{
  "@id": "urn:uuid:c1648b57-84fa-4e0b-b343-0c2905fcdc6a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 45,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T02:51:11.781276+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 5.28.4 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-13T23:57:44.113762+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 5.28.4 of undici. not_affected \u2014 The upstream fix for CVE-2023-45143 (e041de35) is already in the target. On a cross-origin redirect, fetch now deletes the cookie and host headers along with authorization. The fix shipped in the upstream undici 5.28.4 release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for CVE-2023-45143 (e041de35) is already in the target. On a cross-origin redirect, fetch now deletes the cookie and host headers along with authorization. The fix shipped in the upstream undici 5.28.4 release that TuxCare onboarded."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-10-13T14:12:08.053071+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 does not affect version 5.28.4 of undici. not_affected \u2014 Target version undici 5.28.4 is NOT AFFECTED by CVE-2024-24750. The vulnerability only affects versions 6.0.0 through 6.6.0 (fixed in 6.6.1). The vulnerable code construct\u2014a ReadableStream wrapper with async start() that drains data in an unbounded while(true) loop ignoring backpressure\u2014was introduced in the 6.x rewrite and does not exist in the 5.x codebase. Version 5.28.4 uses a fundamentally...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "impact_statement": "not_affected \u2014 Target version undici 5.28.4 is NOT AFFECTED by CVE-2024-24750. The vulnerability only affects versions 6.0.0 through 6.6.0 (fixed in 6.6.1). The vulnerable code construct\u2014a ReadableStream wrapper with async start() that drains data in an unbounded while(true) loop ignoring backpressure\u2014was introduced in the 6.x rewrite and does not exist in the 5.x codebase. Version 5.28.4 uses a fundamentally..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-10-13T14:11:00.164254+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 5.28.4 of undici. not_affected \u2014 CVE-2024-24758: The target (undici 5.28.4) is NOT AFFECTED. The vulnerability concerning Proxy-Authorization header leakage on cross-origin redirects was fixed in upstream version 5.28.3. The target version 5.28.4 already contains the upstream fix (commit d3aa574b by Matteo Collina) which deletes the 'proxy-authorization' header during cross-origin redirects in the httpRedirectFetch function. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-24758: The target (undici 5.28.4) is NOT AFFECTED. The vulnerability concerning Proxy-Authorization header leakage on cross-origin redirects was fixed in upstream version 5.28.3. The target version 5.28.4 already contains the upstream fix (commit d3aa574b by Matteo Collina) which deletes the 'proxy-authorization' header during cross-origin redirects in the httpRedirectFetch function. T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-14T00:27:00.079854+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 does not affect version 5.28.4 of undici. not_affected \u2014 Undici 5.28.4 already contains the upstream fix for CVE-2024-30260. RedirectHandler strips authorization, proxy-authorization and cookie headers when a redirect changes origin, and this applies to undici.request() because the handler sits in the dispatch path. The fix came from upstream (Matteo Collina's merge 64e3402d, GHSA-m4v8-wqvr-p9f7) and is in the upstream release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "impact_statement": "not_affected \u2014 Undici 5.28.4 already contains the upstream fix for CVE-2024-30260. RedirectHandler strips authorization, proxy-authorization and cookie headers when a redirect changes origin, and this applies to undici.request() because the handler sits in the dispatch path. The fix came from upstream (Matteo Collina's merge 64e3402d, GHSA-m4v8-wqvr-p9f7) and is in the upstream release that TuxCare onboarded."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-13T23:33:00.074877+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 5.28.4 of undici. not_affected \u2014 The fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, upstream undici merge 2b39440b) is already in this 5.28.4 tree, which is the upstream release. The strict integrity parsing and comparison are in lib/fetch/util.js. The fix was authored upstream by Matteo Collina, not by TuxCare.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 The fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, upstream undici merge 2b39440b) is already in this 5.28.4 tree, which is the upstream release. The strict integrity parsing and comparison are in lib/fetch/util.js. The fix was authored upstream by Matteo Collina, not by TuxCare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "action_statement": "Vulnerability CVE-2025-22150 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "action_statement": "Vulnerability CVE-2025-47279 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-13T10:44:00.071355+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 5.28.4 of undici, and is fixed in 5.28.