{"id":"CVE-2026-48712","aliases":["CLSA-2026-1784164061","CLSA-2026-1784250508","CLSA-2026-1784769544","CLSA-2026-1785468075","CLSA-2026-1785468077","CLSA-2026-1790770894","CLSA-2026-1791218903","CLSA-2026-1791293603","CLSA-2026-1791362263","CLSA-2026-1792411164","CLSA-2026-1792490720","CLSA-2026-1793448517","EUVD-2026-38306","GHSA-wcpc-wj8m-hjx6","ROOT-APP-NPM-CVE-2026-48712"],"status":"published","title":"protobufjs: Denial of service through unbounded Any expansion during JSON conversion","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0046,"percentile":0.40147,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2026-06-15T17:30:15Z","modified":"2026-10-31T14:45:04Z","fixes":[{"ecosystem":"npm","package":"protobufjs","fixed_in":["7.6.1","8.4.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"protobufjs","fixed_in":["7.5.9-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"protobufjs","fixed_in":["6.11.2-aikido.1","7.5.4-aikido.6","7.4.0-aikido.5","7.4.0-aikido.6","7.5.7-aikido.3","7.5.8-aikido.1","7.5.6-aikido.3","6.11.4-aikido.4","8.2.0-aikido.1","8.0.3-aikido.4","6.11.6-aikido.5","7.5.5-aikido.5","8.0.1-aikido.7","8.3.0-aikido.1","7.5.4-aikido.7","7.4.0-aikido.7","7.5.5-aikido.6","8.0.3-aikido.5","7.5.6-aikido.4","7.5.8-aikido.2","8.3.0-aikido.2","7.5.7-aikido.4","8.0.1-aikido.8","8.2.0-aikido.2","7.5.4-aikido.8","6.11.4-aikido.5","7.5.7-aikido.5","8.2.0-aikido.3","7.5.6-aikido.5","7.5.5-aikido.7","7.5.8-aikido.3","8.3.0-aikido.3","8.0.3-aikido.6","8.0.1-aikido.9","6.11.6-aikido.6","7.5.5-aikido.8","7.5.3-aikido.1","7.6.0-aikido.1","7.2.0-aikido.3","7.3.2-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/protobufjs","fixed_in":["6.11.2-root.io.1","7.5.4-root.io.6","7.4.0-root.io.5","7.4.0-root.io.6","7.5.7-root.io.3","7.5.8-root.io.1","7.5.6-root.io.3","6.11.4-root.io.4","8.2.0-root.io.1","8.0.3-root.io.4","6.11.6-root.io.5","7.5.5-root.io.5","8.0.1-root.io.7","8.3.0-root.io.1","7.5.4-root.io.7","7.4.0-root.io.7","7.5.5-root.io.6","8.0.3-root.io.5","7.5.6-root.io.4","7.5.8-root.io.2","8.3.0-root.io.2","7.5.7-root.io.4","8.0.1-root.io.8","8.2.0-root.io.2","7.5.4-root.io.8","6.11.4-root.io.5","7.5.7-root.io.5","8.2.0-root.io.3","7.5.6-root.io.5","7.5.5-root.io.7","7.5.8-root.io.3","8.3.0-root.io.3","8.0.3-root.io.6","8.0.1-root.io.9","6.11.6-root.io.6","7.5.5-root.io.8","7.5.3-root.io.1","7.6.0-root.io.1","7.2.0-root.io.3","7.3.2-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"7.6.0"},{"fixed":"7.6.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"last_affected":"8.4.0"},{"fixed":"8.4.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.10.2-tuxcare.0"},{"fixed":"6.10.2-tuxcare.1"}]}],"versions":["6.10.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.6-tuxcare.0"},{"fixed":"6.11.6-tuxcare.4"}]}],"versions":["6.11.6","6.11.6-tuxcare.1","6.11.6-tuxcare.2","6.11.6-tuxcare.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.1-tuxcare.0"},{"fixed":"2.2.1-tuxcare.1"}]}],"versions":["2.2.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.8-tuxcare.0"},{"fixed":"6.8.8-tuxcare.1"}]}],"versions":["6.8.8"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-tuxcare.0"},{"fixed":"5.0.0-tuxcare.2"}]}],"versions":["5.0.0","5.0.0-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.3-tuxcare.0"},{"fixed":"6.11.3-tuxcare.1"}]}],"versions":["6.11.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.0-tuxcare.0"},{"fixed":"7.4.0-tuxcare.1"}]}],"versions":["7.4.0"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-tuxcare.0"},{"fixed":"8.0.0-tuxcare.1"}]}],"versions":["8.0.0"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.1-tuxcare.0"},{"fixed":"8.0.1-tuxcare.1"}]}],"versions":["8.0.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.4-tuxcare.0"},{"fixed":"7.5.4-tuxcare.1"}]}],"versions":["7.5.