{
  "@id": "urn:uuid:cb403f43-c358-4857-a2f9-6d4e6cbf220e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T21:05:04.452255+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2019-17426 does not affect version 9.7.3 of mongoose. not_affected \u2014 CVE-2019-17426 affected Mongoose through version 5.7.4. The target (version 9.7.3) is NOT vulnerable. The vulnerability was fixed in Mongoose 5.7.5 (Oct 2019) by upstream maintainer Valeri Karpov, who added code to strip `_bsontype` attributes from query objects to work around bson 1.x parser behavior. This workaround was later removed in version 6.1.8 (Jan 2022) when Mongoose upgraded to bson ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17426"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17426 affected Mongoose through version 5.7.4. The target (version 9.7.3) is NOT vulnerable. The vulnerability was fixed in Mongoose 5.7.5 (Oct 2019) by upstream maintainer Valeri Karpov, who added code to strip `_bsontype` attributes from query objects to work around bson 1.x parser behavior. This workaround was later removed in version 6.1.8 (Jan 2022) when Mongoose upgraded to bson ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-24304 does not affect version 9.7.3 of mongoose. not_affected \u2014 CVE-2022-24304 (prototype pollution via Schema.path()) is NOT PRESENT in mongoose 9.7.3. The vulnerability was fixed by upstream commit 6a197316 (July 2022) authored by val@karpov.io, which added validation to reject path segments containing '__proto__', 'constructor', or 'prototype'. This fix shipped in mongoose 5.13.14 and all subsequent releases including 9.7.3. The fix predates the first Tu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24304"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24304 (prototype pollution via Schema.path()) is NOT PRESENT in mongoose 9.7.3. The vulnerability was fixed by upstream commit 6a197316 (July 2022) authored by val@karpov.io, which added validation to reject path segments containing '__proto__', 'constructor', or 'prototype'. This fix shipped in mongoose 5.13.14 and all subsequent releases including 9.7.3. The fix predates the first Tu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2564 does not affect version 9.7.3 of mongoose. not_affected \u2014 CVE-2022-2564 describes a prototype pollution vulnerability in Mongoose's Schema.path() function. The target repository (Mongoose v9.7.3) is NOT AFFECTED because the vulnerable code pattern was already fixed by upstream maintainer Valeri Karpov in commit a45cfb6b0c (July 18, 2022), which shipped in version 6.10.0 and all subsequent releases. The fix adds comprehensive protection via specialProp...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2564"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2564 describes a prototype pollution vulnerability in Mongoose's Schema.path() function. The target repository (Mongoose v9.7.3) is NOT AFFECTED because the vulnerable code pattern was already fixed by upstream maintainer Valeri Karpov in commit a45cfb6b0c (July 18, 2022), which shipped in version 6.10.0 and all subsequent releases. The fix adds comprehensive protection via specialProp..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2023-3696 does not affect version 9.7.3 of mongoose. not_affected \u2014 CVE-2023-3696 is a prototype pollution vulnerability affecting Mongoose versions prior to 7.3.3, 6.11.3, and 5.13.20. The target repository is Mongoose v9.7.3, which already contains the upstream fix that was released in version 7.3.3 on July 10, 2023. The fix prevents prototype pollution by skipping dangerous property names (__proto__, constructor, prototype) during document initialization. Th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-3696"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-3696 is a prototype pollution vulnerability affecting Mongoose versions prior to 7.3.3, 6.11.3, and 5.13.20. The target repository is Mongoose v9.7.3, which already contains the upstream fix that was released in version 7.3.3 on July 10, 2023. The fix prevents prototype pollution by skipping dangerous property names (__proto__, constructor, prototype) during document initialization. Th..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.3"
          }
        }
      ],
      "timestamp": "2026-11-02T20:06:00.090260+00:00",
      "status_notes": "Vulnerability CVE-2024-53900 affects version 9.7.3 of mongoose.",
      "vulnerability": {
        "name": "CVE-2024-53900"
      },
      "action_statement": "Vulnerability CVE-2024-53900 affects version 9.7.3 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.3"
