{ "@id": "urn:uuid:3dfe7895-9e61-40ca-86d6-235efa9598ae", "role": "Document Creator", "author": "https://tuxcare.com", "version": 47, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:52:39.198546+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45143 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2023-45143" }, "action_statement": "Vulnerability CVE-2023-45143 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24758 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2024-24758" }, "action_statement": "Vulnerability CVE-2024-24758 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30260 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2024-30260" }, "action_statement": "Vulnerability CVE-2024-30260 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30261 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2024-30261" }, "action_statement": "Vulnerability CVE-2024-30261 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-22150 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2025-22150" }, "action_statement": "Vulnerability CVE-2025-22150 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47279 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2025-47279" }, "action_statement": "Vulnerability CVE-2025-47279 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-10-15T18:43:00.151252+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 5.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T21:13:33.323397+00:00", "status_notes": "Vulnerability CVE-2026-109829 does not affect version 5.23.0 of undici. not_affected \u2014 The target is undici 5.23.0. It predates the HTTP cache interceptor, which was introduced in undici 7.0.0, so the cache-key confusion after a redirect cannot occur. Its only interceptor is the redirect interceptor. The only cache code is the unrelated Cache Storage API. It is the same product as the advisory, so this is not a false positive.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109829" }, "impact_statement": "not_affected \u2014 The target is undici 5.23.0. It predates the HTTP cache interceptor, which was introduced in undici 7.0.0, so the cache-key confusion after a redirect cannot occur. Its only interceptor is the redirect interceptor. The only cache code is the unrelated Cache Storage API. It is the same product as the advisory, so this is not a false positive." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T21:17:00.039866+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 is not affected. The case-sensitive SRI algorithm lookup that causes CVE-2026-109841 was introduced in 7.15.0 and is not in this code. parseMetadata() here matches the token case-insensitively and checks supportedHashes against algorithm.toLowerCase(), so uppercase and mixed-case tokens are kept and verified rather than skipped. Mismatched bodies are rejected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 undici 5.23.0 is not affected. The case-sensitive SRI algorithm lookup that causes CVE-2026-109841 was introduced in 7.15.0 and is not in this code. parseMetadata() here matches the token case-insensitively and checks supportedHashes against algorithm.toLowerCase(), so uppercase and mixed-case tokens are kept and verified rather than skipped. Mismatched bodies are rejected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-14T02:52:39.198546+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 5.23.0 of undici. not_affected \u2014 Target is undici 5.23.0. The CVE concerns a regression introduced in undici 8.11.0 (affects 8.11.0 and 8.11.1), in the WebSocket-over-HTTP/2 path. The 5.23.0 tree contains no HTTP/2 code at all, so the vulnerable chain cannot exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 5.23.0. The CVE concerns a regression introduced in undici 8.11.0 (affects 8.11.0 and 8.11.1), in the WebSocket-over-HTTP/2 path. The 5.23.0 tree contains no HTTP/2 code at all, so the vulnerable chain cannot exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T21:09:51.991863+00:00", "status_notes": "Vulnerability CVE-2026-109869 does not affect version 5.23.0 of undici. not_affected \u2014 Target is undici 5.23.0, which has no content-encoding chain limit and no reject path for responses with too many codings. The body stream always has an error handler (a pipeline callback or an explicit on('error') listener), and onError destroys the stream. So no unhandled 'error' event can surface on an orphaned stream. The vulnerable pattern from the CVE (6.x/7.x/8.x) is not present.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109869" }, "impact_statement": "not_affected \u2014 Target is undici 5.23.0, which has no content-encoding chain limit and no reject path for responses with too many codings. The body stream always has an error handler (a pipeline callback or an explicit on('error') listener), and onError destroys the stream. So no unhandled 'error' event can surface on an orphaned stream. The vulnerable pattern from the CVE (6.x/7.x/8.x) is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T21:12:00.068117+00:00", "status_notes": "Vulnerability CVE-2026-109924 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 has no EventSource implementation, so the vulnerable SSE parser is absent. The target is the same product (undici) but an older release that predates EventSource. Verdict is not_affected (Type A1, input absent).