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.2-tuxcare.0"},{"fixed":"3.8.2-tuxcare.1"}]}],"versions":["3.8.2"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.9-tuxcare.0"},{"fixed":"7.5.9-tuxcare.2"}]}],"versions":["7.5.9","7.5.9-tuxcare.1"]},{"source":"osv","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.6.1"}]}]},{"source":"osv","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.4.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.2-aikido.1"},{"fixed":"7.5.4-aikido.6"},{"fixed":"7.4.0-aikido.5"},{"fixed":"7.4.0-aikido.6"},{"fixed":"7.5.7-aikido.3"},{"fixed":"7.5.8-aikido.1"},{"fixed":"7.5.6-aikido.3"},{"fixed":"6.11.4-aikido.4"},{"fixed":"8.2.0-aikido.1"},{"fixed":"8.0.3-aikido.4"},{"fixed":"6.11.6-aikido.5"},{"fixed":"7.5.5-aikido.5"},{"fixed":"8.0.1-aikido.7"},{"fixed":"8.3.0-aikido.1"},{"fixed":"7.5.4-aikido.7"},{"fixed":"7.4.0-aikido.7"},{"fixed":"7.5.5-aikido.6"},{"fixed":"8.0.3-aikido.5"},{"fixed":"7.5.6-aikido.4"},{"fixed":"7.5.8-aikido.2"},{"fixed":"8.3.0-aikido.2"},{"fixed":"7.5.7-aikido.4"},{"fixed":"8.0.1-aikido.8"},{"fixed":"8.2.0-aikido.2"},{"fixed":"7.5.4-aikido.8"},{"fixed":"6.11.4-aikido.5"},{"fixed":"7.5.7-aikido.5"},{"fixed":"8.2.0-aikido.3"},{"fixed":"7.5.6-aikido.5"},{"fixed":"7.5.5-aikido.7"},{"fixed":"7.5.8-aikido.3"},{"fixed":"8.3.0-aikido.3"},{"fixed":"8.0.3-aikido.6"},{"fixed":"8.0.1-aikido.9"},{"fixed":"6.11.6-aikido.6"},{"fixed":"7.5.5-aikido.8"},{"fixed":"7.5.3-aikido.1"},{"fixed":"7.6.0-aikido.1"},{"fixed":"7.2.0-aikido.3"},{"fixed":"7.3.2-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.2-root.io.1"},{"fixed":"7.5.4-root.io.6"},{"fixed":"7.4.0-root.io.5"},{"fixed":"7.4.0-root.io.6"},{"fixed":"7.5.7-root.io.3"},{"fixed":"7.5.8-root.io.1"},{"fixed":"7.5.6-root.io.3"},{"fixed":"6.11.4-root.io.4"},{"fixed":"8.2.0-root.io.1"},{"fixed":"8.0.3-root.io.4"},{"fixed":"6.11.6-root.io.5"},{"fixed":"7.5.5-root.io.5"},{"fixed":"8.0.1-root.io.7"},{"fixed":"8.3.0-root.io.1"},{"fixed":"7.5.4-root.io.7"},{"fixed":"7.4.0-root.io.7"},{"fixed":"7.5.5-root.io.6"},{"fixed":"8.0.3-root.io.5"},{"fixed":"7.5.6-root.io.4"},{"fixed":"7.5.8-root.io.2"},{"fixed":"8.3.0-root.io.2"},{"fixed":"7.5.7-root.io.4"},{"fixed":"8.0.1-root.io.8"},{"fixed":"8.2.0-root.io.2"},{"fixed":"7.5.4-root.io.8"},{"fixed":"6.11.4-root.io.5"},{"fixed":"7.5.7-root.io.5"},{"fixed":"8.2.0-root.io.3"},{"fixed":"7.5.6-root.io.5"},{"fixed":"7.5.5-root.io.7"},{"fixed":"7.5.8-root.io.3"},{"fixed":"8.3.0-root.io.3"},{"fixed":"8.0.3-root.io.6"},{"fixed":"8.0.1-root.io.9"},{"fixed":"6.11.6-root.io.6"},{"fixed":"7.5.5-root.io.8"},{"fixed":"7.5.3-root.io.1"},{"fixed":"7.6.0-root.io.1"},{"fixed":"7.2.0-root.io.3"},{"fixed":"7.3.2-root.io.2"}]}]}],"products":[{"vendor":"protobufjs","product":"protobuf.js"},{"vendor":"protobufjs_project","product":"protobufjs"}],"references":[{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-wcpc-wj8m-hjx6","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48712","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wcpc-wj8m-hjx6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48712.json","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-48712","title":"protobufjs: Denial of service through unbounded Any expansion during JSON conversion","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.","status":"published","published":"2026-06-22T16:21:21.506Z","modified":"2026-06-23T15:54:24.472Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-38306","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.","status":"published","published":"2026-06-22T16:21:21Z","modified":"2026-06-23T15:54:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:32.768333Z"}],"ghsa":[{"id":"GHSA-wcpc-wj8m-hjx6","title":"protobufjs: Denial of service through unbounded Any expansion during JSON conversion","description":"## Summary\n\nprotobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated `toObject()` conversion and the custom `google.protobuf.Any` JSON conversion path.\n\nA crafted protobuf binary payload containing deeply nested `Any` values could cause the JavaScript call stack to be exhausted during conversion to JSON.