{
  "@id": "urn:uuid:b0327fd3-9c09-4dd3-be6a-2d22996ede99",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T21:23:26.917293+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-04T01:24:00.055080+00:00",
      "status_notes": "Vulnerability CVE-2020-7720 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2020-7720"
      },
      "action_statement": "Vulnerability CVE-2020-7720 affects version 1.3.1 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-04T01:24:00.055080+00:00",
      "status_notes": "Vulnerability CVE-2022-0122 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2022-0122"
      },
      "action_statement": "Vulnerability CVE-2022-0122 affects version 1.3.1 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-04T01:24:00.055080+00:00",
      "status_notes": "Vulnerability CVE-2022-24771 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2022-24771"
      },
      "action_statement": "Vulnerability CVE-2022-24771 affects version 1.3.1 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-04T01:24:00.055080+00:00",
      "status_notes": "Vulnerability CVE-2022-24772 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2022-24772"
      },
      "action_statement": "Vulnerability CVE-2022-24772 affects version 1.3.1 of node-forge."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:43:31.934619+00:00",
      "status_notes": "Vulnerability CVE-2022-24773 does not affect version 1.3.1 of node-forge. not_affected \u2014 The target is node-forge 1.3.1-tuxcare.4. It already contains the upstream 1.3.0 fix for CVE-2022-24773, which came with the upstream release, so the vulnerable pattern is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24773"
      },
      "impact_statement": "not_affected \u2014 The target is node-forge 1.3.1-tuxcare.4. It already contains the upstream 1.3.0 fix for CVE-2022-24773, which came with the upstream release, so the vulnerable pattern is not present."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-12816 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2025-12816"
      },
      "action_statement": "Vulnerability CVE-2025-12816 affects version 1.3.1 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-10-03T11:48:00.360436+00:00",
      "status_notes": "Vulnerability CVE-2025-66030 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-66030"
      },
      "action_statement": "Vulnerability CVE-2025-66030 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-10-03T11:48:00.360436+00:00",
      "status_notes": "Vulnerability CVE-2025-66031 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-66031"
      },
      "action_statement": "Vulnerability CVE-2025-66031 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-10T18:06:43.514595+00:00",
      "status_notes": "Vulnerability CVE-2026-118774 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-118774"
      },
      "action_statement": "Vulnerability CVE-2026-118774 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-04T15:16:37.196216+00:00",
      "status_notes": "Vulnerability CVE-2026-118775 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-118775"
      },
      "action_statement": "Vulnerability CVE-2026-118775 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-10T18:06:43.514595+00:00",
      "status_notes": "Vulnerability CVE-2026-118776 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-118776"
      },
      "action_statement": "Vulnerability CVE-2026-118776 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-04T15:57:48.546624+00:00",
      "status_notes": "Vulnerability CVE-2026-118777 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-118777"
      },
      "action_statement": "Vulnerability CVE-2026-118777 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-04T15:57:48.546624+00:00",
      "status_notes": "Vulnerability CVE-2026-118778 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-118778"
      },
      "action_statement": "Vulnerability CVE-2026-118778 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-04T15:16:37.196216+00:00",
      "status_notes": "Vulnerability CVE-2026-118779 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-118779"
      },
      "action_statement": "Vulnerability CVE-2026-118779 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-04T15:16:37.196216+00:00",
      "status_notes": "Vulnerability CVE-2026-118780 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-118780"
      },
      "action_statement": "Vulnerability CVE-2026-118780 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-05T11:36:35.472908+00:00",
      "status_notes": "Vulnerability CVE-2026-118781 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-118781"
      },
      "action_statement": "Vulnerability CVE-2026-118781 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-04T15:16:37.196216+00:00",
      "status_notes": "Vulnerability CVE-2026-118782 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-118782"
      },
      "action_statement": "Vulnerability CVE-2026-118782 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-04T15:16:37.196216+00:00",
      "status_notes": "Vulnerability CVE-2026-119186 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-119186"
      },
      "action_statement": "Vulnerability CVE-2026-119186 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-04T15:16:37.196216+00:00",
      "status_notes": "Vulnerability CVE-2026-119187 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-119187"
      },
      "action_statement": "Vulnerability CVE-2026-119187 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-04T15:57:48.546624+00:00",
      "status_notes": "Vulnerability CVE-2026-119188 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-119188"
      },
