{
  "@id": "urn:uuid:3fc78953-4d95-4396-a680-2ac2469bf2e5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T18:51:00.114728+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/file-type@16.5.4",
          "identifiers": {
            "purl": "pkg:npm/file-type@16.5.4"
          }
        }
      ],
      "timestamp": "2026-11-03T18:51:00.114728+00:00",
      "status_notes": "Vulnerability CVE-2022-36313 does not affect version 16.5.4 of file-type. not_affected \u2014 The target repository (file-type v16.5.4-tuxcare.1) is NOT affected by CVE-2022-36313. The fix for the infinite loop vulnerability in MKV file parsing was already present in the upstream v16.5.4 release that TuxCare onboarded. The vulnerable code pattern (unbounded while loop) is not present because the fix (adding `&& mask !== 0` termination condition) was shipped in upstream version 16.5.4 by...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-36313"
      },
      "impact_statement": "not_affected \u2014 The target repository (file-type v16.5.4-tuxcare.1) is NOT affected by CVE-2022-36313. The fix for the infinite loop vulnerability in MKV file parsing was already present in the upstream v16.5.4 release that TuxCare onboarded. The vulnerable code pattern (unbounded while loop) is not present because the fix (adding `&& mask !== 0` termination condition) was shipped in upstream version 16.5.4 by..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/file-type@16.5.4",
          "identifiers": {
            "purl": "pkg:npm/file-type@16.5.4"
          }
        }
      ],
      "timestamp": "2026-10-05T11:33:00.216701+00:00",
      "status_notes": "Vulnerability CVE-2026-31808 affects version 16.5.4 of file-type, and is fixed in 16.5.4-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-31808"
      },
      "action_statement": "Vulnerability CVE-2026-31808 affects version 16.5.4 of file-type, and is fixed in 16.5.4-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/file-type@16.5.4",
          "identifiers": {
            "purl": "pkg:npm/file-type@16.5.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32630 does not affect version 16.5.4 of file-type. not_affected \u2014 Target version 16.5.4 is not affected by CVE-2026-32630. The vulnerability requires ZIP decompression functionality, which was introduced in version 20.0.0 via the @tokenizer/inflate dependency. Version 16.5.4 uses a fundamentally different architecture that only processes uncompressed (stored) ZIP entries and skips compressed entries without decompressing them. The attack chain from compressed...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-32630"
      },
      "impact_statement": "not_affected \u2014 Target version 16.5.4 is not affected by CVE-2026-32630. The vulnerability requires ZIP decompression functionality, which was introduced in version 20.0.0 via the @tokenizer/inflate dependency. Version 16.5.4 uses a fundamentally different architecture that only processes uncompressed (stored) ZIP entries and skips compressed entries without decompressing them. The attack chain from compressed..."
    }
  ]
}