{
  "@id": "urn:uuid:f775c2b2-89f0-48d1-8602-085c96c9fb59",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T21:23:26.917293+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:31.812089+00:00",
      "status_notes": "Vulnerability CVE-2020-7720 affects version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2020-7720"
      },
      "action_statement": "Vulnerability CVE-2020-7720 affects version 0.10.0-tuxcare.8 of node-forge."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:31.812089+00:00",
      "status_notes": "Vulnerability CVE-2022-0122 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2022-0122"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:31.812089+00:00",
      "status_notes": "Vulnerability CVE-2022-24771 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2022-24771"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:31.812089+00:00",
      "status_notes": "Vulnerability CVE-2022-24772 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2022-24772"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:31.812089+00:00",
      "status_notes": "Vulnerability CVE-2022-24773 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2022-24773"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:31.812089+00:00",
      "status_notes": "Vulnerability CVE-2025-12816 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2025-12816"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:31.812089+00:00",
      "status_notes": "Vulnerability CVE-2025-66030 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2025-66030"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:31.812089+00:00",
      "status_notes": "Vulnerability CVE-2025-66031 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2025-66031"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-10T16:36:14.525520+00:00",
      "status_notes": "Vulnerability CVE-2026-118774 does not affect version 0.10.0-tuxcare.8 of node-forge. not_affected \u2014 node-forge 0.10.0 predates the refactor that introduced the flaw. The 0.10.0 cert.verify() already verifies each child certificate with the child's own signature OID and parameters, and uses the issuer only for its public key. The issuer-scheme-selection pattern (_verifySignature choosing padding from the issuer's signatureOid) does not exist in this tree.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-118774"
      },
      "impact_statement": "not_affected \u2014 node-forge 0.10.0 predates the refactor that introduced the flaw. The 0.10.0 cert.verify() already verifies each child certificate with the child's own signature OID and parameters, and uses the issuer only for its public key. The issuer-scheme-selection pattern (_verifySignature choosing padding from the issuer's signatureOid) does not exist in this tree."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:41.317485+00:00",
      "status_notes": "Vulnerability CVE-2026-118775 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-118775"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-10T19:06:00.219885+00:00",
      "status_notes": "Vulnerability CVE-2026-118776 affects version 0.10.0-tuxcare.8 of node-forge, and is fixed in 0.10.0-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-118776"
      },
      "action_statement": "Vulnerability CVE-2026-118776 affects version 0.10.0-tuxcare.8 of node-forge, and is fixed in 0.10.0-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T18:02:52.506286+00:00",
      "status_notes": "Vulnerability CVE-2026-118777 affects version 0.10.0-tuxcare.8 of node-forge, and is fixed in 0.10.0-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-118777"
      },
      "action_statement": "Vulnerability CVE-2026-118777 affects version 0.10.0-tuxcare.8 of node-forge, and is fixed in 0.10.0-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T18:02:52.506286+00:00",
      "status_notes": "Vulnerability CVE-2026-118778 affects version 0.10.0-tuxcare.8 of node-forge, and is fixed in 0.10.0-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-118778"
      },
      "action_statement": "Vulnerability CVE-2026-118778 affects version 0.10.0-tuxcare.8 of node-forge, and is fixed in 0.10.0-tuxcare.9."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:48.918412+00:00",
      "status_notes": "Vulnerability CVE-2026-118779 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-118779"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:41.317485+00:00",
      "status_notes": "Vulnerability CVE-2026-118780 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-118780"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-05T13:39:00.032188+00:00",
      "status_notes": "Vulnerability CVE-2026-118781 affects version 0.10.0-tuxcare.8 of node-forge, and is fixed in 0.10.0-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-118781"
      },
      "action_statement": "Vulnerability CVE-2026-118781 affects version 0.10.0-tuxcare.8 of node-forge, and is fixed in 0.10.0-tuxcare.10."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:48.918412+00:00",
      "status_notes": "Vulnerability CVE-2026-118782 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-118782"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:48.918412+00:00",
      "status_notes": "Vulnerability CVE-2026-119186 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-119186"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:41.317485+00:00",
      "status_notes": "Vulnerability CVE-2026-119187 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-119187"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T18:02:52.506286+00:00",
      "status_notes": "Vulnerability CVE-2026-119188 affects version 0.10.0-tuxcare.8 of node-forge, and is fixed in 0.10.0-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-119188"
      },
      "action_statement": "Vulnerability CVE-2026-119188 affects version 0.10.0-tuxcare.8 of node-forge, and is fixed in 0.10.0-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-10T16:32:43.826664+00:00",
