{
  "@id": "urn:uuid:50615148-3ea5-4071-ae03-c2ef831070bf",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T02:21:00.451771+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.4"
          }
        }
      ],
      "timestamp": "2026-11-08T01:56:00.033225+00:00",
      "status_notes": "Vulnerability CVE-2026-123561 does not affect version 5.9.4 of devalue. not_affected \u2014 devalue 5.9.4 already contains the upstream fix for CVE-2026-123561. The null-prototype branch of parse's hydrate now rejects non-string keys before the `__proto__` comparison, so a coerced key can no longer reach the property set. The fix is upstream commit 9ec5130 (shipped in 5.9.3), which is in HEAD.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123561"
      },
      "impact_statement": "not_affected \u2014 devalue 5.9.4 already contains the upstream fix for CVE-2026-123561. The null-prototype branch of parse's hydrate now rejects non-string keys before the `__proto__` comparison, so a coerced key can no longer reach the property set. The fix is upstream commit 9ec5130 (shipped in 5.9.3), which is in HEAD."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.4"
          }
        }
      ],
      "timestamp": "2026-11-08T02:00:00.041743+00:00",
      "status_notes": "Vulnerability CVE-2026-123562 does not affect version 5.9.4 of devalue. not_affected \u2014 devalue 5.9.4 already contains the upstream fix for CVE-2026-123562. The fix is upstream commit dae8153 (shipped in 5.9.3). In src/stringify.js, flatten() attaches a no-op catch handler to each internal promise when it is created, so a later promise rejecting early cannot cause an unhandled rejection.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123562"
      },
      "impact_statement": "not_affected \u2014 devalue 5.9.4 already contains the upstream fix for CVE-2026-123562. The fix is upstream commit dae8153 (shipped in 5.9.3). In src/stringify.js, flatten() attaches a no-op catch handler to each internal promise when it is created, so a later promise rejecting early cannot cause an unhandled rejection."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.4"
          }
        }
      ],
      "timestamp": "2026-11-08T02:05:11.393909+00:00",
      "status_notes": "Vulnerability CVE-2026-123563 does not affect version 5.9.4 of devalue. not_affected \u2014 devalue 5.9.4 already contains the upstream fix for CVE-2026-123563. It shipped in 5.9.3 as commit 8f8d78e (\"validate revived backing buffers before constructing typed arrays\"). The default fromViewInfo in src/operations.js checks that a revived backing buffer is a real ArrayBuffer or SharedArrayBuffer before calling the typed-array constructor. A custom ArrayBuffer reviver can therefore no lon...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123563"
      },
      "impact_statement": "not_affected \u2014 devalue 5.9.4 already contains the upstream fix for CVE-2026-123563. It shipped in 5.9.3 as commit 8f8d78e (\"validate revived backing buffers before constructing typed arrays\"). The default fromViewInfo in src/operations.js checks that a revived backing buffer is a real ArrayBuffer or SharedArrayBuffer before calling the typed-array constructor. A custom ArrayBuffer reviver can therefore no lon..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.4"
          }
        }
      ],
      "timestamp": "2026-11-08T02:05:32.300200+00:00",
      "status_notes": "Vulnerability CVE-2026-123564 does not affect version 5.9.4 of devalue. not_affected \u2014 devalue 5.9.4 already includes the upstream fix for CVE-2026-123564 (released in 5.9.3, upstream commit 6861dbb). uneval no longer emits `Array(n)` or `[,,,]` for large sparse arrays. For very sparse arrays it emits an allocator that forces dictionary-mode elements, and the traversal skips holes.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123564"
      },
      "impact_statement": "not_affected \u2014 devalue 5.9.4 already includes the upstream fix for CVE-2026-123564 (released in 5.9.3, upstream commit 6861dbb). uneval no longer emits `Array(n)` or `[,,,]` for large sparse arrays. For very sparse arrays it emits an allocator that forces dictionary-mode elements, and the traversal skips holes."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.4"
          }
        }
      ],
      "timestamp": "2026-11-08T02:09:04.823798+00:00",