          }
        }
      ],
      "timestamp": "2026-11-02T20:07:00.091345+00:00",
      "status_notes": "Vulnerability CVE-2025-23061 affects version 9.7.3 of mongoose.",
      "vulnerability": {
        "name": "CVE-2025-23061"
      },
      "action_statement": "Vulnerability CVE-2025-23061 affects version 9.7.3 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.3"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:04.452255+00:00",
      "status_notes": "Vulnerability CVE-2026-125116 affects version 9.7.3 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125116"
      },
      "action_statement": "Vulnerability CVE-2026-125116 affects version 9.7.3 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.3"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:04.452255+00:00",
      "status_notes": "Vulnerability CVE-2026-125117 affects version 9.7.3 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125117"
      },
      "action_statement": "Vulnerability CVE-2026-125117 affects version 9.7.3 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.3"
          }
        }
      ],
      "timestamp": "2026-11-10T20:58:50.437512+00:00",
      "status_notes": "Vulnerability CVE-2026-125118 affects version 9.7.3 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125118"
      },
      "action_statement": "Vulnerability CVE-2026-125118 affects version 9.7.3 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.3"
          }
        }
      ],
      "timestamp": "2026-11-10T20:03:31.902906+00:00",
      "status_notes": "Vulnerability CVE-2026-125119 affects version 9.7.3 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125119"
      },
      "action_statement": "Vulnerability CVE-2026-125119 affects version 9.7.3 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.3"
          }
        }
      ],
      "timestamp": "2026-11-10T19:43:34.920122+00:00",
      "status_notes": "Vulnerability CVE-2026-125120 affects version 9.7.3 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125120"
      },
      "action_statement": "Vulnerability CVE-2026-125120 affects version 9.7.3 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.3"
          }
        }
      ],
      "timestamp": "2026-11-02T20:07:00.091345+00:00",
      "status_notes": "Vulnerability CVE-2026-42334 affects version 9.7.3 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-42334"
      },
      "action_statement": "Vulnerability CVE-2026-42334 affects version 9.7.3 of mongoose."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2026-73562 does not affect version 9.7.3 of mongoose. not_affected \u2014 CVE-2026-73562 prototype pollution vulnerability is NOT present in mongoose 9.7.3. The target version contains comprehensive upstream fixes that prevent prototype pollution in update casting. Multiple defense layers are in place: setDottedPath() checks each path segment for special properties (__proto__, constructor, prototype) and skips them; Schema.prototype.path() uses Object.hasOwn() and th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-73562"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-73562 prototype pollution vulnerability is NOT present in mongoose 9.7.3. The target version contains comprehensive upstream fixes that prevent prototype pollution in update casting. Multiple defense layers are in place: setDottedPath() checks each path segment for special properties (__proto__, constructor, prototype) and skips them; Schema.prototype.path() uses Object.hasOwn() and th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability GHSA-r5xw-q988-826m does not affect version 9.7.3 of mongoose. not_affected \u2014 The target version (mongoose 9.7.3) is NOT affected by GHSA-r5xw-q988-826m (remote memory exposure via number-to-Buffer cast). The vulnerable code pattern was removed by upstream commit 8066b145c (Jan 2016, author: Valeri Karpov), which was already present in the upstream release before TuxCare involvement. The fix converts numeric input to an array before Buffer creation, preventing uninitiali...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r5xw-q988-826m"
      },
      "impact_statement": "not_affected \u2014 The target version (mongoose 9.7.3) is NOT affected by GHSA-r5xw-q988-826m (remote memory exposure via number-to-Buffer cast). The vulnerable code pattern was removed by upstream commit 8066b145c (Jan 2016, author: Valeri Karpov), which was already present in the upstream release before TuxCare involvement. The fix converts numeric input to an array before Buffer creation, preventing uninitiali..."
    }
  ]
}