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109924" }, "impact_statement": "not_affected \u2014 undici 5.23.0 has no EventSource implementation, so the vulnerable SSE parser is absent. The target is the same product (undici) but an older release that predates EventSource. Verdict is not_affected (Type A1, input absent)." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 5.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T21:25:00.839887+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 has no shared HTTP cache interceptor and no conditional-revalidation logic. The CVE only affects 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3, where a cache interceptor composed with the redirect interceptor lets a 304 from a different origin revalidate a stored response. That chain cannot exist here.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 undici 5.23.0 has no shared HTTP cache interceptor and no conditional-revalidation logic. The CVE only affects 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3, where a cache interceptor composed with the redirect interceptor lets a 304 from a different origin revalidate a stored response. That chain cannot exist here." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T21:21:48.734291+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 predates the cache, dump and decompress interceptors (added in 7.x), so the vulnerable replay path does not exist. The only interceptor shipped is the redirect interceptor. fetch has no HTTP cache or revalidation. The patch commits are upstream commits for the 7.x/8.x interceptor code. They don't apply to this tree.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 undici 5.23.0 predates the cache, dump and decompress interceptors (added in 7.x), so the vulnerable replay path does not exist. The only interceptor shipped is the redirect interceptor. fetch has no HTTP cache or revalidation. The patch commits are upstream commits for the 7.x/8.x interceptor code. They don't apply to this tree." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T21:23:15.305445+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 5.23.0 of undici. not_affected \u2014 Target is undici 5.23.0, far below the affected ranges (7.0.0-7.30.1, 8.0.0-8.12.3). Tuple-form request headers cannot reach the cross-origin redirect path here. RedirectHandler.cleanRequestHeaders only understands flat name/value arrays or plain objects, and the Request constructor rejects tuple-form headers before any request is sent, so no redirect can occur. The cache and deduplicate interc...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 Target is undici 5.23.0, far below the affected ranges (7.0.0-7.30.1, 8.0.0-8.12.3). Tuple-form request headers cannot reach the cross-origin redirect path here. RedirectHandler.cleanRequestHeaders only understands flat name/value arrays or plain objects, and the Request constructor rejects tuple-form headers before any request is sent, so no redirect can occur. The cache and deduplicate interc..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T21:24:42.697192+00:00", "status_notes": "Vulnerability CVE-2026-120423 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 splits integrity metadata on ' ' (lib/fetch/util.js:595), the same flaw the CVE describes. In this version the per-token regex (line 578) is unanchored, so a digest preceded by a tab or newline is still recognized. Merged tab-joined tokens produce a hash group that cannot match the real digest, so the check fails closed. A body that differs from the pinned digest was never accepte...", "vulnerability": { "name": "CVE-2026-120423" }, "impact_statement": "not_affected \u2014 undici 5.23.0 splits integrity metadata on ' ' (lib/fetch/util.js:595), the same flaw the CVE describes. In this version the per-token regex (line 578) is unanchored, so a digest preceded by a tab or newline is still recognized. Merged tab-joined tokens produce a hash group that cannot match the real digest, so the check fails closed. A body that differs from the pinned digest was never accepte..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T21:20:59.401455+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 5.23.0 of undici. not_affected \u2014 Target is undici 5.23.0 (HEAD c91449ac). The CVE affects 7.0.0-7.30.1 and 8.0.0-8.12.3, where a dispatcher-level HTTP response-cache interceptor is combined with the redirect interceptor. The 5.23.0 tree has no such response-cache interceptor or shared response store, so the credentialed-redirect-to-cache chain cannot occur. The patches were not readable (URLs only), so the Brief was inferred f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 Target is undici 5.23.0 (HEAD c91449ac). The CVE affects 7.0.0-7.30.1 and 8.0.0-8.12.3, where a dispatcher-level HTTP response-cache interceptor is combined with the redirect interceptor. The 5.23.0 tree has no such response-cache interceptor or shared response store, so the credentialed-redirect-to-cache chain cannot occur. The patches were not readable (URLs only), so the Brief was inferred f..