\n\n## Impact\n\nAn attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause message conversion to fail with a stack overflow.\n\nThis affects applications that decode untrusted protobuf input containing `google.protobuf.Any` values and then convert decoded messages to JSON or plain objects with JSON conversion enabled, for example through `JSON.stringify(message)`, `Message#toJSON()`, or `Type.toObject(message, { json: true })`.\n\nApplications that only decode and re-encode protobuf binary data without converting decoded messages to JSON are not directly affected by this issue.\n\n## Preconditions\n\n* The application must decode protobuf binary data influenced by an attacker.\n* The application schema must include `google.protobuf.Any`, and the referenced `type_url` must resolve to a message type in the loaded protobuf root.\n* The application must convert the decoded message to JSON or a plain object through an affected conversion path.\n* The crafted input must contain deeply nested `Any` values that are expanded during conversion.\n\n## Workarounds\n\nAvoid converting untrusted protobuf messages containing `google.protobuf.Any` values to JSON with affected versions. If immediate upgrade is not possible, reject or limit messages with deeply nested `Any` payloads at an outer protocol boundary where feasible, avoid JSON conversion of untrusted `Any` values, or isolate message conversion in a process that can be safely restarted.","status":"published","published":"2026-06-15T17:30:15Z","modified":"2026-07-15T22:04:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:40:43.958448Z"}],"nvd":[{"id":"CVE-2026-48712","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.","status":"published","published":"2026-06-22T18:16:39.64Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"CVE-2026-48712","title":"protobufjs: Denial of service through unbounded Any expansion during JSON conversion","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.","status":"published","published":"2026-06-22T16:21:21.506Z","modified":"2026-10-28T02:30:56.597752585Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"GHSA-wcpc-wj8m-hjx6","title":"protobufjs: Denial of service through unbounded Any expansion during JSON conversion","description":"## Summary\n\nprotobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated `toObject()` conversion and the custom `google.protobuf.Any` JSON conversion path.\n\nA crafted protobuf binary payload containing deeply nested `Any` values could cause the JavaScript call stack to be exhausted during conversion to JSON.\n\n## Impact\n\nAn attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause message conversion to fail with a stack overflow.\n\nThis affects applications that decode untrusted protobuf input containing `google.protobuf.Any` values and then convert decoded messages to JSON or plain objects with JSON conversion enabled, for example through `JSON.stringify(message)`, `Message#toJSON()`, or `Type.toObject(message, { json: true })`.\n\nApplications that only decode and re-encode protobuf binary data without converting decoded messages to JSON are not directly affected by this issue.\n\n## Preconditions\n\n* The application must decode protobuf binary data influenced by an attacker.\n* The application schema must include `google.protobuf.Any`, and the referenced `type_url` must resolve to a message type in the loaded protobuf root.\n* The application must convert the decoded message to JSON or a plain object through an affected conversion path.\n* The crafted input must contain deeply nested `Any` values that are expanded during conversion.