{
  "@id": "urn:uuid:1071fd22-09af-4c65-9348-3cd6c2da5a5b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T21:23:26.917293+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T01:24:00.055080+00:00",
      "status_notes": "Vulnerability CVE-2020-7720 affects version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2020-7720"
      },
      "action_statement": "Vulnerability CVE-2020-7720 affects version 1.3.3-tuxcare.2 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T01:24:00.055080+00:00",
      "status_notes": "Vulnerability CVE-2022-0122 affects version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2022-0122"
      },
      "action_statement": "Vulnerability CVE-2022-0122 affects version 1.3.3-tuxcare.2 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T01:24:00.055080+00:00",
      "status_notes": "Vulnerability CVE-2022-24771 affects version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2022-24771"
      },
      "action_statement": "Vulnerability CVE-2022-24771 affects version 1.3.3-tuxcare.2 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T01:24:00.055080+00:00",
      "status_notes": "Vulnerability CVE-2022-24772 affects version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2022-24772"
      },
      "action_statement": "Vulnerability CVE-2022-24772 affects version 1.3.3-tuxcare.2 of node-forge."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:45:18.492316+00:00",
      "status_notes": "Vulnerability CVE-2022-24773 does not affect version 1.3.3-tuxcare.2 of node-forge. not_affected \u2014 The target is node-forge 1.3.3, which is past the 1.3.0 fix for CVE-2022-24773. RSASSA-PKCS1-v1_5 verification parses the whole decrypted block strictly and validates the DigestInfo structure, so malformed wrappers are rejected. The fix came from upstream (digitalbazaar), not from a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24773"
      },
      "impact_statement": "not_affected \u2014 The target is node-forge 1.3.3, which is past the 1.3.0 fix for CVE-2022-24773. RSASSA-PKCS1-v1_5 verification parses the whole decrypted block strictly and validates the DigestInfo structure, so malformed wrappers are rejected. The fix came from upstream (digitalbazaar), not from a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T01:24:00.055080+00:00",
      "status_notes": "Vulnerability CVE-2025-12816 affects version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2025-12816"
      },
      "action_statement": "Vulnerability CVE-2025-12816 affects version 1.3.3-tuxcare.2 of node-forge."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:50:00.063329+00:00",
      "status_notes": "Vulnerability CVE-2025-66030 does not affect version 1.3.3-tuxcare.2 of node-forge. not_affected \u2014 CVE-2025-66030 (OID arc integer truncation in asn1.derToOid) is already fixed in this target. The upstream commit 3e0c35ace169 by David I. Lehn (digitalbazaar) is an ancestor of HEAD. It was already present in the upstream node-forge 1.3.3 release that TuxCare onboarded, so this is an upstream fix and not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-66030"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-66030 (OID arc integer truncation in asn1.derToOid) is already fixed in this target. The upstream commit 3e0c35ace169 by David I. Lehn (digitalbazaar) is an ancestor of HEAD. It was already present in the upstream node-forge 1.3.3 release that TuxCare onboarded, so this is an upstream fix and not a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T01:24:00.055080+00:00",
      "status_notes": "Vulnerability CVE-2025-66031 affects version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2025-66031"
      },
      "action_statement": "Vulnerability CVE-2025-66031 affects version 1.3.3-tuxcare.2 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T17:45:38.376707+00:00",
      "status_notes": "Vulnerability CVE-2026-118774 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-118774"
      },
      "action_statement": "Vulnerability CVE-2026-118774 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T12:05:46.248719+00:00",
      "status_notes": "Vulnerability CVE-2026-118775 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-118775"
      },
      "action_statement": "Vulnerability CVE-2026-118775 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T17:45:38.376707+00:00",
      "status_notes": "Vulnerability CVE-2026-118776 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-118776"
      },
      "action_statement": "Vulnerability CVE-2026-118776 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T12:05:54.146079+00:00",
      "status_notes": "Vulnerability CVE-2026-118777 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-118777"
      },
      "action_statement": "Vulnerability CVE-2026-118777 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T12:05:46.248719+00:00",
      "status_notes": "Vulnerability CVE-2026-118778 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-118778"
      },
      "action_statement": "Vulnerability CVE-2026-118778 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T12:05:54.146079+00:00",
      "status_notes": "Vulnerability CVE-2026-118779 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-118779"
      },
      "action_statement": "Vulnerability CVE-2026-118779 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T12:05:46.248719+00:00",
      "status_notes": "Vulnerability CVE-2026-118780 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-118780"
      },
      "action_statement": "Vulnerability CVE-2026-118780 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T22:47:26.684085+00:00",
      "status_notes": "Vulnerability CVE-2026-118781 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-118781"
      },
      "action_statement": "Vulnerability CVE-2026-118781 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T12:06:11.861171+00:00",
      "status_notes": "Vulnerability CVE-2026-118782 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-118782"
      },
      "action_statement": "Vulnerability CVE-2026-118782 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T12:05:46.248719+00:00",
      "status_notes": "Vulnerability CVE-2026-119186 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-119186"