      "status_notes": "Vulnerability CVE-2026-123565 does not affect version 5.9.4 of devalue. not_affected \u2014 devalue 5.9.4 already contains the upstream fix for CVE-2026-123565 (shipped in 5.9.3, commit 84f6f67 \"prevent quadratic uneval expansion of repeated primitives\"). uneval now counts and hoists repeated long strings and bigints into shared parameters instead of inlining them at every reference. The fix is upstream-authored and was in the release before any TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123565"
      },
      "impact_statement": "not_affected \u2014 devalue 5.9.4 already contains the upstream fix for CVE-2026-123565 (shipped in 5.9.3, commit 84f6f67 \"prevent quadratic uneval expansion of repeated primitives\"). uneval now counts and hoists repeated long strings and bigints into shared parameters instead of inlining them at every reference. The fix is upstream-authored and was in the release before any TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.4"
          }
        }
      ],
      "timestamp": "2026-11-08T02:11:20.224686+00:00",
      "status_notes": "Vulnerability CVE-2026-123566 does not affect version 5.9.4 of devalue. not_affected \u2014 devalue 5.9.4 is past the 5.9.3 fix for CVE-2026-123566. uneval in src/uneval.js already enumerates only populated array indices and never walks every hole of a sparse array. The fix shipped in the upstream release, so this is an upstream fix and not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123566"
      },
      "impact_statement": "not_affected \u2014 devalue 5.9.4 is past the 5.9.3 fix for CVE-2026-123566. uneval in src/uneval.js already enumerates only populated array indices and never walks every hole of a sparse array. The fix shipped in the upstream release, so this is an upstream fix and not a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.4"
          }
        }
      ],
      "timestamp": "2026-11-08T02:15:03.346579+00:00",
      "status_notes": "Vulnerability CVE-2026-123567 does not affect version 5.9.4 of devalue. not_affected \u2014 devalue 5.9.4 is well past the 5.6.4 fix. parse/unflatten throw on any `__proto__` key, both for plain objects and for the \"null\" null-prototype wrapper path. This guard shipped in the upstream release, so the vulnerable pattern is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123567"
      },
      "impact_statement": "not_affected \u2014 devalue 5.9.4 is well past the 5.6.4 fix. parse/unflatten throw on any `__proto__` key, both for plain objects and for the \"null\" null-prototype wrapper path. This guard shipped in the upstream release, so the vulnerable pattern is not present."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.4"
          }
        }
      ],
      "timestamp": "2026-11-08T02:18:54.319671+00:00",
      "status_notes": "Vulnerability CVE-2026-123568 does not affect version 5.9.4 of devalue. not_affected \u2014 devalue 5.9.4 is well past the 5.6.3 fix for CVE-2026-123568. uneval rejects '__proto__' keys on plain objects, and null-prototype objects are emitted with an explicit __proto__:null, so the output shape matches the input. The fix shipped in the upstream release (upstream commit 0f04d4d, \"Properly handle __proto__\"), not as a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123568"
      },
      "impact_statement": "not_affected \u2014 devalue 5.9.4 is well past the 5.6.3 fix for CVE-2026-123568. uneval rejects '__proto__' keys on plain objects, and null-prototype objects are emitted with an explicit __proto__:null, so the output shape matches the input. The fix shipped in the upstream release (upstream commit 0f04d4d, \"Properly handle __proto__\"), not as a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.9.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.9.4"
          }
        }
      ],
      "timestamp": "2026-11-08T02:21:00.451771+00:00",
      "status_notes": "Vulnerability CVE-2026-123569 does not affect version 5.9.4 of devalue. not_affected \u2014 devalue 5.9.4 is past the CVE's fixed version (5.6.3). Both stringify and uneval choose a sparse encoding for very sparse arrays and do not iterate or allocate per hole. The fix shipped in the upstream release, so this is not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123569"
      },
      "impact_statement": "not_affected \u2014 devalue 5.9.4 is past the CVE's fixed version (5.6.3). Both stringify and uneval choose a sparse encoding for very sparse arrays and do not iterate or allocate per hole. The fix shipped in the upstream release, so this is not a TuxCare backport."
    }
  ]
}