{
  "@id": "urn:uuid:1fb76355-11cf-4e1b-be12-3d1b6e809dab",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T21:05:02.047764+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.0"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2019-17426 does not affect version 9.6.0 of mongoose. not_affected \u2014 CVE-2019-17426 affected Mongoose \u22645.7.4 when using BSON 1.x, where query objects with `_bsontype` properties caused filters to be ignored, enabling access control bypass. Mongoose 5.7.5 added a workaround (commit f3eca5b94, Oct 2019) to explicitly delete `_bsontype` from queries. This workaround was intentionally removed in Jan 2022 (commit 94570a640) after upgrading to BSON 4.x, which fixed th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17426"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17426 affected Mongoose \u22645.7.4 when using BSON 1.x, where query objects with `_bsontype` properties caused filters to be ignored, enabling access control bypass. Mongoose 5.7.5 added a workaround (commit f3eca5b94, Oct 2019) to explicitly delete `_bsontype` from queries. This workaround was intentionally removed in Jan 2022 (commit 94570a640) after upgrading to BSON 4.x, which fixed th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.0"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-24304 does not affect version 9.6.0 of mongoose. not_affected \u2014 CVE-2022-24304 describes a prototype pollution vulnerability in Mongoose's Schema.path() function when processing dotted paths containing '__proto__', 'constructor', or 'prototype'. The target repository (mongoose v9.6.0) contains the upstream fix committed on Jul 18, 2022 (commit 6a19731), which was already present in the upstream release when TuxCare onboarded this version. The fix adds valid...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24304"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24304 describes a prototype pollution vulnerability in Mongoose's Schema.path() function when processing dotted paths containing '__proto__', 'constructor', or 'prototype'. The target repository (mongoose v9.6.0) contains the upstream fix committed on Jul 18, 2022 (commit 6a19731), which was already present in the upstream release when TuxCare onboarded this version. The fix adds valid..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.0"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2564 does not affect version 9.6.0 of mongoose. not_affected \u2014 CVE-2022-2564 (Prototype Pollution in Schema.path()) is not present in Mongoose 9.6.0. The vulnerability was fixed by upstream maintainer Valeri Karpov in commit 99b418941 on August 21, 2022, which added checks to prevent setting special properties (__proto__, constructor, prototype) in both Schema.prototype.path() and Schema.prototype.add(). This fix was already included in the upstream releas...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2564"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2564 (Prototype Pollution in Schema.path()) is not present in Mongoose 9.6.0. The vulnerability was fixed by upstream maintainer Valeri Karpov in commit 99b418941 on August 21, 2022, which added checks to prevent setting special properties (__proto__, constructor, prototype) in both Schema.prototype.path() and Schema.prototype.add(). This fix was already included in the upstream releas..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.0"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2023-3696 does not affect version 9.6.0 of mongoose. not_affected \u2014 CVE-2023-3696 (Prototype Pollution in mongoose) does not affect version 9.6.0. The vulnerability was fixed in upstream versions 7.3.3, 6.11.3, and 5.13.20 (July 2023) by implementing comprehensive `specialProperties` checks that reject dangerous property names (`__proto__`, `constructor`, `prototype`) across all object manipulation code paths. The target version 9.6.0 inherits these upstream fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-3696"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-3696 (Prototype Pollution in mongoose) does not affect version 9.6.0. The vulnerability was fixed in upstream versions 7.3.3, 6.11.3, and 5.13.20 (July 2023) by implementing comprehensive `specialProperties` checks that reject dangerous property names (`__proto__`, `constructor`, `prototype`) across all object manipulation code paths. The target version 9.6.0 inherits these upstream fi..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.0"
          }
        }
      ],
      "timestamp": "2026-11-02T20:06:00.090260+00:00",
      "status_notes": "Vulnerability CVE-2024-53900 affects version 9.6.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2024-53900"
      },
      "action_statement": "Vulnerability CVE-2024-53900 affects version 9.6.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.0"
          }
        }
      ],
      "timestamp": "2026-11-02T20:07:00.091345+00:00",
      "status_notes": "Vulnerability CVE-2025-23061 affects version 9.6.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2025-23061"
      },
      "action_statement": "Vulnerability CVE-2025-23061 affects version 9.6.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.0"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:02.047764+00:00",
      "status_notes": "Vulnerability CVE-2026-125116 affects version 9.6.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125116"
      },
      "action_statement": "Vulnerability CVE-2026-125116 affects version 9.6.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.0"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:02.047764+00:00",
      "status_notes": "Vulnerability CVE-2026-125117 affects version 9.6.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125117"
      },
      "action_statement": "Vulnerability CVE-2026-125117 affects version 9.6.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.0"
          }
        }
      ],
      "timestamp": "2026-11-10T20:58:50.437512+00:00",
      "status_notes": "Vulnerability CVE-2026-125118 affects version 9.6.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125118"
      },
      "action_statement": "Vulnerability CVE-2026-125118 affects version 9.6.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.0"
          }
        }
      ],
      "timestamp": "2026-11-10T20:03:31.902906+00:00",
      "status_notes": "Vulnerability CVE-2026-125119 affects version 9.6.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125119"
      },
      "action_statement": "Vulnerability CVE-2026-125119 affects version 9.6.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.0"
          }
        }
      ],
      "timestamp": "2026-11-10T19:43:34.920122+00:00",
      "status_notes": "Vulnerability CVE-2026-125120 affects version 9.6.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125120"
      },
      "action_statement": "Vulnerability CVE-2026-125120 affects version 9.6.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.0"
          }
        }
      ],
      "timestamp": "2026-11-02T20:07:00.091345+00:00",
      "status_notes": "Vulnerability CVE-2026-42334 affects version 9.6.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-42334"
      },
      "action_statement": "Vulnerability CVE-2026-42334 affects version 9.6.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.0"
          }
        }
      ],
      "timestamp": "2026-10-18T14:59:00.108410+00:00",
      "status_notes": "Vulnerability CVE-2026-73562 affects version 9.6.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-73562"
      },
      "action_statement": "Vulnerability CVE-2026-73562 affects version 9.6.0 of mongoose."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.0"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability GHSA-r5xw-q988-826m does not affect version 9.6.0 of mongoose. not_affected \u2014 Target mongoose 9.6.0 is NOT AFFECTED by GHSA-r5xw-q988-826m. The vulnerability (remote memory exposure when saving numbers to Buffer fields via deprecated `new Buffer(number)`) was fixed by upstream maintainer Valeri Karpov in commit 8066b145c (Jan 2016), released in version 4.3.6. The fix converts numbers to byte arrays before Buffer construction, preventing uninitialized memory allocation. V...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r5xw-q988-826m"
      },
      "impact_statement": "not_affected \u2014 Target mongoose 9.6.0 is NOT AFFECTED by GHSA-r5xw-q988-826m. The vulnerability (remote memory exposure when saving numbers to Buffer fields via deprecated `new Buffer(number)`) was fixed by upstream maintainer Valeri Karpov in commit 8066b145c (Jan 2016), released in version 4.3.6. The fix converts numbers to byte arrays before Buffer construction, preventing uninitialized memory allocation. V..."
    }
  ]
}