{
  "@id": "urn:uuid:9f42020e-f22f-4d73-a37d-9262870af345",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T11:23:00.043341+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.14.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.14.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:25:34.644070+00:00",
      "status_notes": "Vulnerability CVE-2025-43864 affects version 7.14.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2025-43864"
      },
      "action_statement": "Vulnerability CVE-2025-43864 affects version 7.14.2 of react-router."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.14.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.14.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:25:00.217895+00:00",
      "status_notes": "Vulnerability CVE-2025-43865 affects version 7.14.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2025-43865"
      },
      "action_statement": "Vulnerability CVE-2025-43865 affects version 7.14.2 of react-router."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.14.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.14.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:47:00.151806+00:00",
      "status_notes": "Vulnerability CVE-2025-59057 affects version 7.14.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2025-59057"
      },
      "action_statement": "Vulnerability CVE-2025-59057 affects version 7.14.2 of react-router."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.14.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.14.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:47:00.151806+00:00",
      "status_notes": "Vulnerability CVE-2026-22029 affects version 7.14.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2026-22029"
      },
      "action_statement": "Vulnerability CVE-2026-22029 affects version 7.14.2 of react-router."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.14.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.14.2"
          }
        }
      ],
      "timestamp": "2026-11-04T00:26:59.759173+00:00",
      "status_notes": "Vulnerability CVE-2026-22030 does not affect version 7.14.2 of react-router. not_affected \u2014 CVE-2026-22030 CSRF vulnerability is not present in the target. The upstream React Router project added origin validation checks in version 7.12.0 (commit 75b1ef50867d8fa3d5ffdab28245d5fec307d6a7 by Matt Brophy). The target is based on upstream version 7.14.2, which already contained this fix when TuxCare onboarded it. The defense function throwIfPotentialCSRFAttack properly validates origin he...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22030"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-22030 CSRF vulnerability is not present in the target. The upstream React Router project added origin validation checks in version 7.12.0 (commit 75b1ef50867d8fa3d5ffdab28245d5fec307d6a7 by Matt Brophy). The target is based on upstream version 7.14.2, which already contained this fix when TuxCare onboarded it. The defense function throwIfPotentialCSRFAttack properly validates origin he..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.14.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.14.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:49:00.106665+00:00",
      "status_notes": "Vulnerability CVE-2026-42211 affects version 7.14.2 of react-router.",
      "vulnerability": {
        "name": "CVE-2026-42211"
      },
      "action_statement": "Vulnerability CVE-2026-42211 affects version 7.14.2 of react-router."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.14.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.14.2"
          }
        }
      ],
      "timestamp": "2026-11-04T17:47:00.434658+00:00",
      "status_notes": "Vulnerability CVE-2026-42342 affects version 7.14.2 of react-router, and is fixed in 7.14.2-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42342"
      },
      "action_statement": "Vulnerability CVE-2026-42342 affects version 7.14.2 of react-router, and is fixed in 7.14.2-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.14.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.14.2"
          }
        }
      ],
      "timestamp": "2026-10-16T23:03:00.148442+00:00",
      "status_notes": "Vulnerability CVE-2026-53663 affects version 7.14.2 of react-router, and is fixed in 7.14.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-53663"
      },
      "action_statement": "Vulnerability CVE-2026-53663 affects version 7.14.2 of react-router, and is fixed in 7.14.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.14.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.14.2"
          }
        }
      ],
      "timestamp": "2026-10-16T23:03:00.148442+00:00",
      "status_notes": "Vulnerability CVE-2026-53666 affects version 7.14.2 of react-router, and is fixed in 7.14.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-53666"
      },
      "action_statement": "Vulnerability CVE-2026-53666 affects version 7.14.2 of react-router, and is fixed in 7.14.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.14.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.14.2"
          }
        }
      ],
      "timestamp": "2026-10-16T23:03:00.148442+00:00",
      "status_notes": "Vulnerability CVE-2026-53667 affects version 7.14.2 of react-router, and is fixed in 7.14.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-53667"
      },
      "action_statement": "Vulnerability CVE-2026-53667 affects version 7.14.2 of react-router, and is fixed in 7.14.2-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.14.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.14.2"
          }
        }
      ],
      "timestamp": "2026-11-04T00:37:00.052574+00:00",
      "status_notes": "Vulnerability CVE-2026-53668 does not affect version 7.14.2 of react-router. not_affected \u2014 Target react-router version 7.14.2-tuxcare.2 is NOT AFFECTED by CVE-2026-53668. The vulnerability (open redirect via protocol-less absolute URLs like `//evil.com`) was fixed in upstream commit 3a5b5ad0e by Matt Brophy before TuxCare onboarded this version. The fix normalizes all double slashes to single slashes via `removeDoubleSlashes()`, preventing `//domain` from being interpreted as a netwo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-53668"
      },
      "impact_statement": "not_affected \u2014 Target react-router version 7.14.2-tuxcare.2 is NOT AFFECTED by CVE-2026-53668. The vulnerability (open redirect via protocol-less absolute URLs like `//evil.com`) was fixed in upstream commit 3a5b5ad0e by Matt Brophy before TuxCare onboarded this version. The fix normalizes all double slashes to single slashes via `removeDoubleSlashes()`, preventing `//domain` from being interpreted as a netwo..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.14.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.14.2"
          }
        }
      ],
      "timestamp": "2026-10-16T23:03:00.148442+00:00",
      "status_notes": "Vulnerability CVE-2026-53669 affects version 7.14.2 of react-router, and is fixed in 7.14.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-53669"
      },
      "action_statement": "Vulnerability CVE-2026-53669 affects version 7.14.2 of react-router, and is fixed in 7.14.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.14.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.14.2"
          }
        }
      ],
      "timestamp": "2026-11-06T11:23:00.043341+00:00",
      "status_notes": "Vulnerability CVE-2026-55685 affects version 7.14.2 of react-router, and is fixed in 7.14.2-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-55685"
      },
      "action_statement": "Vulnerability CVE-2026-55685 affects version 7.14.2 of react-router, and is fixed in 7.14.2-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.14.2",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.14.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:10:00.108305+00:00",
      "status_notes": "Vulnerability GHSA-qwww-vcr4-c8h2 affects version 7.14.2 of react-router, and is fixed in 7.14.2-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-qwww-vcr4-c8h2"
      },
      "action_statement": "Vulnerability GHSA-qwww-vcr4-c8h2 affects version 7.14.2 of react-router, and is fixed in 7.14.2-tuxcare.2."
    }
  ]
}