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 5.28.4 of undici, and is fixed in 5.28.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:06:00.064776+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 5.28.4 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T13:26:42.796685+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 does not affect version 5.28.4 of undici. not_affected \u2014 undici 5.28.4 is not affected. Its SRI parser (lib/fetch/util.js parseMetadata) matches the algorithm token with a case-insensitive regex and lowercases it before the supported-hash check. The 7.15.0 regression (a lowercase-only lookup of the raw token) is not present. I ran bytesMatch with sha256, SHA256 and Sha256 tokens. A matching body passed and a mismatched body failed in every case.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.4 is not affected. Its SRI parser (lib/fetch/util.js parseMetadata) matches the algorithm token with a case-insensitive regex and lowercases it before the supported-hash check. The 7.15.0 regression (a lowercase-only lookup of the raw token) is not present. I ran bytesMatch with sha256, SHA256 and Sha256 tokens. A matching body passed and a mismatched body failed in every case."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-14T02:51:11.781276+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 does not affect version 5.28.4 of undici. not_affected \u2014 Not affected. The CVE concerns WebSocket-over-HTTP/2 support added in undici 8.11.0. This target (undici 5.28.4-tuxcare.3) rejects upgrade requests over HTTP/2 before any stream is created, so a failed WebSocket handshake can never leave an orphaned ClientHttp2Stream.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "impact_statement": "not_affected \u2014 Not affected. The CVE concerns WebSocket-over-HTTP/2 support added in undici 8.11.0. This target (undici 5.28.4-tuxcare.3) rejects upgrade requests over HTTP/2 before any stream is created, so a failed WebSocket handshake can never leave an orphaned ClientHttp2Stream."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:31.171802+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 5.28.4 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T13:23:29.740738+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 does not affect version 5.28.4 of undici. not_affected \u2014 undici 5.28.4 contains no EventSource client and no Server-Sent Events parser, so the vulnerable component is absent. EventSource was first added in undici 6.x, and the CVE fixes are 6.29.1, 7.30.1 and 8.12.2. The repository is the same product as the advisory (undici) but an older line, so false_positive does not apply.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.4 contains no EventSource client and no Server-Sent Events parser, so the vulnerable component is absent. EventSource was first added in undici 6.x, and the CVE fixes are 6.29.1, 7.30.1 and 8.12.2. The repository is the same product as the advisory (undici) but an older line, so false_positive does not apply."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-13T10:44:00.071355+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 5.28.4 of undici, and is fixed in 5.28.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 5.28.4 of undici, and is fixed in 5.28.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "action_statement": "Vulnerability CVE-2026-11525 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 5.28.4 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T10:29:00.043711+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 does not affect version 5.28.4 of undici. not_affected \u2014 Not affected. The target is undici 5.28.4, which has no shared HTTP cache interceptor. The vulnerability needs the cache interceptor composed with the redirect interceptor, and that cache interceptor first appeared in undici 7.x. The CVE's affected ranges are 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "impact_statement": "not_affected \u2014 Not affected. The target is undici 5.28.4, which has no shared HTTP cache interceptor. The vulnerability needs the cache interceptor composed with the redirect interceptor, and that cache interceptor first appeared in undici 7.x. The CVE's affected ranges are 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T10:16:59.893945+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 does not affect version 5.28.4 of undici. not_affected \u2014 Target is undici 5.28.4. The CVE affects undici 7.0.0-7.30.1 and 8.0.0-8.12.3, where the cache interceptor was introduced. The 5.x tree has no cache interceptor, no cache handler or store, and no dump or decompress interceptors, so there is no replay path where a downstream handler's throw could escape.