{ "@id": "urn:uuid:a4fe2ac3-7527-4749-abf4-f8ed790236c7", "role": "Document Creator", "author": "https://tuxcare.com", "version": 14, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T21:05:04.452255+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.3", "identifiers": { "purl": "pkg:npm/mongoose@9.6.3" } } ], "timestamp": "2026-11-04T09:01:00.133094+00:00", "status_notes": "Vulnerability CVE-2019-17426 does not affect version 9.6.3 of mongoose. not_affected \u2014 CVE-2019-17426 affected Mongoose through version 5.7.4, where query objects with a `_bsontype` attribute would be ignored by older BSON parser versions (BSON 1.x), enabling attackers to bypass query filters. The target version (9.6.3-tuxcare.1) is not affected because: (1) The vulnerability was fixed in upstream Mongoose 5.7.5 (October 2019) by adding code to delete the `_bsontype` property fro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17426" }, "impact_statement": "not_affected \u2014 CVE-2019-17426 affected Mongoose through version 5.7.4, where query objects with a `_bsontype` attribute would be ignored by older BSON parser versions (BSON 1.x), enabling attackers to bypass query filters. The target version (9.6.3-tuxcare.1) is not affected because: (1) The vulnerability was fixed in upstream Mongoose 5.7.5 (October 2019) by adding code to delete the `_bsontype` property fro..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.3", "identifiers": { "purl": "pkg:npm/mongoose@9.6.3" } } ], "timestamp": "2026-11-04T09:05:53.304095+00:00", "status_notes": "Vulnerability CVE-2022-24304 does not affect version 9.6.3 of mongoose. not_affected \u2014 CVE-2022-24304 describes a prototype pollution vulnerability in Mongoose's Schema.path() method that allowed setting __proto__ and other special properties on schemas. The target repository (Mongoose 9.6.3-tuxcare.1) is NOT AFFECTED because an upstream fix (commit 6a1973165, July 2022) already removed the vulnerable pattern before TuxCare maintenance began. The fix validates path strings agains...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24304" }, "impact_statement": "not_affected \u2014 CVE-2022-24304 describes a prototype pollution vulnerability in Mongoose's Schema.path() method that allowed setting __proto__ and other special properties on schemas. The target repository (Mongoose 9.6.3-tuxcare.1) is NOT AFFECTED because an upstream fix (commit 6a1973165, July 2022) already removed the vulnerable pattern before TuxCare maintenance began. The fix validates path strings agains..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.3", "identifiers": { "purl": "pkg:npm/mongoose@9.6.3" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2022-2564 does not affect version 9.6.3 of mongoose. not_affected \u2014 The target repository (Mongoose 9.6.3-tuxcare.1) is NOT AFFECTED by CVE-2022-2564. The prototype pollution vulnerability in Schema.path() was fixed in upstream Mongoose commit 6a197316564742c0422309e1b5fecfa4faec126e (dated 2022-08-19) by upstream maintainer Valeri Karpov (val@karpov.io). This fix was already included in the upstream release that TuxCare forked from, predating TuxCare's first c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-2564" }, "impact_statement": "not_affected \u2014 The target repository (Mongoose 9.6.3-tuxcare.1) is NOT AFFECTED by CVE-2022-2564. The prototype pollution vulnerability in Schema.path() was fixed in upstream Mongoose commit 6a197316564742c0422309e1b5fecfa4faec126e (dated 2022-08-19) by upstream maintainer Valeri Karpov (val@karpov.io). This fix was already included in the upstream release that TuxCare forked from, predating TuxCare's first c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.3", "identifiers": { "purl": "pkg:npm/mongoose@9.6.3" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2023-3696 does not affect version 9.6.3 of mongoose. not_affected \u2014 CVE-2023-3696 (Prototype Pollution in mongoose) does not affect mongoose 9.6.3-tuxcare.1. The vulnerability was fixed by upstream maintainer Valeri Karpov in commit e29578d2e (July 2023) and released in versions 7.3.3, 6.11.3, and 5.13.20. Version 9.6.3, released upstream in September 2024, already contains this fix. The vulnerable code pattern (missing validation of special properties '__proto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-3696" }, "impact_statement": "not_affected \u2014 CVE-2023-3696 (Prototype Pollution in mongoose) does not affect mongoose 9.6.3-tuxcare.1. The vulnerability was fixed by upstream maintainer Valeri Karpov in commit e29578d2e (July 2023) and released in versions 7.3.3, 6.11.3, and 5.13.20. Version 9.6.3, released upstream in September 2024, already contains this fix. The vulnerable code pattern (missing validation of special properties '__proto..