{
  "@id": "urn:uuid:850ec3cb-22b0-483c-9f63-28543d18e571",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T00:50:33.230498+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongodb@7.1.0",
          "identifiers": {
            "purl": "pkg:npm/mongodb@7.1.0"
          }
        }
      ],
      "timestamp": "2026-11-04T00:50:33.230498+00:00",
      "status_notes": "Vulnerability CVE-2021-32050 does not affect version 7.1.0 of mongodb. not_affected \u2014 CVE-2021-32050 affects MongoDB drivers that inadvertently publish authentication-related data to command listener events. The MongoDB Node.js driver v7.1.0 target contains comprehensive redaction logic that prevents this exposure. The fix (commit 536e5ffbc, June 2021) was authored by MongoDB upstream and shipped in the release before TuxCare began maintaining this repository. All authentication...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-32050"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-32050 affects MongoDB drivers that inadvertently publish authentication-related data to command listener events. The MongoDB Node.js driver v7.1.0 target contains comprehensive redaction logic that prevents this exposure. The fix (commit 536e5ffbc, June 2021) was authored by MongoDB upstream and shipped in the release before TuxCare began maintaining this repository. All authentication..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongodb@7.1.0",
          "identifiers": {
            "purl": "pkg:npm/mongodb@7.1.0"
          }
        }
      ],
      "timestamp": "2026-11-04T00:46:40.416965+00:00",
      "status_notes": "Vulnerability GHSA-mh5c-679w-hh4r does not affect version 7.1.0 of mongodb. not_affected \u2014 Version 7.1.0 is not affected by GHSA-mh5c-679w-hh4r. The vulnerability affected versions prior to 3.1.13, where calling createCollection with an invalid collection name on a non-existent database would throw an uncaught exception, crashing the application. The fix was applied in upstream version 3.1.13 (commit 210c71dcc) by MongoDB maintainer Matt Broadstone, adding proper error handling aroun...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-mh5c-679w-hh4r"
      },
      "impact_statement": "not_affected \u2014 Version 7.1.0 is not affected by GHSA-mh5c-679w-hh4r. The vulnerability affected versions prior to 3.1.13, where calling createCollection with an invalid collection name on a non-existent database would throw an uncaught exception, crashing the application. The fix was applied in upstream version 3.1.13 (commit 210c71dcc) by MongoDB maintainer Matt Broadstone, adding proper error handling aroun..."
    }
  ]
}