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "impact_statement": "not_affected \u2014 Target is undici 5.28.4. The CVE affects undici 7.0.0-7.30.1 and 8.0.0-8.12.3, where the cache interceptor was introduced. The 5.x tree has no cache interceptor, no cache handler or store, and no dump or decompress interceptors, so there is no replay path where a downstream handler's throw could escape."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T10:17:15.295484+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 does not affect version 5.28.4 of undici. not_affected \u2014 Target is undici 5.28.4, outside the affected ranges (7.0.0-7.30.1 and 8.0.0-8.12.3). The tuple-array header representation that triggers the bypass is not accepted in this version. Request construction rejects it with InvalidArgumentError before any redirect occurs. The cache and deduplicate interceptors that serialize retained headers do not exist here. Flat-array and object headers are strip...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "impact_statement": "not_affected \u2014 Target is undici 5.28.4, outside the affected ranges (7.0.0-7.30.1 and 8.0.0-8.12.3). The tuple-array header representation that triggers the bypass is not accepted in this version. Request construction rejects it with InvalidArgumentError before any redirect occurs. The cache and deduplicate interceptors that serialize retained headers do not exist here. Flat-array and object headers are strip..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T10:18:00.081064+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 does not affect version 5.28.4 of undici. not_affected \u2014 undici 5.28.4 is outside the CVE's affected ranges (7.15.0-7.30.1, 8.0.0-8.12.3). It still has the metadata.split(' ') pattern, but the hash-with-options regex is unanchored, so whitespace-prefixed tokens still parse and are checked. Tab-padded SRI values do not cause the integrity check to be skipped.",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.4 is outside the CVE's affected ranges (7.15.0-7.30.1, 8.0.0-8.12.3). It still has the metadata.split(' ') pattern, but the hash-with-options regex is unanchored, so whitespace-prefixed tokens still parse and are checked. Tab-padded SRI values do not cause the integrity check to be skipped."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T10:16:00.033790+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 does not affect version 5.28.4 of undici. not_affected \u2014 Target is undici 5.28.4. It has a redirect interceptor but no HTTP response-cache interceptor or shared response cache, which arrived in undici 7.x. Nothing stores the final response of a redirected request under the original request's key, so the CVE-2026-120474 chain cannot form. The vulnerable combination of the redirect interceptor and a shared response cache is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "impact_statement": "not_affected \u2014 Target is undici 5.28.4. It has a redirect interceptor but no HTTP response-cache interceptor or shared response cache, which arrived in undici 7.x. Nothing stores the final response of a redirected request under the original request's key, so the CVE-2026-120474 chain cannot form. The vulnerable combination of the redirect interceptor and a shared response cache is not present."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "action_statement": "Vulnerability CVE-2026-12151 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:03.785272+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "action_statement": "Vulnerability CVE-2026-13697 affects version 5.28.4 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T12:13:00.050272+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 does not affect version 5.28.4 of undici. not_affected \u2014 Target is undici 5.28.4, which has no HTTP cache interceptor and no Cache-Control directive parser. The CVE concerns the cache interceptor added in undici 7.x/8.x (interceptors.cache(), shared-cache mode). The product matches, but the affected component does not exist in this version, so the verdict is not_affected (Type A1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "impact_statement": "not_affected \u2014 Target is undici 5.28.4, which has no HTTP cache interceptor and no Cache-Control directive parser. The CVE concerns the cache interceptor added in undici 7.x/8.x (interceptors.cache(), shared-cache mode). The product matches, but the affected component does not exist in this version, so the verdict is not_affected (Type A1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "action_statement": "Vulnerability CVE-2026-15157 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "action_statement": "Vulnerability CVE-2026-1525 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "action_statement": "Vulnerability CVE-2026-1527 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "action_statement": "Vulnerability CVE-2026-1528 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "action_statement": "Vulnerability CVE-2026-16728 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "action_statement": "Vulnerability CVE-2026-16729 affects version 5.28.4 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T13:16:51.263433+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 does not affect version 5.28.4 of undici. not_affected \u2014 undici 5.28.4 (lib/handler/RetryHandler.js) is not affected by CVE-2026-18149. The upstream flaw is in the 7.x/8.x retry-handler, which forwards a non-retryable replacement response through onResponseStart after an earlier response was already exposed, orphaning the original body. The 5.x RetryHandler has no such forwarding path. Any response with status >= 300 is aborted with a RequestRetryErr...