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.3", "identifiers": { "purl": "pkg:npm/mongoose@9.6.3" } } ], "timestamp": "2026-11-02T20:06:00.090260+00:00", "status_notes": "Vulnerability CVE-2024-53900 affects version 9.6.3 of mongoose.", "vulnerability": { "name": "CVE-2024-53900" }, "action_statement": "Vulnerability CVE-2024-53900 affects version 9.6.3 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.3", "identifiers": { "purl": "pkg:npm/mongoose@9.6.3" } } ], "timestamp": "2026-11-02T20:07:00.091345+00:00", "status_notes": "Vulnerability CVE-2025-23061 affects version 9.6.3 of mongoose.", "vulnerability": { "name": "CVE-2025-23061" }, "action_statement": "Vulnerability CVE-2025-23061 affects version 9.6.3 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.3", "identifiers": { "purl": "pkg:npm/mongoose@9.6.3" } } ], "timestamp": "2026-11-10T21:05:04.452255+00:00", "status_notes": "Vulnerability CVE-2026-125116 affects version 9.6.3 of mongoose.", "vulnerability": { "name": "CVE-2026-125116" }, "action_statement": "Vulnerability CVE-2026-125116 affects version 9.6.3 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.3", "identifiers": { "purl": "pkg:npm/mongoose@9.6.3" } } ], "timestamp": "2026-11-10T21:05:02.047764+00:00", "status_notes": "Vulnerability CVE-2026-125117 affects version 9.6.3 of mongoose.", "vulnerability": { "name": "CVE-2026-125117" }, "action_statement": "Vulnerability CVE-2026-125117 affects version 9.6.3 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.3", "identifiers": { "purl": "pkg:npm/mongoose@9.6.3" } } ], "timestamp": "2026-11-10T20:58:50.437512+00:00", "status_notes": "Vulnerability CVE-2026-125118 affects version 9.6.3 of mongoose.", "vulnerability": { "name": "CVE-2026-125118" }, "action_statement": "Vulnerability CVE-2026-125118 affects version 9.6.3 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.3", "identifiers": { "purl": "pkg:npm/mongoose@9.6.3" } } ], "timestamp": "2026-11-10T20:03:31.902906+00:00", "status_notes": "Vulnerability CVE-2026-125119 affects version 9.6.3 of mongoose.", "vulnerability": { "name": "CVE-2026-125119" }, "action_statement": "Vulnerability CVE-2026-125119 affects version 9.6.3 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.3", "identifiers": { "purl": "pkg:npm/mongoose@9.6.3" } } ], "timestamp": "2026-11-10T19:43:34.920122+00:00", "status_notes": "Vulnerability CVE-2026-125120 affects version 9.6.3 of mongoose.", "vulnerability": { "name": "CVE-2026-125120" }, "action_statement": "Vulnerability CVE-2026-125120 affects version 9.6.3 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.3", "identifiers": { "purl": "pkg:npm/mongoose@9.6.3" } } ], "timestamp": "2026-11-02T20:07:00.091345+00:00", "status_notes": "Vulnerability CVE-2026-42334 affects version 9.6.3 of mongoose.", "vulnerability": { "name": "CVE-2026-42334" }, "action_statement": "Vulnerability CVE-2026-42334 affects version 9.6.3 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.3", "identifiers": { "purl": "pkg:npm/mongoose@9.6.3" } } ], "timestamp": "2026-10-20T05:58:00.129887+00:00", "status_notes": "Vulnerability CVE-2026-73562 affects version 9.6.3 of mongoose, and is fixed in 9.6.3-tuxcare.1.", "vulnerability": { "name": "CVE-2026-73562" }, "action_statement": "Vulnerability CVE-2026-73562 affects version 9.6.3 of mongoose, and is fixed in 9.6.3-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.3", "identifiers": { "purl": "pkg:npm/mongoose@9.6.3" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability GHSA-r5xw-q988-826m does not affect version 9.6.3 of mongoose. not_affected \u2014 Mongoose 9.6.3-tuxcare.1 is NOT vulnerable to GHSA-r5xw-q988-826m (remote memory exposure via uninitialized buffer allocation). The vulnerability affected versions before 4.3.6/3.8.39 when saving a number to a Buffer field. The upstream fix was applied in commit 8066b145c (Jan 2016) by wrapping numbers in arrays before buffer creation, preventing the unsafe `new Buffer(number)` pattern that all...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-r5xw-q988-826m" }, "impact_statement": "not_affected \u2014 Mongoose 9.6.3-tuxcare.1 is NOT vulnerable to GHSA-r5xw-q988-826m (remote memory exposure via uninitialized buffer allocation). The vulnerability affected versions before 4.3.6/3.8.39 when saving a number to a Buffer field. The upstream fix was applied in commit 8066b145c (Jan 2016) by wrapping numbers in arrays before buffer creation, preventing the unsafe `new Buffer(number)` pattern that all..." } ] }