{"schemaVersion":3,"id":"CVE-2026-44288","aliases":["CGA-2j53-vggv-2vh7","CGA-4c4r-8rg9-hm6f","CGA-72ff-qm8h-57c6","CGA-7xh6-g7p2-24cf","CGA-996f-7rm8-qhc4","CGA-9m2f-rc99-7x43","CGA-c27m-756f-vw45","CGA-c2rc-cg97-x44v","CGA-cj6c-mr95-xph3","CGA-cq5w-64hm-p9r5","CGA-cxhq-j6rv-pfhp","CGA-frqr-8pw3-j439","CGA-gfm5-7r58-6v28","CGA-hmj3-87vj-g42v","CGA-hwf2-884g-rw9w","CGA-m47j-5w5p-3qf9","CGA-pxfh-68gv-qgrm","CGA-vwv8-mj6g-6m2x","GHSA-q6x5-8v7m-xcrf","CGA-23wr-58wr-gjw5","CGA-27h5-xcrv-9q6f","CGA-28jx-w973-5gcf","CGA-29jx-6pj5-w657","CGA-2fxq-qjg6-vg83","CGA-2jhj-h9m4-6f59","CGA-2mxh-wjgx-q5fw","CGA-2q73-qqpm-v4pj","CGA-2w9p-4pfh-v5mj","CGA-32rf-9g6m-hcrx","CGA-3333-2ppx-5f4j","CGA-33wv-5cq5-jw94","CGA-34vf-8p92-jrg8","CGA-35wq-g22r-9763","CGA-38wg-vj2w-h93x","CGA-3c2g-qwf2-xr6r","CGA-3pp6-vj4x-6gc5","CGA-4pgw-g8r4-2xm3","CGA-4pr2-4mcp-jvm2","CGA-4xcf-gxvc-9mm7","CGA-5445-7vhr-6cf2","CGA-569j-66pr-xhv4","CGA-5734-2fpp-gcrf","CGA-5cv9-w2fg-c7w6","CGA-5g75-5q29-3jqq","CGA-5gm3-pfmr-xj5x","CGA-5pr8-rcq5-q3cj","CGA-5r43-35hr-r7fj","CGA-5wq9-mcmr-4pw7","CGA-5x8h-m443-7r5x","CGA-5x97-pxj3-64hj","CGA-63cv-88m2-98jp","CGA-66m7-528r-6635","CGA-6984-8r84-22p9","CGA-6cpm-jm46-94wr","CGA-6f8g-93xp-8662","CGA-6q85-2x4v-h2c2","CGA-6x9g-pgm6-jh2x","CGA-74hv-f6gf-hv2f","CGA-7657-p99m-72xh","CGA-7cq3-j5xf-xq68","CGA-7j46-vg76-9q28","CGA-7p47-2qvw-r9gx","CGA-86jg-7qjx-27j7","CGA-8c52-jrfm-5xv8","CGA-8jg8-f4mv-q8jw","CGA-8pj4-8vgq-q9hw","CGA-8prq-fh7g-wm5q","CGA-8wm7-c3g3-7qx5","CGA-8x3r-xrwq-gm8w","CGA-977q-cppg-4pmv","CGA-99cw-86qv-rv63","CGA-9q25-mfqq-9wq2","CGA-9qfw-8hgh-6g6m","CGA-9rj6-j9x9-94jp","CGA-9w2g-wqmr-g7pm","CGA-9wjm-3f3c-fq3q","CGA-9xrv-2c42-c44p","CGA-c224-3wv9-2v96","CGA-c5p9-w3cw-m6xm","CGA-c9qw-pv78-3q32","CGA-ccw4-7g85-rvwj","CGA-cqjw-rgmj-4jhr","CGA-cqx5-vpmc-6wfj","CGA-crh6-4jv6-v3hq","CGA-cwvq-hj84-mhpc","CGA-ffcx-8hc9-4v3w","CGA-fmrw-2vcv-x9m9","CGA-fpwf-696g-7r3q","CGA-fvjh-w9wc-f4fp","CGA-fxh2-4xwp-h8gr","CGA-g32w-j779-w796","CGA-g3qc-qmmr-hfrv","CGA-g93p-q85w-f55w","CGA-gg4q-7xhp-5wfv","CGA-ghmx-9m45-67g3","CGA-ghxw-q6cr-c657","CGA-gjp6-pcx7-rm2w","CGA-gqhr-r373-4mfm","CGA-h5h9-jxfc-h9gc","CGA-h7vh-3pjg-vq4j","CGA-hqrv-8mwv-pr5v","CGA-hwp6-4cc4-jf4q","CGA-j3pw-65q9-x6jv","CGA-jc2h-9wcj-5483","CGA-jf4w-w937-73jj","CGA-jf7v-xv46-qq8w","CGA-jfv7-hh49-2fjh","CGA-jfvw-9984-x5pg","CGA-jj5w-r7gv-3j4x","CGA-jmmq-2q7m-9h4p","CGA-jq74-89m2-6c65","CGA-jqxv-fg4v-8g4m","CGA-jrvf-5h4m-5mp8","CGA-jvvf-x54f-535w","CGA-jx6g-p348-rwwh","CGA-m28g-f64q-wgjh","CGA-m535-pp3c-vxfv","CGA-m85q-w775-qw47","CGA-mgp8-44cc-j3r5","CGA-mx8w-g5q8-g8cv","CGA-p2w6-vjqw-q32p","CGA-p6hg-xvh8-qg9q","CGA-p6r2-r5j5-326x","CGA-p8qh-9j8w-g24m","CGA-p9v5-j7j7-3qc9","CGA-pp2r-p599-xfhv","CGA-pvxm-jvrj-hqwg","CGA-q35p-gwqv-m339","CGA-q5qf-g78v-h32x","CGA-q6pg-77p3-7xrg","CGA-q6r4-92hc-9xx8","CGA-q773-7rwm-wmqg","CGA-qcxq-74xf-q7fp","CGA-qmc7-h94m-8mq6","CGA-qp4x-j2x3-98wg","CGA-qr56-6c7j-mfww","CGA-qrgq-6f8q-9624","CGA-r484-9gh8-6gqf","CGA-r7fg-6grc-6fvq","CGA-rxcc-mch7-gqfj","CGA-v5cp-pv45-w26q","CGA-v6qr-x6q5-6vjf","CGA-vcqg-q7v3-hhfg","CGA-vcvc-xxxx-g35m","CGA-vrm8-v559-vccq","CGA-vvv4-2qpq-9q3j","CGA-w4w6-x682-j27r","CGA-w95q-mqg9-9cpj","CGA-wfr3-c387-rffw","CGA-wr9w-g7mx-2985","CGA-wvg7-f5rx-qfrg","CGA-wvxf-pgq2-25m4","CGA-x3pc-4355-5wwj","CGA-x48x-w4c2-8g8r","CGA-x7c5-29q5-rc3f","CGA-xcp3-hp9c-w7q3","CGA-xhf3-q9g6-px2h","CGA-xq94-jhj4-7c6g","CGA-xrhf-m5ch-9hhr","CGA-xrrr-fcj7-98v7","CGA-xvpf-cm36-w22r"],"status":"published","duplicateOf":null,"title":null,"description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain ASCII characters could decode to strings containing those characters. This vulnerability is fixed in 7.5.6 and 8.0.2.","dates":{"published":"2026-05-13T14:37:26.624Z","modified":"2026-05-13T18:33:51.296Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00325,"percentile":0.24127,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.023999999999999976,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00301},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00301,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00301,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00301,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00301,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00301,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00301,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00301,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00301,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00301,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00301,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00325,"percentile":0.24127}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00301,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00301,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00301,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00301,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00325,"percentile":0.24127}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-176","name":"Improper