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 5.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T20:08:00.042663+00:00", "status_notes": "Vulnerability CVE-2026-13697 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 has no cache interceptor and no Cache-Control response parser (lib/util/cache.js is absent). The vulnerable code, which was added in later major versions, is not present, so the CVE does not apply.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-13697" }, "impact_statement": "not_affected \u2014 undici 5.23.0 has no cache interceptor and no Cache-Control response parser (lib/util/cache.js is absent). The vulnerable code, which was added in later major versions, is not present, so the CVE does not apply." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T20:07:00.106745+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 has no HTTP cache interceptor and no Cache-Control response parsing. The only cache code is the Web Cache API (CacheStorage), which is script-driven. The vulnerable parser for qualified no-cache/private directives and the shared-cache store decision do not exist in this version. Same product lineage as the CVE, so this is not a false_positive. Type A1.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 undici 5.23.0 has no HTTP cache interceptor and no Cache-Control response parsing. The only cache code is the Web Cache API (CacheStorage), which is script-driven. The vulnerable parser for qualified no-cache/private directives and the shared-cache store decision do not exist in this version. Same product lineage as the CVE, so this is not a false_positive. Type A1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1525 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2026-1525" }, "action_statement": "Vulnerability CVE-2026-1525 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1527 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2026-1527" }, "action_statement": "Vulnerability CVE-2026-1527 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1528 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2026-1528" }, "action_statement": "Vulnerability CVE-2026-1528 affects version 5.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T20:03:00.065439+00:00", "status_notes": "Vulnerability CVE-2026-16728 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 has no retry interceptor or retry/resume handler at all. The CVE concerns interceptors.retry() (fixed in 6.28.0, 7.29.0 and 8.9.0), which resumes a partial 206 response and delivers stale Content-Length headers. That component was introduced in later releases and is absent here. The repo is the same product (undici), so this is not a false_positive, but no input-to-goal chain exists.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16728" }, "impact_statement": "not_affected \u2014 undici 5.23.0 has no retry interceptor or retry/resume handler at all. The CVE concerns interceptors.retry() (fixed in 6.28.0, 7.29.0 and 8.9.0), which resumes a partial 206 response and delivers stale Content-Length headers. That component was introduced in later releases and is absent here. The repo is the same product (undici), so this is not a false_positive, but no input-to-goal chain exists." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 5.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T20:54:00.045132+00:00", "status_notes": "Vulnerability CVE-2026-18149 does not affect version 5.23.0 of undici. not_affected \u2014 The target is undici 5.23.0, which has no RetryHandler and no response-retry layer. The flaw is in a component that was added later, so the target is not affected (Type A1, input chain absent). I could not read the patch diffs, because only URLs were provided and remote access is not allowed. The conclusion rests on the CVE text and a search of the target tree.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-18149" }, "impact_statement": "not_affected \u2014 The target is undici 5.23.0, which has no RetryHandler and no response-retry layer. The flaw is in a component that was added later, so the target is not affected (Type A1, input chain absent). I could not read the patch diffs, because only URLs were provided and remote access is not allowed. The conclusion rests on the CVE text and a search of the target tree." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T20:58:00.045389+00:00", "status_notes": "Vulnerability CVE-2026-18540 does not affect version 5.23.0 of undici. not_affected \u2014 Target is undici 5.23.0 (c91449ac). It has no retry interceptor or retry handler, and no code that resumes a partially delivered response with a Range request. The flaw (resumed bytes appended to an earlier partial response) has no code to live in. The TuxCare fixes for CVE-2026-18540 exist only on other version branches (5.28.4, 7.24.8) and are not in HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-18540" }, "impact_statement": "not_affected \u2014 Target is undici 5.23.0 (c91449ac). It has no retry interceptor or retry handler, and no code that resumes a partially delivered response with a Range request. The flaw (resumed bytes appended to an earlier partial response) has no code to live in. The TuxCare fixes for CVE-2026-18540 exist only on other version branches (5.28.4, 7.24.8) and are not in HEAD." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T21:09:00.036652+00:00", "status_notes": "Vulnerability CVE-2026-19534 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 receives a 101 response carrying an unrequested Sec-WebSocket-Protocol header, but it fails the connection through the error-event path and does not throw. CVE-2026-19534 affects 6.7.0 and later, and the crashing code is not present in 5.23.0. A live repro against the target, with a stub for the missing busboy dependency kept outside the repo, got an 'error' event (\"Protocol was n...", "vulnerability": { "name": "CVE-2026-19534" }, "impact_statement": "not_affected \u2014 undici 5.23.0 receives a 101 response carrying an unrequested Sec-WebSocket-Protocol header, but it fails the connection through the error-event path and does not throw. CVE-2026-19534 affects 6.7.0 and later, and the crashing code is not present in 5.23.0. A live repro against the target, with a stub for the missing busboy dependency kept outside the repo, got an 'error' event (\"Protocol was n..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22036 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2026-22036" }, "action_statement": "Vulnerability CVE-2026-22036 affects version 5.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 5.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-14T01:25:13.546710+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 5.23.0 of undici. not_affected \u2014 Target is undici 5.23.0, the same product as the advisory. It has no deduplication interceptor and no interceptors API, so the vulnerable component (interceptors.deduplicate(), which fans one upstream response out to several identical in-flight requests) does not exist. It cannot buffer response bodies for deduplicated requests.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 Target is undici 5.23.0, the same product as the advisory. It has no deduplication interceptor and no interceptors API, so the vulnerable component (interceptors.deduplicate(), which fans one upstream response out to several identical in-flight requests) does not exist. It cannot buffer response bodies for deduplicated requests." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 5.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T20:09:00.046186+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 5.23.0 of undici. not_affected \u2014 Target is undici 5.23.0. CVE-2026-6734 affects Socks5ProxyAgent, which was added in undici 7.23.0 (PR #4385). That class and any SOCKS5 support are absent from this tree. The only proxy dispatcher, ProxyAgent, builds on Agent, which keeps one pool per origin, so the cross-origin pool reuse flaw cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Target is undici 5.23.0. CVE-2026-6734 affects Socks5ProxyAgent, which was added in undici 7.23.0 (PR #4385). That class and any SOCKS5 support are absent from this tree. The only proxy dispatcher, ProxyAgent, builds on Agent, which keeps one pool per origin, so the cross-origin pool reuse flaw cannot occur." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T20:49:00.046850+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 has no `interceptors.decompress()` interceptor, which is the only component CVE-2026-84890 concerns. The advisory's fixed versions (7.29.1 and 8.10.2) add a `maxSize` option to that interceptor, so there is no equivalent code here to patch. The product is the same (undici), so this is not a false positive. The only decompression code is the built-in fetch path, which is a separate...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 undici 5.23.0 has no `interceptors.decompress()` interceptor, which is the only component CVE-2026-84890 concerns. The advisory's fixed versions (7.29.1 and 8.10.2) add a `maxSize` option to that interceptor, so there is no equivalent code here to patch. The product is the same (undici), so this is not a false positive. The only decompression code is the built-in fetch path, which is a separate..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T20:42:57.564309+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 has no HTTP caching interceptor. The `interceptors.cache()` shared-cache feature, where the CVE's Set-Cookie flaw lives, does not exist in this version. The only cache code is the WHATWG Cache API (lib/cache), which is explicitly app-driven and does no Cache-Control/shared-cache re-serving. Product is the same (undici), so this is not a false positive. The CVE's affected component...