{
  "@id": "urn:uuid:1aea1109-70ca-40df-b9fc-eb4e34a3eaec",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T22:41:49.096351+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/bl@1.0.3",
          "identifiers": {
            "purl": "pkg:npm/bl@1.0.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-8244 affects version 1.0.3 of bl, and is fixed in 1.0.3-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2020-8244"
      },
      "action_statement": "Vulnerability CVE-2020-8244 affects version 1.0.3 of bl, and is fixed in 1.0.3-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/bl@1.0.3",
          "identifiers": {
            "purl": "pkg:npm/bl@1.0.3"
          }
        }
      ],
      "timestamp": "2026-11-03T22:41:49.096351+00:00",
      "status_notes": "Vulnerability GHSA-wrw9-m778-g6mc does not affect version 1.0.3 of bl. not_affected \u2014 The target repository (bl version 1.0.3-tuxcare.1) is NOT affected by GHSA-wrw9-m778-g6mc. The vulnerability pattern has been removed by an upstream fix that was already present in the upstream release 1.0.3 before TuxCare onboarded the package. The fix (commit 061279d) adds type checking to the append() method to coerce number arguments to strings before passing them to the Buffer constructor,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wrw9-m778-g6mc"
      },
      "impact_statement": "not_affected \u2014 The target repository (bl version 1.0.3-tuxcare.1) is NOT affected by GHSA-wrw9-m778-g6mc. The vulnerability pattern has been removed by an upstream fix that was already present in the upstream release 1.0.3 before TuxCare onboarded the package. The fix (commit 061279d) adds type checking to the append() method to coerce number arguments to strings before passing them to the Buffer constructor,..."
    }
  ]
}