\nAn attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause decoding to fail with a stack overflow.\n\nThis affects applications that decode untrusted protobuf binary input with affected versions.\n\n## Preconditions\n\n- The application must decode protobuf binary data influenced by an attacker.\n- The crafted input must contain deeply nested protobuf structures, such as nested group tags or nested message fields.\n- The affected decoder path must process the crafted input.\n\n## Workarounds\n\nAvoid decoding untrusted protobuf binary data with affected versions. If immediate upgrade is not possible, reject excessively nested messages at an outer protocol boundary where feasible, or isolate protobuf decoding in a process that can be safely restarted.","status":"published","published":"2026-05-12T15:01:05Z","modified":"2026-05-14T20:35:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:40:09.033429Z"}],"nvd":[{"id":"CVE-2026-44289","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.","status":"published","published":"2026-05-13T16:16:55.713Z","modified":"2026-11-11T20:10:00.273Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-674","CWE-606"],"updated_at":"2026-11-11T21:26:15.366289Z"}],"osv":[{"id":"CVE-2026-44289","title":"protobufjs: Denial of service through unbounded protobuf recursion","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.","status":"published","published":"2026-05-13T14:39:09.791Z","modified":"2026-10-28T02:31:03.014544599Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"GHSA-685m-2w69-288q","title":"protobuf.js: Denial of service through unbounded protobuf recursion","description":"## Summary\n\nprotobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields.\n\nA crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding.\n\n## Impact\n\nAn attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause decoding to fail with a stack overflow.\n\nThis affects applications that decode untrusted protobuf binary input with affected versions.\n\n## Preconditions\n\n- The application must decode protobuf binary data influenced by an attacker.\n- The crafted input must contain deeply nested protobuf structures, such as nested group tags or nested message fields.\n- The affected decoder path must process the crafted input.\n\n## Workarounds\n\nAvoid decoding untrusted protobuf binary data with affected versions. If immediate upgrade is not possible, reject excessively nested messages at an outer protocol boundary where feasible, or isolate protobuf decoding in a process that can be safely restarted.","status":"published","published":"2026-05-12T15:01:05Z","modified":"2026-09-10T03:50:45.700576464Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"ROOT-APP-NPM-CVE-2026-44289","title":"CVE-2026-44289 in protobufjs - Patched by Root","description":"Root has patched CVE-2026-44289 in the protobufjs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-29T11:44:16Z","modified":"2026-09-29T12:15:03.629291099Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"CLSA-2026-1779670111","title":"TuxCare security update for protobufjs (3 CVEs)","description":"TuxCare rebuilt protobufjs to address 3 CVEs. Fixed in 6.11.6-tuxcare.3.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:48:03.584351626Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1784769544","title":"TuxCare security update for protobufjs (8 CVEs)","description":"TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 2.2.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:36.697524254Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785380788","title":"TuxCare security update for protobufjs (3 CVEs)","description":"TuxCare rebuilt protobufjs to address 3 CVEs. Fixed in 1.5.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-23T19:28:12.787611364Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785380800","title":"TuxCare security update for protobufjs (4 CVEs)","description":"TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 0.12.13-tuxcare.1.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:48:03.87706677Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785468075","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 6.8.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:58.137107213Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785468077","title":"TuxCare security update for protobufjs (7 CVEs)","description":"TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 5.0.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:58.183593535Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1791218903","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 7.4.0-tuxcare.1.","status":"published","published":"2026-10-05T16:48:23Z","modified":"2026-10-15T09:47:35.511996505Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791293603","title":"TuxCare security update for protobufjs (12 CVEs)","description":"TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 8.0.0-tuxcare.1.","status":"published","published":"2026-10-06T13:33:23Z","modified":"2026-10-15T09:47:58.261804525Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791362263","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 8.0.1-tuxcare.1.","status":"published","published":"2026-10-07T08:37:43Z","modified":"2026-10-15T09:47:58.388325645Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792184156","title":"TuxCare security update for protobufjs (8 CVEs)","description":"TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 6.11.3-tuxcare.2.","status":"published","published":"2026-10-16T20:55:56Z","modified":"2026-10-17T01:30:06.508288094Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792411164","title":"TuxCare security update for protobufjs (4 CVEs)","description":"TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 7.5.4-tuxcare.1.","status":"published","published":"2026-10-19T11:59:24Z","modified":"2026-10-19T13:30:05.667164716Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792490720","title":"TuxCare security update for protobufjs (12 CVEs)","description":"TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 3.8.2-tuxcare.1.","status":"published","published":"2026-10-20T10:05:18Z","modified":"2026-10-20T13:45:16.914475482Z","updated_at":"2026-11-02T15:43:54.378946Z"}]}}