      "action_statement": "Vulnerability CVE-2026-119188 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-10T16:32:43.826664+00:00",
      "status_notes": "Vulnerability CVE-2026-119189 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-119189"
      },
      "action_statement": "Vulnerability CVE-2026-119189 affects version 1.3.1 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-04T15:57:48.546624+00:00",
      "status_notes": "Vulnerability CVE-2026-119190 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-119190"
      },
      "action_statement": "Vulnerability CVE-2026-119190 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-10T16:32:43.826664+00:00",
      "status_notes": "Vulnerability CVE-2026-119191 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-119191"
      },
      "action_statement": "Vulnerability CVE-2026-119191 affects version 1.3.1 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-10T16:32:43.826664+00:00",
      "status_notes": "Vulnerability CVE-2026-119192 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-119192"
      },
      "action_statement": "Vulnerability CVE-2026-119192 affects version 1.3.1 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-10T21:23:26.917293+00:00",
      "status_notes": "Vulnerability CVE-2026-125332 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-125332"
      },
      "action_statement": "Vulnerability CVE-2026-125332 affects version 1.3.1 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-10T21:23:26.917293+00:00",
      "status_notes": "Vulnerability CVE-2026-125333 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-125333"
      },
      "action_statement": "Vulnerability CVE-2026-125333 affects version 1.3.1 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-10T21:18:37.645708+00:00",
      "status_notes": "Vulnerability CVE-2026-125334 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-125334"
      },
      "action_statement": "Vulnerability CVE-2026-125334 affects version 1.3.1 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-10T21:23:26.917293+00:00",
      "status_notes": "Vulnerability CVE-2026-125335 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-125335"
      },
      "action_statement": "Vulnerability CVE-2026-125335 affects version 1.3.1 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-10-03T11:48:00.360436+00:00",
      "status_notes": "Vulnerability CVE-2026-33891 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-33891"
      },
      "action_statement": "Vulnerability CVE-2026-33891 affects version 1.3.1 of node-forge, and is fixed in 1.3.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33894 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-33894"
      },
      "action_statement": "Vulnerability CVE-2026-33894 affects version 1.3.1 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33895 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-33895"
      },
      "action_statement": "Vulnerability CVE-2026-33895 affects version 1.3.1 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33896 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-33896"
      },
      "action_statement": "Vulnerability CVE-2026-33896 affects version 1.3.1 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-10-01T21:19:46.058769+00:00",
      "status_notes": "Vulnerability CVE-2026-85393 affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-85393"
      },
      "action_statement": "Vulnerability CVE-2026-85393 affects version 1.3.1 of node-forge."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:48:00.101890+00:00",
      "status_notes": "Vulnerability GHSA-5rrq-pxf6-6jx5 does not affect version 1.3.1 of node-forge. not_affected \u2014 The target is node-forge 1.3.1, which is later than 1.0.0. The upstream fix, commit 5122808 by dlehn@digitalbazaar.com, removed the forge.debug API in 1.0.0. The repo has no lib/debug.js and no forge.debug definition. The fix shipped in the upstream release before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-5rrq-pxf6-6jx5"
      },
      "impact_statement": "not_affected \u2014 The target is node-forge 1.3.1, which is later than 1.0.0. The upstream fix, commit 5122808 by dlehn@digitalbazaar.com, removed the forge.debug API in 1.0.0. The repo has no lib/debug.js and no forge.debug definition. The fix shipped in the upstream release before the first TuxCare commit."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-04T01:24:00.055080+00:00",
      "status_notes": "Vulnerability GHSA-gf8q-jrpm-jvxq affects version 1.3.1 of node-forge.",
      "vulnerability": {
        "name": "GHSA-gf8q-jrpm-jvxq"
      },
      "action_statement": "Vulnerability GHSA-gf8q-jrpm-jvxq affects version 1.3.1 of node-forge."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.1",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.1"
          }
        }
      ],
      "timestamp": "2026-11-06T13:16:00.060527+00:00",
      "status_notes": "Vulnerability GHSA-wxgw-qj99-44c2 does not affect version 1.3.1 of node-forge. not_affected \u2014 Target is node-forge 1.3.1-tuxcare.4. The upstream fix (commit 6a1e3ef, \"Remove object path functions\", released in 0.10.0) is already part of the upstream release the branch was built from. util.setPath, getPath and deletePath no longer exist anywhere in the repo.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wxgw-qj99-44c2"
      },
      "impact_statement": "not_affected \u2014 Target is node-forge 1.3.1-tuxcare.4. The upstream fix (commit 6a1e3ef, \"Remove object path functions\", released in 0.10.0) is already part of the upstream release the branch was built from. util.setPath, getPath and deletePath no longer exist anywhere in the repo."
    }
  ]
}