\n\n## Workarounds\n\nAvoid converting untrusted protobuf messages containing `google.protobuf.Any` values to JSON with affected versions. If immediate upgrade is not possible, reject or limit messages with deeply nested `Any` payloads at an outer protocol boundary where feasible, avoid JSON conversion of untrusted `Any` values, or isolate message conversion in a process that can be safely restarted.","status":"published","published":"2026-06-15T17:30:15Z","modified":"2026-09-10T03:51:09.67527962Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"CLSA-2026-1784164061","title":"TuxCare security update for protobufjs (4 CVEs)","description":"TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 6.10.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-30T19:45:57.267311183Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784250508","title":"TuxCare security update for protobufjs (6 CVEs)","description":"TuxCare rebuilt protobufjs to address 6 CVEs. Fixed in 6.11.6-tuxcare.4.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-15T09:47:36.23843937Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784769544","title":"TuxCare security update for protobufjs (8 CVEs)","description":"TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 2.2.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:36.697524254Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785468075","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 6.8.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:58.137107213Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785468077","title":"TuxCare security update for protobufjs (7 CVEs)","description":"TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 5.0.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:58.183593535Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1790770894","title":"TuxCare security update for protobufjs (4 CVEs)","description":"TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 6.11.3-tuxcare.1.","status":"published","published":"2026-09-30T12:21:34Z","modified":"2026-10-15T09:47:41.943165086Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791218903","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 7.4.0-tuxcare.1.","status":"published","published":"2026-10-05T16:48:23Z","modified":"2026-10-15T09:47:35.511996505Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791293603","title":"TuxCare security update for protobufjs (12 CVEs)","description":"TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 8.0.0-tuxcare.1.","status":"published","published":"2026-10-06T13:33:23Z","modified":"2026-10-15T09:47:58.261804525Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791362263","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 8.0.1-tuxcare.1.","status":"published","published":"2026-10-07T08:37:43Z","modified":"2026-10-15T09:47:58.388325645Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792411164","title":"TuxCare security update for protobufjs (4 CVEs)","description":"TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 7.5.4-tuxcare.1.","status":"published","published":"2026-10-19T11:59:24Z","modified":"2026-10-19T13:30:05.667164716Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792490720","title":"TuxCare security update for protobufjs (12 CVEs)","description":"TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 3.8.2-tuxcare.1.","status":"published","published":"2026-10-20T10:05:18Z","modified":"2026-10-20T13:45:16.914475482Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793448517","title":"TuxCare security update for protobufjs (1 CVE)","description":"TuxCare rebuilt protobufjs to address 1 CVE. Fixed in 7.5.9-tuxcare.2.","status":"published","published":"2026-10-31T13:08:37Z","modified":"2026-10-31T14:45:04.291996726Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"ROOT-APP-NPM-CVE-2026-48712","title":"CVE-2026-48712 in protobufjs - Patched by Root","description":"Root has patched CVE-2026-48712 in the protobufjs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-29T11:44:16Z","modified":"2026-09-29T12:15:04.906514037Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}