{
  "@id": "urn:uuid:5ddb7b34-28d9-466a-8dd6-c2b24a4a0ff2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T02:16:06.229864+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.3",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.3"
          }
        }
      ],
      "timestamp": "2026-11-08T01:51:07.178181+00:00",
      "status_notes": "Vulnerability CVE-2026-123561 does not affect version 5.9.3 of devalue. not_affected \u2014 devalue 5.9.3 already contains the upstream fix for CVE-2026-123561. In src/parse.js, the null-prototype object branch rejects any non-string key before comparing against '__proto__'. This stops coerced keys from bypassing the check. The fix is upstream commit 9ec5130 (author hello+git@ell.iott.dev), shipped in the 5.9.3 release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123561"
      },
      "impact_statement": "not_affected \u2014 devalue 5.9.3 already contains the upstream fix for CVE-2026-123561. In src/parse.js, the null-prototype object branch rejects any non-string key before comparing against '__proto__'. This stops coerced keys from bypassing the check. The fix is upstream commit 9ec5130 (author hello+git@ell.iott.dev), shipped in the 5.9.3 release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.3",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.3"
          }
        }
      ],
      "timestamp": "2026-11-08T01:57:00.048642+00:00",
      "status_notes": "Vulnerability CVE-2026-123562 does not affect version 5.9.3 of devalue. not_affected \u2014 Target is devalue 5.9.3, the release that fixes CVE-2026-123562. src/stringify.js attaches a no-op catch handler (`str.catch(() => {})`) to every derived promise as soon as it is created. A later rejection therefore cannot go unhandled while an earlier promise is still pending. The fix is upstream commit dae8153 (author hello+git@ell.iott.dev), shipped in 5.9.3 and not authored by TuxCare.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123562"
      },
      "impact_statement": "not_affected \u2014 Target is devalue 5.9.3, the release that fixes CVE-2026-123562. src/stringify.js attaches a no-op catch handler (`str.catch(() => {})`) to every derived promise as soon as it is created. A later rejection therefore cannot go unhandled while an earlier promise is still pending. The fix is upstream commit dae8153 (author hello+git@ell.iott.dev), shipped in 5.9.3 and not authored by TuxCare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.3",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.3"
          }
        }
      ],
      "timestamp": "2026-11-08T02:05:11.393909+00:00",
      "status_notes": "Vulnerability CVE-2026-123563 does not affect version 5.9.3 of devalue. not_affected \u2014 devalue 5.9.3 already contains the upstream fix. It was shipped in the upstream release (commit 8f8d78e, \"validate revived backing buffers before constructing typed arrays\"). Before building a typed array or DataView, fromViewInfo now checks that the revived backing buffer is a real ArrayBuffer or SharedArrayBuffer. A custom ArrayBuffer reviver can no longer substitute a number or array-like to...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123563"
      },
      "impact_statement": "not_affected \u2014 devalue 5.9.3 already contains the upstream fix. It was shipped in the upstream release (commit 8f8d78e, \"validate revived backing buffers before constructing typed arrays\"). Before building a typed array or DataView, fromViewInfo now checks that the revived backing buffer is a real ArrayBuffer or SharedArrayBuffer. A custom ArrayBuffer reviver can no longer substitute a number or array-like to..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.3",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.3"
          }
        }
      ],
      "timestamp": "2026-11-08T02:00:00.041743+00:00",
      "status_notes": "Vulnerability CVE-2026-123564 does not affect version 5.9.3 of devalue. not_affected \u2014 The target is devalue 5.9.3, the first fixed release. The upstream fix is already in it (commit 6861dbb, authored by hello+git@ell.iott.dev and merged through GitHub). uneval no longer emits memory-proportional code for very sparse arrays. HEAD has no TuxCare-domain commit that carries the fix, so the fix is upstream-attributed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123564"
      },
      "impact_statement": "not_affected \u2014 The target is devalue 5.9.3, the first fixed release. The upstream fix is already in it (commit 6861dbb, authored by hello+git@ell.iott.dev and merged through GitHub). uneval no longer emits memory-proportional code for very sparse arrays. HEAD has no TuxCare-domain commit that carries the fix, so the fix is upstream-attributed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.3",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.3"
          }
        }
      ],
      "timestamp": "2026-11-08T02:05:11.393909+00:00",