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.4 (lib/handler/RetryHandler.js) is not affected by CVE-2026-18149. The upstream flaw is in the 7.x/8.x retry-handler, which forwards a non-retryable replacement response through onResponseStart after an earlier response was already exposed, orphaning the original body. The 5.x RetryHandler has no such forwarding path. Any response with status >= 300 is aborted with a RequestRetryErr..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-13T16:53:00.054763+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 affects version 5.28.4 of undici, and is fixed in 5.28.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "action_statement": "Vulnerability CVE-2026-18540 affects version 5.28.4 of undici, and is fixed in 5.28.4-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:31.171802+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "action_statement": "Vulnerability CVE-2026-19534 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "action_statement": "Vulnerability CVE-2026-22036 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 5.28.4 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-14T01:34:28.431620+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 does not affect version 5.28.4 of undici. not_affected \u2014 The target is undici 5.28.4-tuxcare.3. It has no `interceptors.deduplicate()` and no deduplication handler, so the code CVE-2026-2581 fixes does not exist here. Nothing in the repo coalesces identical concurrent requests and buffers response bodies for other consumers. I could not fetch the upstream patch (only a URL was given), so the patch brief comes from the CVE's description of the patch.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "impact_statement": "not_affected \u2014 The target is undici 5.28.4-tuxcare.3. It has no `interceptors.deduplicate()` and no deduplication handler, so the code CVE-2026-2581 fixes does not exist here. Nothing in the repo coalesces identical concurrent requests and buffers response bodies for other consumers. I could not fetch the upstream patch (only a URL was given), so the patch brief comes from the CVE's description of the patch."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "action_statement": "Vulnerability CVE-2026-6733 affects version 5.28.4 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:03.785272+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "action_statement": "Vulnerability CVE-2026-6734 affects version 5.28.4 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T13:03:28.653511+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 does not affect version 5.28.4 of undici. not_affected \u2014 undici 5.28.4 has no `interceptors.decompress()` interceptor. The CVE and its fix (`maxSize` option on that interceptor) apply only to that component, which was added in later 7.x/8.x lines. The only decompression code here is fetch's own content-decoding in lib/fetch/index.js, which is outside the CVE and patch scope.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.4 has no `interceptors.decompress()` interceptor. The CVE and its fix (`maxSize` option on that interceptor) apply only to that component, which was added in later 7.x/8.x lines. The only decompression code here is fetch's own content-decoding in lib/fetch/index.js, which is outside the CVE and patch scope."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T13:05:00.204353+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 does not affect version 5.28.4 of undici. not_affected \u2014 undici 5.28.4 has no HTTP cache interceptor (`interceptors.cache()`), no shared/private cache type, and no HTTP response cache store. The vulnerable component, which stores a cacheable Set-Cookie response and re-serves it to other callers, does not exist in this tree. The only cache code is the script-driven Web Cache API (lib/cache), which is not a shared HTTP cache.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.4 has no HTTP cache interceptor (`interceptors.cache()`), no shared/private cache type, and no HTTP response cache store. The vulnerable component, which stores a cacheable Set-Cookie response and re-serves it to other callers, does not exist in this tree. The only cache code is the script-driven Web Cache API (lib/cache), which is not a shared HTTP cache."