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 undici 5.23.0 has no HTTP caching interceptor. The `interceptors.cache()` shared-cache feature, where the CVE's Set-Cookie flaw lives, does not exist in this version. The only cache code is the WHATWG Cache API (lib/cache), which is explicitly app-driven and does no Cache-Control/shared-cache re-serving. Product is the same (undici), so this is not a false positive. The CVE's affected component..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T20:23:00.106689+00:00", "status_notes": "Vulnerability CVE-2026-84947 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 has no dump interceptor, which is the component CVE-2026-84947 concerns. The repo is the same product (undici) but a much older version. lib/interceptor/ holds only redirectInterceptor.js, and index.js exports no `interceptors.dump`. The only \"dump\" code is BodyReadable.dump(), which has a different role and does not return a truncated 200 response.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84947" }, "impact_statement": "not_affected \u2014 undici 5.23.0 has no dump interceptor, which is the component CVE-2026-84947 concerns. The repo is the same product (undici) but a much older version. lib/interceptor/ holds only redirectInterceptor.js, and index.js exports no `interceptors.dump`. The only \"dump\" code is BodyReadable.dump(), which has a different role and does not return a truncated 200 response." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T20:36:00.072688+00:00", "status_notes": "Vulnerability CVE-2026-84961 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 BalancedPool does not JSON-clone its options. It forwards them to each upstream Pool with a shallow Object.assign, so function-valued connect/tls options (custom checkServerIdentity or connector) are preserved. Pool destructures connect/tls before its own deepClone. The vulnerable chain from the CVE does not exist in this version.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-84961" }, "impact_statement": "not_affected \u2014 undici 5.23.0 BalancedPool does not JSON-clone its options. It forwards them to each upstream Pool with a shallow Object.assign, so function-valued connect/tls options (custom checkServerIdentity or connector) are preserved. Pool destructures connect/tls before its own deepClone. The vulnerable chain from the CVE does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T20:33:00.084290+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 5.23.0 of undici. not_affected \u2014 Target is undici 5.23.0, which has no HTTP cache interceptor (interceptors.cache(), cache store or canCacheResponse). That feature was added in the 7.x line. The CVE's vulnerable component is absent, so the Brief's Input cannot reach the Goal. The Product-Identity Check matched (same product, older version), so this is not a false_positive.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 Target is undici 5.23.0, which has no HTTP cache interceptor (interceptors.cache(), cache store or canCacheResponse). That feature was added in the 7.x line. The CVE's vulnerable component is absent, so the Brief's Input cannot reach the Goal. The Product-Identity Check matched (same product, older version), so this is not a false_positive." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T20:18:00.067289+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 5.23.0 of undici. not_affected \u2014 Target is undici 5.23.0. It has no WebSocketStream API; that API was introduced in 7.0.0. The classic WebSocket implementation in lib/websocket has no writable-stream abort path in its close handling, so the CVE's crash chain cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 Target is undici 5.23.0. It has no WebSocketStream API; that API was introduced in 7.0.0. The classic WebSocket implementation in lib/websocket has no writable-stream abort path in its close handling, so the CVE's crash chain cannot occur." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-14T02:13:58.919555+00:00", "status_notes": "Vulnerability CVE-2026-85024 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 does not implement permessage-deflate. There is no lib/web/websocket/permessage-deflate.js and no zlib InflateRaw in the WebSocket code. The extension is never offered, and a server response that names any extension fails the connection. The vulnerable chain does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85024" }, "impact_statement": "not_affected \u2014 undici 5.23.0 does not implement permessage-deflate. There is no lib/web/websocket/permessage-deflate.js and no zlib InflateRaw in the WebSocket code. The extension is never offered, and a server response that names any extension fails the connection. The vulnerable chain does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-14T02:28:42.740195+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 5.23.0 of undici. not_affected \u2014 Target is undici 5.23.0. The CVE affects only undici 8.10.0 and 8.10.1, in the `interceptors.cache()` and `interceptors.deduplicate()` APIs. Those APIs do not exist in this tree. The only interceptor it ships is `redirectInterceptor`. The vulnerable cache and deduplication key construction is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 5.23.0. The CVE affects only undici 8.10.0 and 8.10.1, in the `interceptors.cache()` and `interceptors.deduplicate()` APIs. Those APIs do not exist in this tree. The only interceptor it ships is `redirectInterceptor`. The vulnerable cache and deduplication key construction is absent." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-10-15T18:47:21.529900+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 5.23.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 5.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T21:19:00.470464+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 has no `decompress` interceptor and no `dump` interceptor. The vulnerable component, which forwards decompressed data to a downstream handler from zlib stream callbacks, does not exist in this version. The only interceptor shipped is redirectInterceptor.js. The patch and CVE only apply to the 7.x and 8.x lines.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 undici 5.23.0 has no `decompress` interceptor and no `dump` interceptor. The vulnerable component, which forwards decompressed data to a downstream handler from zlib stream callbacks, does not exist in this version. The only interceptor shipped is redirectInterceptor.js. The patch and CVE only apply to the 7.x and 8.x lines." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-14T01:54:00.066706+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 5.23.0 of undici. not_affected \u2014 Target is undici 5.23.0. CVE-2026-9675 is a regression in the maxPayloadSize feature that first shipped in undici 8.1.0: the per-frame check was enforced but the cumulative check across fragments was not. 5.23.0 has no maxPayloadSize option and no cumulative-size check, so the regression is absent. Per the advisory, lines without the feature (7.x) are unaffected. The patch contents were not pro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 Target is undici 5.23.0. CVE-2026-9675 is a regression in the maxPayloadSize feature that first shipped in undici 8.1.0: the per-frame check was enforced but the cumulative check across fragments was not. 5.23.0 has no maxPayloadSize option and no cumulative-size check, so the regression is absent. Per the advisory, lines without the feature (7.x) are unaffected. The patch contents were not pro..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T20:10:29.841377+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 has no HTTP cache interceptor (interceptors.cache()), no shared-cache mode and no response Cache-Control parser. The CVE-2026-9678 flaw cannot occur. The only cache code is the Web Cache API in lib/cache, which stores only what script explicitly puts and does not evaluate private/no-cache directives.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 undici 5.23.0 has no HTTP cache interceptor (interceptors.cache()), no shared-cache mode and no response Cache-Control parser. The CVE-2026-9678 flaw cannot occur. The only cache code is the Web Cache API in lib/cache, which stores only what script explicitly puts and does not evaluate private/no-cache directives." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T20:01:00.036985+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 5.23.0 of undici. not_affected \u2014 undici 5.23.0 does not percent-decode cookie values. The CVE says the flaw (qsUnescape in parseSetCookie) was introduced in 7.0.0 via PR #3789. In this target, parseSetCookie and getCookies return values verbatim, so encoded sequences like %0D%0A stay as inert literal text.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 undici 5.23.0 does not percent-decode cookie values. The CVE says the flaw (qsUnescape in parseSetCookie) was introduced in 7.0.0 via PR #3789. In this target, parseSetCookie and getCookies return values verbatim, so encoded sequences like %0D%0A stay as inert literal text." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.23.0", "identifiers": { "purl": "pkg:npm/undici@5.23.0" } } ], "timestamp": "2026-11-13T20:13:00.036418+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 5.23.0 of undici. not_affected \u2014 Target is undici 5.23.0. SOCKS5 support (Socks5ProxyAgent and socks5:// handling in ProxyAgent) was added in undici 7.23.0, and no SOCKS code exists anywhere in this repo. The CVE's SOCKS5 path that drops requestTls is therefore absent. The only proxy path is the HTTP CONNECT tunnel, which forwards requestTls to the destination TLS connector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 Target is undici 5.23.0. SOCKS5 support (Socks5ProxyAgent and socks5:// handling in ProxyAgent) was added in undici 7.23.0, and no SOCKS code exists anywhere in this repo. The CVE's SOCKS5 path that drops requestTls is therefore absent. The only proxy path is the HTTP CONNECT tunnel, which forwards requestTls to the destination TLS connector." } ] }