Handling of Unicode Encoding","description":"The product does not properly handle when an input contains Unicode encoding.","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/176.html"}],"affected":[{"vendor":"chainguard","product":"cadence-web","name":"cadence-web","label":"cadence-web","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cadence-web","purlType":"apk","versions":[{"text":"< 4.0.15-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.0.15-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gemini-cli","name":"gemini-cli","label":"gemini-cli","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gemini-cli","purlType":"apk","versions":[{"text":"< 0.44.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"homepage","name":"homepage","label":"homepage","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/homepage","purlType":"apk","versions":[{"text":"< 1.13.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.13.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19","name":"kibana-8.19","label":"kibana-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19","purlType":"apk","versions":[{"text":"< 8.19.15-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.15-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-bitnami","name":"kibana-8.19-bitnami","label":"kibana-8.19-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-bitnami","purlType":"apk","versions":[{"text":"< 8.19.15-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.15-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-iamguarded","name":"kibana-8.19-iamguarded","label":"kibana-8.19-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-iamguarded","purlType":"apk","versions":[{"text":"< 8.19.15-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.15-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0","name":"kibana-9.0","label":"kibana-9.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0","purlType":"apk","versions":[{"text":"< 9.0.8-r29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r29","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-bitnami","name":"kibana-9.0-bitnami","label":"kibana-9.0-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-bitnami","purlType":"apk","versions":[{"text":"< 9.0.8-r29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r29","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-iamguarded","name":"kibana-9.0-iamguarded","label":"kibana-9.0-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-iamguarded","purlType":"apk","versions":[{"text":"< 9.0.8-r29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r29","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1","name":"kibana-9.1","label":"kibana-9.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1","purlType":"apk","versions":[{"text":"< 9.1.10-r18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r18","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1-iamguarded","name":"kibana-9.1-iamguarded","label":"kibana-9.1-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1-iamguarded","purlType":"apk","versions":[{"text":"< 9.1.10-r18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r18","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3","name":"kibana-9.3","label":"kibana-9.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3","purlType":"apk","versions":[{"text":"< 9.3.4-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.4-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3-iamguarded","name":"kibana-9.3-iamguarded","label":"kibana-9.3-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3-iamguarded","purlType":"apk","versions":[{"text":"< 9.3.4-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.4-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4","name":"kibana-9.4","label":"kibana-9.