{
  "@id": "urn:uuid:f9e2891e-8502-47ca-92d6-37924164c6bd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T02:18:54.319671+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123561 affects version 5.8.1 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123561"
      },
      "action_statement": "Vulnerability CVE-2026-123561 affects version 5.8.1 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123562 affects version 5.8.1 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123562"
      },
      "action_statement": "Vulnerability CVE-2026-123562 affects version 5.8.1 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123563 affects version 5.8.1 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123563"
      },
      "action_statement": "Vulnerability CVE-2026-123563 affects version 5.8.1 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123564 affects version 5.8.1 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123564"
      },
      "action_statement": "Vulnerability CVE-2026-123564 affects version 5.8.1 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123565 affects version 5.8.1 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123565"
      },
      "action_statement": "Vulnerability CVE-2026-123565 affects version 5.8.1 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123566 affects version 5.8.1 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123566"
      },
      "action_statement": "Vulnerability CVE-2026-123566 affects version 5.8.1 of devalue."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-11-08T02:10:06.652911+00:00",
      "status_notes": "Vulnerability CVE-2026-123567 does not affect version 5.8.1 of devalue. not_affected \u2014 Target is devalue 5.8.1-tuxcare.2, which is newer than the 5.6.4 fix. The upstream fix (commit 87c1f3c) is already in the shipped upstream release. Every parse/unflatten path that builds an object from payload keys rejects `__proto__`, and the 'Object' wrapper path only accepts primitives. No path produces an own `__proto__` property.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123567"
      },
      "impact_statement": "not_affected \u2014 Target is devalue 5.8.1-tuxcare.2, which is newer than the 5.6.4 fix. The upstream fix (commit 87c1f3c) is already in the shipped upstream release. Every parse/unflatten path that builds an object from payload keys rejects `__proto__`, and the 'Object' wrapper path only accepts primitives. No path produces an own `__proto__` property."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-11-08T02:13:00.027595+00:00",
      "status_notes": "Vulnerability CVE-2026-123568 does not affect version 5.8.1 of devalue. not_affected \u2014 devalue 5.8.1-tuxcare.2 is past the 5.6.3 fix for CVE-2026-123568. The upstream fix for __proto__ handling (0f04d4d) is an ancestor of HEAD and was already in the upstream release TuxCare onboarded. uneval's walk step throws on any own '__proto__' key, so the prototype-pollution input never reaches code generation.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123568"
      },
      "impact_statement": "not_affected \u2014 devalue 5.8.1-tuxcare.2 is past the 5.6.3 fix for CVE-2026-123568. The upstream fix for __proto__ handling (0f04d4d) is an ancestor of HEAD and was already in the upstream release TuxCare onboarded. uneval's walk step throws on any own '__proto__' key, so the prototype-pollution input never reaches code generation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-11-08T02:18:54.319671+00:00",
      "status_notes": "Vulnerability CVE-2026-123569 does not affect version 5.8.1 of devalue. not_affected \u2014 devalue 5.8.1-tuxcare.2 is not affected. The CVE fix (upstream devalue 5.6.3, commit 819f1ac, \"better encoding for sparse arrays\") is already in the upstream release TuxCare onboarded. stringify and uneval both use a sparse-aware encoding that avoids per-hole iteration. TuxCare backport 78a1669 (GHSA-wf3x-273g-mvxv) additionally hardens uneval.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123569"
      },
      "impact_statement": "not_affected \u2014 devalue 5.8.1-tuxcare.2 is not affected. The CVE fix (upstream devalue 5.6.3, commit 819f1ac, \"better encoding for sparse arrays\") is already in the upstream release TuxCare onboarded. stringify and uneval both use a sparse-aware encoding that avoids per-hole iteration. TuxCare backport 78a1669 (GHSA-wf3x-273g-mvxv) additionally hardens uneval."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-10-19T21:56:00.206765+00:00",
      "status_notes": "Vulnerability CVE-2026-81176 affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-81176"
      },
      "action_statement": "Vulnerability CVE-2026-81176 affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-10-19T21:56:00.206765+00:00",
      "status_notes": "Vulnerability CVE-2026-92708 affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-92708"
      },
      "action_statement": "Vulnerability CVE-2026-92708 affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-10-19T21:56:00.206765+00:00",
      "status_notes": "Vulnerability GHSA-4q55-j62x-fr9h affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-4q55-j62x-fr9h"
      },
      "action_statement": "Vulnerability GHSA-4q55-j62x-fr9h affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-10-27T10:51:21.247352+00:00",
      "status_notes": "Vulnerability GHSA-hx4r-w6wj-j8fg affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-hx4r-w6wj-j8fg"
      },
      "action_statement": "Vulnerability GHSA-hx4r-w6wj-j8fg affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-10-27T10:51:21.247352+00:00",
      "status_notes": "Vulnerability GHSA-mcm9-63f2-9j32 affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-mcm9-63f2-9j32"
      },
      "action_statement": "Vulnerability GHSA-mcm9-63f2-9j32 affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-10-19T21:56:00.206765+00:00",
      "status_notes": "Vulnerability GHSA-r9w8-h9r3-54w4 affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-r9w8-h9r3-54w4"
      },
      "action_statement": "Vulnerability GHSA-r9w8-h9r3-54w4 affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-10-19T21:56:00.206765+00:00",
      "status_notes": "Vulnerability GHSA-wf3x-273g-mvxv affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-wf3x-273g-mvxv"
      },
      "action_statement": "Vulnerability GHSA-wf3x-273g-mvxv affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.8.1",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.8.1"
          }
        }
      ],
      "timestamp": "2026-10-19T21:56:00.206765+00:00",
      "status_notes": "Vulnerability GHSA-x5rw-q4pp-hg5g affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-x5rw-q4pp-hg5g"
      },
      "action_statement": "Vulnerability GHSA-x5rw-q4pp-hg5g affects version 5.8.1 of devalue, and is fixed in 5.8.1-tuxcare.1."
    }
  ]
}