{
  "@id": "urn:uuid:533a0360-910d-4e66-a1ef-8cfabdd56875",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T10:56:00.067004+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@6.12.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@6.12.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2019-17426 does not affect version 6.12.2-tuxcare.2 of mongoose. not_affected \u2014 CVE-2019-17426 affected Mongoose through version 5.7.4 due to a vulnerability in the bson 1.x parser that caused query objects with a `_bsontype` attribute to be ignored, allowing access control bypass. The target version 6.12.2-tuxcare.5 is not affected because it uses bson 4.7.2, which does not exhibit the vulnerable behavior. The original Mongoose-level workaround (deleting `_bsontype` from ...",
      "vulnerability": {
        "name": "CVE-2019-17426"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17426 affected Mongoose through version 5.7.4 due to a vulnerability in the bson 1.x parser that caused query objects with a `_bsontype` attribute to be ignored, allowing access control bypass. The target version 6.12.2-tuxcare.5 is not affected because it uses bson 4.7.2, which does not exhibit the vulnerable behavior. The original Mongoose-level workaround (deleting `_bsontype` from ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@6.12.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@6.12.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2022-24304 does not affect version 6.12.2-tuxcare.2 of mongoose. not_affected \u2014 CVE-2022-24304 is not present in Mongoose 6.12.2-tuxcare.5. The vulnerability involves prototype pollution in Schema.path() when setting schema properties with paths containing '__proto__', 'constructor', or 'prototype'. The upstream Mongoose project fixed this on 2022-07-18 (commit 6a197316) by adding validation checks that reject special properties in both the final path segment and all inter...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24304"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24304 is not present in Mongoose 6.12.2-tuxcare.5. The vulnerability involves prototype pollution in Schema.path() when setting schema properties with paths containing '__proto__', 'constructor', or 'prototype'. The upstream Mongoose project fixed this on 2022-07-18 (commit 6a197316) by adding validation checks that reject special properties in both the final path segment and all inter..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@6.12.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@6.12.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2022-2564 does not affect version 6.12.2-tuxcare.2 of mongoose. not_affected \u2014 CVE-2022-2564 (prototype pollution in Schema.path()) is not present in this target. The vulnerability was fixed in upstream commit 6a1973165 by Valeri Karpov, which was already included in the upstream release before TuxCare onboarded the project. The fix validates property names against a specialProperties Set containing ['__proto__', 'constructor', 'prototype'] in both Schema.path() and Schem...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2564"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2564 (prototype pollution in Schema.path()) is not present in this target. The vulnerability was fixed in upstream commit 6a1973165 by Valeri Karpov, which was already included in the upstream release before TuxCare onboarded the project. The fix validates property names against a specialProperties Set containing ['__proto__', 'constructor', 'prototype'] in both Schema.path() and Schem..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@6.12.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@6.12.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2023-3696 does not affect version 6.12.2-tuxcare.2 of mongoose. not_affected \u2014 CVE-2023-3696 is a prototype pollution vulnerability in Mongoose prior to versions 7.3.3, 6.11.3, and 5.13.20. The target repository (mongoose 6.12.2-tuxcare.5) is NOT vulnerable because the fix was already included in the upstream release 6.11.3. The fix (commit 305ce4ff7, authored by upstream maintainer Valeri Karpov) prevents `__proto__` and `constructor` properties from being processed duri...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-3696"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-3696 is a prototype pollution vulnerability in Mongoose prior to versions 7.3.3, 6.11.3, and 5.13.20. The target repository (mongoose 6.12.2-tuxcare.5) is NOT vulnerable because the fix was already included in the upstream release 6.11.3. The fix (commit 305ce4ff7, authored by upstream maintainer Valeri Karpov) prevents `__proto__` and `constructor` properties from being processed duri..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/mongoose@6.12.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@6.12.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-53900 is fixed in version 6.12.2-tuxcare.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2024-53900"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/mongoose@6.12.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@6.12.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-23061 is fixed in version 6.12.2-tuxcare.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2025-23061"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@6.12.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@6.12.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:02.047764+00:00",
