{
  "@id": "urn:uuid:1ec506ae-f6a5-444f-bdf8-a213261e809b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T01:57:00.048642+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-57820 affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-57820"
      },
      "action_statement": "Vulnerability CVE-2025-57820 affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123561 affects version 4.3.1 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123561"
      },
      "action_statement": "Vulnerability CVE-2026-123561 affects version 4.3.1 of devalue."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-11-08T01:54:36.091996+00:00",
      "status_notes": "Vulnerability CVE-2026-123562 does not affect version 4.3.1 of devalue. not_affected \u2014 Target is devalue 4.3.1-tuxcare.4, which has no stringifyAsync and no Promise or async handling. The unhandled-rejection flaw, which exists only in devalue 5.8.0 to 5.9.2, cannot occur here.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123562"
      },
      "impact_statement": "not_affected \u2014 Target is devalue 4.3.1-tuxcare.4, which has no stringifyAsync and no Promise or async handling. The unhandled-rejection flaw, which exists only in devalue 5.8.0 to 5.9.2, cannot occur here."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-11-08T01:57:00.048642+00:00",
      "status_notes": "Vulnerability CVE-2026-123563 does not affect version 4.3.1 of devalue. not_affected \u2014 devalue 4.3.1-tuxcare.4 has no ArrayBuffer/typed-array support in parse/unflatten. The only path touching binary buffers is a user-supplied reviver, which is caller code. The library has no typed-array allocation code, so there is no allocation check to bypass. The library's own length-driven allocation (sparse arrays) is already guarded.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-123563"
      },
      "impact_statement": "not_affected \u2014 devalue 4.3.1-tuxcare.4 has no ArrayBuffer/typed-array support in parse/unflatten. The only path touching binary buffers is a user-supplied reviver, which is caller code. The library has no typed-array allocation code, so there is no allocation check to bypass. The library's own length-driven allocation (sparse arrays) is already guarded."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123564 affects version 4.3.1 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123564"
      },
      "action_statement": "Vulnerability CVE-2026-123564 affects version 4.3.1 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123565 affects version 4.3.1 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123565"
      },
      "action_statement": "Vulnerability CVE-2026-123565 affects version 4.3.1 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123566 affects version 4.3.1 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123566"
      },
      "action_statement": "Vulnerability CVE-2026-123566 affects version 4.3.1 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123567 affects version 4.3.1 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123567"
      },
      "action_statement": "Vulnerability CVE-2026-123567 affects version 4.3.1 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123568 affects version 4.3.1 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123568"
      },
      "action_statement": "Vulnerability CVE-2026-123568 affects version 4.3.1 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123569 affects version 4.3.1 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123569"
      },
      "action_statement": "Vulnerability CVE-2026-123569 affects version 4.3.1 of devalue."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22774 does not affect version 4.3.1 of devalue. Version 4.3.1 is not affected by CVE-2026-22774. The vulnerability concerns typed array deserialization in devalue.parse, where malformed input can cause excessive memory allocation when TypedArray constructors receive non-ArrayBuffer values. However, version 4.3.1 does not have TypedArray or ArrayBuffer deserialization support at all\u2014this feature was added in version 4.3.2+ (commit bbf86c2). When TypedArray-formatted data is sent to v4.3.1, it's rejected with \"Unknown type\" error at src/parse.js:105. The vulnerable code path does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22774"
      },
      "impact_statement": "Version 4.3.1 is not affected by CVE-2026-22774. The vulnerability concerns typed array deserialization in devalue.parse, where malformed input can cause excessive memory allocation when TypedArray constructors receive non-ArrayBuffer values. However, version 4.3.1 does not have TypedArray or ArrayBuffer deserialization support at all\u2014this feature was added in version 4.3.2+ (commit bbf86c2). When TypedArray-formatted data is sent to v4.3.1, it's rejected with \"Unknown type\" error at src/parse.js:105. The vulnerable code path does not exist in this version."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-30226 affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-30226"
      },
      "action_statement": "Vulnerability CVE-2026-30226 affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-09-28T14:46:02.549463+00:00",
      "status_notes": "Vulnerability CVE-2026-42570 affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-42570"
      },
      "action_statement": "Vulnerability CVE-2026-42570 affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-09-28T14:46:02.549463+00:00",
      "status_notes": "Vulnerability CVE-2026-81176 affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-81176"
      },
      "action_statement": "Vulnerability CVE-2026-81176 affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-33hq-fvwr-56pm affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-33hq-fvwr-56pm"
      },
      "action_statement": "Vulnerability GHSA-33hq-fvwr-56pm affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-10-10T10:04:00.071644+00:00",
      "status_notes": "Vulnerability GHSA-4q55-j62x-fr9h affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-4q55-j62x-fr9h"
      },
      "action_statement": "Vulnerability GHSA-4q55-j62x-fr9h affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-8qm3-746x-r74r affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-8qm3-746x-r74r"
      },
      "action_statement": "Vulnerability GHSA-8qm3-746x-r74r affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-10-10T21:14:00.094377+00:00",
      "status_notes": "Vulnerability GHSA-hx4r-w6wj-j8fg affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.4.",
      "vulnerability": {
        "name": "GHSA-hx4r-w6wj-j8fg"
      },
      "action_statement": "Vulnerability GHSA-hx4r-w6wj-j8fg affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-10-10T21:14:00.094377+00:00",
      "status_notes": "Vulnerability GHSA-mcm9-63f2-9j32 affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.4.",
      "vulnerability": {
        "name": "GHSA-mcm9-63f2-9j32"
      },
      "action_statement": "Vulnerability GHSA-mcm9-63f2-9j32 affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mwv9-gp5h-frr4 affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-mwv9-gp5h-frr4"
      },
      "action_statement": "Vulnerability GHSA-mwv9-gp5h-frr4 affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-10-01T17:36:03.503905+00:00",
      "status_notes": "Vulnerability GHSA-r9w8-h9r3-54w4 does not affect version 4.3.1 of devalue. not_affected \u2014 Target version 4.3.1-tuxcare.2 does not contain ArrayBuffer handling code required for GHSA-r9w8-h9r3-54w4. ArrayBuffer support was introduced in commit bbf86c2 (Sep 2023), first released in upstream v5.1.0. The target version predates this feature and lacks the vulnerable code path entirely. The parse.js switch statement only handles Date, Set, Map, RegExp, Object, BigInt, and null types - no ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r9w8-h9r3-54w4"
      },
      "impact_statement": "not_affected \u2014 Target version 4.3.1-tuxcare.2 does not contain ArrayBuffer handling code required for GHSA-r9w8-h9r3-54w4. ArrayBuffer support was introduced in commit bbf86c2 (Sep 2023), first released in upstream v5.1.0. The target version predates this feature and lacks the vulnerable code path entirely. The parse.js switch statement only handles Date, Set, Map, RegExp, Object, BigInt, and null types - no ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@4.3.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@4.3.1"
          }
        }
      ],
      "timestamp": "2026-10-10T21:14:00.094377+00:00",
      "status_notes": "Vulnerability GHSA-wf3x-273g-mvxv affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.4.",
      "vulnerability": {
        "name": "GHSA-wf3x-273g-mvxv"
      },
      "action_statement": "Vulnerability GHSA-wf3x-273g-mvxv affects version 4.3.1 of devalue, and is fixed in 4.3.1-tuxcare.4."
    }
  ]
}