      },
      "action_statement": "Vulnerability CVE-2026-119186 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T12:05:46.248719+00:00",
      "status_notes": "Vulnerability CVE-2026-119187 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-119187"
      },
      "action_statement": "Vulnerability CVE-2026-119187 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T12:05:54.146079+00:00",
      "status_notes": "Vulnerability CVE-2026-119188 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-119188"
      },
      "action_statement": "Vulnerability CVE-2026-119188 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T16:32:43.826664+00:00",
      "status_notes": "Vulnerability CVE-2026-119189 affects version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-119189"
      },
      "action_statement": "Vulnerability CVE-2026-119189 affects version 1.3.3-tuxcare.2 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T12:05:46.248719+00:00",
      "status_notes": "Vulnerability CVE-2026-119190 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-119190"
      },
      "action_statement": "Vulnerability CVE-2026-119190 affects version 1.3.3-tuxcare.2 of node-forge, and is fixed in 1.3.3-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T16:32:43.826664+00:00",
      "status_notes": "Vulnerability CVE-2026-119191 affects version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-119191"
      },
      "action_statement": "Vulnerability CVE-2026-119191 affects version 1.3.3-tuxcare.2 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T16:32:43.826664+00:00",
      "status_notes": "Vulnerability CVE-2026-119192 affects version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-119192"
      },
      "action_statement": "Vulnerability CVE-2026-119192 affects version 1.3.3-tuxcare.2 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T21:23:26.917293+00:00",
      "status_notes": "Vulnerability CVE-2026-125332 affects version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-125332"
      },
      "action_statement": "Vulnerability CVE-2026-125332 affects version 1.3.3-tuxcare.2 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T21:23:26.917293+00:00",
      "status_notes": "Vulnerability CVE-2026-125333 affects version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-125333"
      },
      "action_statement": "Vulnerability CVE-2026-125333 affects version 1.3.3-tuxcare.2 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T21:18:37.645708+00:00",
      "status_notes": "Vulnerability CVE-2026-125334 affects version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-125334"
      },
      "action_statement": "Vulnerability CVE-2026-125334 affects version 1.3.3-tuxcare.2 of node-forge."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T21:23:26.917293+00:00",
      "status_notes": "Vulnerability CVE-2026-125335 affects version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-125335"
      },
      "action_statement": "Vulnerability CVE-2026-125335 affects version 1.3.3-tuxcare.2 of node-forge."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-08T13:49:00.166686+00:00",
      "status_notes": "Vulnerability CVE-2026-33891 is fixed in version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-33891"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-08T13:49:00.166686+00:00",
      "status_notes": "Vulnerability CVE-2026-33894 is fixed in version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-33894"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-08T13:49:00.166686+00:00",
      "status_notes": "Vulnerability CVE-2026-33895 is fixed in version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-33895"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-08T13:49:00.166686+00:00",
      "status_notes": "Vulnerability CVE-2026-33896 is fixed in version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-33896"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-08T13:49:00.166686+00:00",
      "status_notes": "Vulnerability CVE-2026-85393 affects version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "CVE-2026-85393"
      },
      "action_statement": "Vulnerability CVE-2026-85393 affects version 1.3.3-tuxcare.2 of node-forge."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:48:00.101890+00:00",
      "status_notes": "Vulnerability GHSA-5rrq-pxf6-6jx5 does not affect version 1.3.3-tuxcare.2 of node-forge. not_affected \u2014 Target is node-forge 1.3.3. The GHSA-5rrq-pxf6-6jx5 fix, which removed the forge.debug API in 1.0.0, is already in the upstream release. The vulnerable debug storage helpers are not present in lib/.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-5rrq-pxf6-6jx5"
      },
      "impact_statement": "not_affected \u2014 Target is node-forge 1.3.3. The GHSA-5rrq-pxf6-6jx5 fix, which removed the forge.debug API in 1.0.0, is already in the upstream release. The vulnerable debug storage helpers are not present in lib/."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T01:24:00.055080+00:00",
      "status_notes": "Vulnerability GHSA-gf8q-jrpm-jvxq affects version 1.3.3-tuxcare.2 of node-forge.",
      "vulnerability": {
        "name": "GHSA-gf8q-jrpm-jvxq"
      },
      "action_statement": "Vulnerability GHSA-gf8q-jrpm-jvxq affects version 1.3.3-tuxcare.2 of node-forge."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/node-forge@1.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/node-forge@1.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T13:13:59.713094+00:00",
      "status_notes": "Vulnerability GHSA-wxgw-qj99-44c2 does not affect version 1.3.3-tuxcare.2 of node-forge. not_affected \u2014 forge.util.setPath/getPath/deletePath are absent from the target (node-forge 1.3.3). The upstream fix commit 6a1e3ef (\"Remove object path functions\", 0.10.0) is an ancestor of HEAD and shipped in the upstream release before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wxgw-qj99-44c2"
      },
      "impact_statement": "not_affected \u2014 forge.util.setPath/getPath/deletePath are absent from the target (node-forge 1.3.3). The upstream fix commit 6a1e3ef (\"Remove object path functions\", 0.10.0) is an ancestor of HEAD and shipped in the upstream release before the first TuxCare commit."
    }
  ]
}