      "status_notes": "Vulnerability CVE-2026-119189 affects version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-119189"
      },
      "action_statement": "Vulnerability CVE-2026-119189 affects version 0.10.0-tuxcare.8 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T18:02:52.506286+00:00",
      "status_notes": "Vulnerability CVE-2026-119190 affects version 0.10.0-tuxcare.8 of node-forge, and is fixed in 0.10.0-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-119190"
      },
      "action_statement": "Vulnerability CVE-2026-119190 affects version 0.10.0-tuxcare.8 of node-forge, and is fixed in 0.10.0-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-10T16:32:43.826664+00:00",
      "status_notes": "Vulnerability CVE-2026-119191 affects version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-119191"
      },
      "action_statement": "Vulnerability CVE-2026-119191 affects version 0.10.0-tuxcare.8 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-10T16:32:43.826664+00:00",
      "status_notes": "Vulnerability CVE-2026-119192 affects version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-119192"
      },
      "action_statement": "Vulnerability CVE-2026-119192 affects version 0.10.0-tuxcare.8 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-10T21:23:26.917293+00:00",
      "status_notes": "Vulnerability CVE-2026-125332 affects version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-125332"
      },
      "action_statement": "Vulnerability CVE-2026-125332 affects version 0.10.0-tuxcare.8 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-10T21:23:26.917293+00:00",
      "status_notes": "Vulnerability CVE-2026-125333 affects version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-125333"
      },
      "action_statement": "Vulnerability CVE-2026-125333 affects version 0.10.0-tuxcare.8 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-10T21:18:37.645708+00:00",
      "status_notes": "Vulnerability CVE-2026-125334 affects version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-125334"
      },
      "action_statement": "Vulnerability CVE-2026-125334 affects version 0.10.0-tuxcare.8 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-10T21:23:26.917293+00:00",
      "status_notes": "Vulnerability CVE-2026-125335 affects version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-125335"
      },
      "action_statement": "Vulnerability CVE-2026-125335 affects version 0.10.0-tuxcare.8 of node-forge."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:31.812089+00:00",
      "status_notes": "Vulnerability CVE-2026-33891 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-33891"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:31.812089+00:00",
      "status_notes": "Vulnerability CVE-2026-33894 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-33894"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:31.812089+00:00",
      "status_notes": "Vulnerability CVE-2026-33895 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-33895"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:31.812089+00:00",
      "status_notes": "Vulnerability CVE-2026-33896 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-33896"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:31.812089+00:00",
      "status_notes": "Vulnerability CVE-2026-85393 affects version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-85393"
      },
      "action_statement": "Vulnerability CVE-2026-85393 affects version 0.10.0-tuxcare.8 of node-forge."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:31.812089+00:00",
      "status_notes": "Vulnerability GHSA-5rrq-pxf6-6jx5 is fixed in version 0.10.0-tuxcare.8 of node-forge.",
      "vulnerability": {
        "name": "GHSA-5rrq-pxf6-6jx5"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:12:31.812089+00:00",
      "status_notes": "Vulnerability GHSA-gf8q-jrpm-jvxq does not affect version 0.10.0-tuxcare.8 of node-forge. already_fixed \u2014 The target repository (node-forge 0.10.0-tuxcare.6) already contains the fix for GHSA-gf8q-jrpm-jvxq. The vulnerable forge.util.parseUrl function with its broken regex-based URL parser was removed and replaced with the WHATWG URL Standard API in TuxCare commit 3018229 (December 18, 2025) as part of CVE-2022-0122 backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-gf8q-jrpm-jvxq"
      },
      "impact_statement": "already_fixed \u2014 The target repository (node-forge 0.10.0-tuxcare.6) already contains the fix for GHSA-gf8q-jrpm-jvxq. The vulnerable forge.util.parseUrl function with its broken regex-based URL parser was removed and replaced with the WHATWG URL Standard API in TuxCare commit 3018229 (December 18, 2025) as part of CVE-2022-0122 backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@0.10.0-tuxcare.8",
          "identifiers": {
            "purl": "pkg:npm/node-forge@0.10.0-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-06T13:16:00.060527+00:00",
      "status_notes": "Vulnerability GHSA-wxgw-qj99-44c2 does not affect version 0.10.0-tuxcare.8 of node-forge. not_affected \u2014 The vendor fix (6a1e3ef, \"Remove object path functions\", authored by dlehn@digitalbazaar.com) is already in the target. It removes util.setPath, util.getPath and util.deletePath, so the vulnerable function no longer exists. The commit predates the first TuxCare commit, so the fix shipped in the upstream 0.10.0 release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wxgw-qj99-44c2"
      },
      "impact_statement": "not_affected \u2014 The vendor fix (6a1e3ef, \"Remove object path functions\", authored by dlehn@digitalbazaar.com) is already in the target. It removes util.setPath, util.getPath and util.deletePath, so the vulnerable function no longer exists. The commit predates the first TuxCare commit, so the fix shipped in the upstream 0.10.0 release."
    }
  ]
}