      "status_notes": "Vulnerability CVE-2026-125116 affects version 6.12.2-tuxcare.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125116"
      },
      "action_statement": "Vulnerability CVE-2026-125116 affects version 6.12.2-tuxcare.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@6.12.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@6.12.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T21:04:58.956727+00:00",
      "status_notes": "Vulnerability CVE-2026-125117 affects version 6.12.2-tuxcare.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125117"
      },
      "action_statement": "Vulnerability CVE-2026-125117 affects version 6.12.2-tuxcare.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@6.12.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@6.12.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T20:58:50.437512+00:00",
      "status_notes": "Vulnerability CVE-2026-125118 affects version 6.12.2-tuxcare.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125118"
      },
      "action_statement": "Vulnerability CVE-2026-125118 affects version 6.12.2-tuxcare.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@6.12.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@6.12.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T10:56:00.067004+00:00",
      "status_notes": "Vulnerability CVE-2026-125119 affects version 6.12.2-tuxcare.2 of mongoose, and is fixed in 6.12.2-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-125119"
      },
      "action_statement": "Vulnerability CVE-2026-125119 affects version 6.12.2-tuxcare.2 of mongoose, and is fixed in 6.12.2-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@6.12.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@6.12.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T10:56:00.067004+00:00",
      "status_notes": "Vulnerability CVE-2026-125120 affects version 6.12.2-tuxcare.2 of mongoose, and is fixed in 6.12.2-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-125120"
      },
      "action_statement": "Vulnerability CVE-2026-125120 affects version 6.12.2-tuxcare.2 of mongoose, and is fixed in 6.12.2-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@6.12.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@6.12.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42334 affects version 6.12.2-tuxcare.2 of mongoose, and is fixed in 6.12.2-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-42334"
      },
      "action_statement": "Vulnerability CVE-2026-42334 affects version 6.12.2-tuxcare.2 of mongoose, and is fixed in 6.12.2-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@6.12.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@6.12.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-73562 affects version 6.12.2-tuxcare.2 of mongoose, and is fixed in 6.12.2-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-73562"
      },
      "action_statement": "Vulnerability CVE-2026-73562 affects version 6.12.2-tuxcare.2 of mongoose, and is fixed in 6.12.2-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@6.12.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@6.12.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-664h-wqgq-64gw affects version 6.12.2-tuxcare.2 of mongoose, and is fixed in 6.12.2-tuxcare.4.",
      "vulnerability": {
        "name": "GHSA-664h-wqgq-64gw"
      },
      "action_statement": "Vulnerability GHSA-664h-wqgq-64gw affects version 6.12.2-tuxcare.2 of mongoose, and is fixed in 6.12.2-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@6.12.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@6.12.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability GHSA-r5xw-q988-826m does not affect version 6.12.2-tuxcare.2 of mongoose. not_affected \u2014 Target version 6.12.2-tuxcare.5 is not affected by GHSA-r5xw-q988-826m (remote memory exposure when saving numbers to Buffer fields). The vulnerable code pattern that used the deprecated `new Buffer(number)` constructor has been replaced by the safe `Buffer.alloc(number)` API, which properly initializes allocated memory with zeros. This fix was introduced in upstream commit 4a1c77b87 (August 20...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r5xw-q988-826m"
      },
      "impact_statement": "not_affected \u2014 Target version 6.12.2-tuxcare.5 is not affected by GHSA-r5xw-q988-826m (remote memory exposure when saving numbers to Buffer fields). The vulnerable code pattern that used the deprecated `new Buffer(number)` constructor has been replaced by the safe `Buffer.alloc(number)` API, which properly initializes allocated memory with zeros. This fix was introduced in upstream commit 4a1c77b87 (August 20..."
    }
  ]
}