      "status_notes": "Vulnerability CVE-2026-123565 does not affect version 5.9.3 of devalue. not_affected \u2014 devalue 5.9.3 already contains the upstream fix for CVE-2026-123565. Commit 84f6f67 (\"fix: prevent quadratic `uneval` output expansion for repeated strings and bigints\") is an ancestor of HEAD. It was authored upstream and shipped in the 5.9.3 release, before the only TuxCare commit (tuxcare.yaml, which is HEAD). `uneval` now counts repeated long strings and bigints and hoists them into named p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123565"
      },
      "impact_statement": "not_affected \u2014 devalue 5.9.3 already contains the upstream fix for CVE-2026-123565. Commit 84f6f67 (\"fix: prevent quadratic `uneval` output expansion for repeated strings and bigints\") is an ancestor of HEAD. It was authored upstream and shipped in the 5.9.3 release, before the only TuxCare commit (tuxcare.yaml, which is HEAD). `uneval` now counts repeated long strings and bigints and hoists them into named p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.3",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.3"
          }
        }
      ],
      "timestamp": "2026-11-08T02:06:02.171657+00:00",
      "status_notes": "Vulnerability CVE-2026-123566 does not affect version 5.9.3 of devalue. not_affected \u2014 devalue 5.9.3 already contains the upstream fix for the sparse-array CPU amplification in uneval. The fix shipped in the upstream 5.9.3 release (commit 6861dbb, Elliott Johnson), so the vulnerable pattern is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123566"
      },
      "impact_statement": "not_affected \u2014 devalue 5.9.3 already contains the upstream fix for the sparse-array CPU amplification in uneval. The fix shipped in the upstream 5.9.3 release (commit 6861dbb, Elliott Johnson), so the vulnerable pattern is not present."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.3",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.3"
          }
        }
      ],
      "timestamp": "2026-11-08T02:09:50.319592+00:00",
      "status_notes": "Vulnerability CVE-2026-123567 does not affect version 5.9.3 of devalue. not_affected \u2014 Target is devalue 5.9.3, well past the 5.6.4 fix. parse/unflatten reject any `__proto__` key on plain objects, null-prototype objects and sparse arrays, so the returned objects can never carry an own `__proto__` property. The guard came from an upstream commit (0623a47, Rich Harris, in 5.3.2) that was in the release TuxCare onboarded. HEAD has no TuxCare-domain commits, so this is an upstream fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123567"
      },
      "impact_statement": "not_affected \u2014 Target is devalue 5.9.3, well past the 5.6.4 fix. parse/unflatten reject any `__proto__` key on plain objects, null-prototype objects and sparse arrays, so the returned objects can never carry an own `__proto__` property. The guard came from an upstream commit (0623a47, Rich Harris, in 5.3.2) that was in the release TuxCare onboarded. HEAD has no TuxCare-domain commits, so this is an upstream fix."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.3",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.3"
          }
        }
      ],
      "timestamp": "2026-11-08T02:13:41.065959+00:00",
      "status_notes": "Vulnerability CVE-2026-123568 does not affect version 5.9.3 of devalue. not_affected \u2014 Target is devalue 5.9.3, well past the 5.6.3 fix for CVE-2026-123568. uneval's traversal rejects any own '__proto__' key (plain or null-prototype objects) with a DevalueError before code is generated, so the output cannot set a prototype. The fix is upstream-authored and shipped in the release. No TuxCare-domain commit exists in HEAD's history.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123568"
      },
      "impact_statement": "not_affected \u2014 Target is devalue 5.9.3, well past the 5.6.3 fix for CVE-2026-123568. uneval's traversal rejects any own '__proto__' key (plain or null-prototype objects) with a DevalueError before code is generated, so the output cannot set a prototype. The fix is upstream-authored and shipped in the release. No TuxCare-domain commit exists in HEAD's history."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.3",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.3"
          }
        }
      ],
      "timestamp": "2026-11-08T02:16:06.229864+00:00",
      "status_notes": "Vulnerability CVE-2026-123569 does not affect version 5.9.3 of devalue. not_affected \u2014 devalue 5.9.3 is past the 5.6.3 fix for CVE-2026-123569. Both stringify and uneval choose a sparse encoding when an array is very sparse. They no longer iterate over every hole. The fix is an upstream commit (819f1ac, 'better encoding for sparse arrays', released in 5.6.3) that is already in HEAD, so the target is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123569"
      },
      "impact_statement": "not_affected \u2014 devalue 5.9.3 is past the 5.6.3 fix for CVE-2026-123569. Both stringify and uneval choose a sparse encoding when an array is very sparse. They no longer iterate over every hole. The fix is an upstream commit (819f1ac, 'better encoding for sparse arrays', released in 5.6.3) that is already in HEAD, so the target is not affected."
    }
  ]
}