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4","purlType":"apk","versions":[{"text":"< 9.4.2-r2","noFixRecorded":false,"fixedIn":null},{"text":"< 9.4.2-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.2-r2 | < 9.4.2-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4-iamguarded","name":"kibana-9.4-iamguarded","label":"kibana-9.4-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4-iamguarded","purlType":"apk","versions":[{"text":"< 9.4.2-r2","noFixRecorded":false,"fixedIn":null},{"text":"< 9.4.2-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.2-r2 | < 9.4.2-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.10.0-r21","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.0-r21","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3.152","name":"langfuse-fips-3.152","label":"langfuse-fips-3.152","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3.152","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3.152-worker","name":"langfuse-fips-3.152-worker","label":"langfuse-fips-3.152-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3.152-worker","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.4-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.4-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo","name":"nemo","label":"nemo","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo","purlType":"apk","versions":[{"text":"< 2.7.3-r11","noFixRecorded":false,"fixedIn":null},{"text":"< 2.7.3-r19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.7.3-r11 | < 2.7.3-r19","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opentelemetry-auto-instrumentations-node","name":"opentelemetry-auto-instrumentations-node","label":"opentelemetry-auto-instrumentations-node","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opentelemetry-auto-instrumentations-node","purlType":"apk","versions":[{"text":"< 0.76.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.76.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.237.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.237.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"renovate","name":"renovate","label":"renovate","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/renovate","purlType":"apk","versions":[{"text":"< 43.170.15-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 43.170.15-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-22","name":"vitess-22","label":"vitess-22","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-22","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.4-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.4-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.10.0-r21","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.0-r21","eol":null,"hubHref":null},{"vendor":"wolfi","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.237.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.237.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"renovate","name":"renovate","label":"renovate","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/renovate","purlType":"apk","versions":[{"text":"< 43.170.15-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 43.170.15-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.4-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.4-r5","eol":null,"hubHref":null},{"vendor":"Npm","product":"protobufjs","name":"protobufjs","label":"protobufjs","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/protobufjs","purlType":"npm","versions":[{"text":"< 7.5.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.6 | ≥ 8.0.0, < 8.0.2","eol":null,"hubHref":null},{"vendor":"@protobufjs","product":"utf8","name":"@protobufjs/utf8","label":"utf8","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@protobufjs/utf8","purlType":"npm","versions":[{"text":"< 1.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.1","eol":null,"hubHref":null},{"vendor":"protobufjs_project","product":"protobufjs","name":"protobufjs","label":"protobufjs","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.5.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.6 | ≥ 8.0.0, < 8.0.2","eol":null,"hubHref":"/vendor/protobufjs_project/protobufjs"},{"vendor":"protobufjs","product":"protobuf.js","name":"protobuf.js","label":"protobuf.js","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.5.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.6 | ≥ 8.0.0, < 8.0.2","eol":null,"hubHref":"/vendor/protobufjs/protobufjs"}],"affectedCount":33,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-q6x5-8v7m-xcrf","label":"github.com/protobufjs/protobuf.js/security/advisories/GHSA-q6x5-8v7m-xcrf","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB","Vendor Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44288.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44288.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44288","label":"nvd.nist.gov/vuln/detail/CVE-2026-44288","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/protobufjs/protobuf.js","label":"github.com/protobufjs/protobuf.js","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6","label":"github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2","label":"github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-9GM5-V5F4-465P"]},"timeline":[{"kind":"published","date":"2026-05-13T14:37:26.624Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-05-13T18:33:51.296Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T01:15:45.977Z","stale":false,"partial":false}}