{
  "@id": "urn:uuid:0fd5b678-3faa-45a6-b444-9a0502309ca0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T11:23:00.043341+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:25:34.644070+00:00",
      "status_notes": "Vulnerability CVE-2025-43864 affects version 7.13.1-tuxcare.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2025-43864"
      },
      "action_statement": "Vulnerability CVE-2025-43864 affects version 7.13.1-tuxcare.2 of react-router."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:25:00.217895+00:00",
      "status_notes": "Vulnerability CVE-2025-43865 affects version 7.13.1-tuxcare.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2025-43865"
      },
      "action_statement": "Vulnerability CVE-2025-43865 affects version 7.13.1-tuxcare.2 of react-router."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:47:00.151806+00:00",
      "status_notes": "Vulnerability CVE-2025-59057 affects version 7.13.1-tuxcare.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2025-59057"
      },
      "action_statement": "Vulnerability CVE-2025-59057 affects version 7.13.1-tuxcare.2 of react-router."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:47:00.151806+00:00",
      "status_notes": "Vulnerability CVE-2026-22029 affects version 7.13.1-tuxcare.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2026-22029"
      },
      "action_statement": "Vulnerability CVE-2026-22029 affects version 7.13.1-tuxcare.2 of react-router."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T00:26:27.945159+00:00",
      "status_notes": "Vulnerability CVE-2026-22030 does not affect version 7.13.1-tuxcare.2 of react-router. not_affected \u2014 The target repository (React Router 7.13.1-tuxcare.3) is NOT affected by CVE-2026-22030. The CSRF protection fix was already included in the upstream React Router 7.13.1 release before TuxCare onboarded it. The defense mechanism (origin header validation via throwIfPotentialCSRFAttack) is present and properly integrated in all three server-side action entry points (server.ts, single-fetch.ts, s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22030"
      },
      "impact_statement": "not_affected \u2014 The target repository (React Router 7.13.1-tuxcare.3) is NOT affected by CVE-2026-22030. The CSRF protection fix was already included in the upstream React Router 7.13.1 release before TuxCare onboarded it. The defense mechanism (origin header validation via throwIfPotentialCSRFAttack) is present and properly integrated in all three server-side action entry points (server.ts, single-fetch.ts, s..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T17:53:00.040676+00:00",
      "status_notes": "Vulnerability CVE-2026-33244 affects version 7.13.1-tuxcare.2 of react-router, and is fixed in 7.13.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-33244"
      },
      "action_statement": "Vulnerability CVE-2026-33244 affects version 7.13.1-tuxcare.2 of react-router, and is fixed in 7.13.1-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T11:56:30.168532+00:00",
      "status_notes": "Vulnerability CVE-2026-33245 is fixed in version 7.13.1-tuxcare.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2026-33245"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T11:56:30.168532+00:00",
      "status_notes": "Vulnerability CVE-2026-34077 is fixed in version 7.13.1-tuxcare.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2026-34077"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T11:56:30.168532+00:00",
      "status_notes": "Vulnerability CVE-2026-40181 is fixed in version 7.13.1-tuxcare.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2026-40181"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T11:56:30.168532+00:00",
      "status_notes": "Vulnerability CVE-2026-42211 is fixed in version 7.13.1-tuxcare.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2026-42211"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T17:53:00.040676+00:00",
      "status_notes": "Vulnerability CVE-2026-42342 affects version 7.13.1-tuxcare.2 of react-router, and is fixed in 7.13.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-42342"
      },
      "action_statement": "Vulnerability CVE-2026-42342 affects version 7.13.1-tuxcare.2 of react-router, and is fixed in 7.13.1-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T11:56:30.168532+00:00",
      "status_notes": "Vulnerability CVE-2026-53663 is fixed in version 7.13.1-tuxcare.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2026-53663"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T11:56:30.168532+00:00",
      "status_notes": "Vulnerability CVE-2026-53666 is fixed in version 7.13.1-tuxcare.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2026-53666"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T11:56:30.168532+00:00",
      "status_notes": "Vulnerability CVE-2026-53667 is fixed in version 7.13.1-tuxcare.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2026-53667"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T00:37:00.052574+00:00",
      "status_notes": "Vulnerability CVE-2026-53668 does not affect version 7.13.1-tuxcare.2 of react-router. not_affected \u2014 The target repository (@remix-run/react-router 7.13.1-tuxcare.3) is NOT affected by CVE-2026-53668. The vulnerability\u2014an open redirect via protocol-less absolute URLs (e.g., //evil.com) bypassing path normalization\u2014has been fixed by upstream commit 3a5b5ad0e authored by Matt Brophy. This fix was already present in the upstream release 7.13.1 before TuxCare onboarded the version. The vulnerable ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-53668"
      },
      "impact_statement": "not_affected \u2014 The target repository (@remix-run/react-router 7.13.1-tuxcare.3) is NOT affected by CVE-2026-53668. The vulnerability\u2014an open redirect via protocol-less absolute URLs (e.g., //evil.com) bypassing path normalization\u2014has been fixed by upstream commit 3a5b5ad0e authored by Matt Brophy. This fix was already present in the upstream release 7.13.1 before TuxCare onboarded the version. The vulnerable ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T11:56:30.168532+00:00",
      "status_notes": "Vulnerability CVE-2026-53669 is fixed in version 7.13.1-tuxcare.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2026-53669"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T11:23:00.043341+00:00",
      "status_notes": "Vulnerability CVE-2026-55685 affects version 7.13.1-tuxcare.2 of react-router, and is fixed in 7.13.1-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-55685"
      },
      "action_statement": "Vulnerability CVE-2026-55685 affects version 7.13.1-tuxcare.2 of react-router, and is fixed in 7.13.1-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T18:27:31.961988+00:00",
      "status_notes": "Vulnerability GHSA-qwww-vcr4-c8h2 affects version 7.13.1-tuxcare.2 of react-router, and is fixed in 7.13.1-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-qwww-vcr4-c8h2"
      },
      "action_statement": "Vulnerability GHSA-qwww-vcr4-c8h2 affects version 7.13.1-tuxcare.2 of react-router, and is fixed in 7.13.1-tuxcare.3."
    }
  ]
}