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T12:52:00.028717+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 does not affect version 5.28.4 of undici. not_affected \u2014 undici 5.28.4 has no `interceptors.dump()` / dump interceptor, so the vulnerable component of CVE-2026-84947 is absent from this version. The patch could not be read (URLs only), so this relies on the CVE text and its description of the fix. The repo is the undici project (same product), but only an older line (5.x) that predates the dump interceptor.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.4 has no `interceptors.dump()` / dump interceptor, so the vulnerable component of CVE-2026-84947 is absent from this version. The patch could not be read (URLs only), so this relies on the CVE text and its description of the fix. The repo is the undici project (same product), but only an older line (5.x) that predates the dump interceptor."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:03.785272+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "action_statement": "Vulnerability CVE-2026-84961 affects version 5.28.4 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T12:58:53.206755+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 does not affect version 5.28.4 of undici. not_affected \u2014 undici 5.28.4 has no HTTP cache interceptor (`interceptors.cache()`), so the CVE-2026-85008 flaw cannot occur. The repo's only interceptor is the redirect interceptor. `lib/cache/` is the WHATWG Cache API (CacheStorage), a different component, and it already rejects non-GET methods.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.4 has no HTTP cache interceptor (`interceptors.cache()`), so the CVE-2026-85008 flaw cannot occur. The repo's only interceptor is the redirect interceptor. `lib/cache/` is the WHATWG Cache API (CacheStorage), a different component, and it already rejects non-GET methods."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T12:45:22.374815+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 does not affect version 5.28.4 of undici. not_affected \u2014 The target is undici 5.28.4. It has no WebSocketStream implementation, which first appeared in undici 7.0.0. The vulnerable unclean-close handler that aborts a locked writable stream does not exist in this tree, so the target is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "impact_statement": "not_affected \u2014 The target is undici 5.28.4. It has no WebSocketStream implementation, which first appeared in undici 7.0.0. The vulnerable unclean-close handler that aborts a locked writable stream does not exist in this tree, so the target is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-14T02:15:39.406188+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 does not affect version 5.28.4 of undici. not_affected \u2014 undici 5.28.4-tuxcare.3 has no permessage-deflate support in its WebSocket client. lib/web/websocket/permessage-deflate.js does not exist in this tree, and nothing under lib/websocket uses zlib or any InflateRaw stream. The vulnerable cleanup (removeAllListeners() on an InflateRaw) is absent. The Goal (process crash from an unobserved error on an internal decompression stream) is therefore unre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.4-tuxcare.3 has no permessage-deflate support in its WebSocket client. lib/web/websocket/permessage-deflate.js does not exist in this tree, and nothing under lib/websocket uses zlib or any InflateRaw stream. The vulnerable cleanup (removeAllListeners() on an InflateRaw) is absent. The Goal (process crash from an unobserved error on an internal decompression stream) is therefore unre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-14T02:30:15.142850+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 does not affect version 5.28.4 of undici. not_affected \u2014 Target is undici 5.28.4-tuxcare.3. The `interceptors.cache()` and `interceptors.deduplicate()` interceptors, which were added in 8.10.0, do not exist in this tree, so the cross-origin cache-key flaw cannot occur. The only cache code is the fetch Cache API (CacheStorage), a different component.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "impact_statement": "not_affected \u2014 Target is undici 5.28.4-tuxcare.3. The `interceptors.cache()` and `interceptors.deduplicate()` interceptors, which were added in 8.10.0, do not exist in this tree, so the cross-origin cache-key flaw cannot occur. The only cache code is the fetch Cache API (CacheStorage), a different component."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-13T10:44:00.071355+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 5.28.4 of undici, and is fixed in 5.28.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 5.28.4 of undici, and is fixed in 5.28.4-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T13:33:00.064476+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 does not affect version 5.28.4 of undici. not_affected \u2014 undici 5.28.4 has no `decompress` interceptor and no `dump` interceptor, so the vulnerable code does not exist here. Its only zlib use is the fetch() body decoder, a stream pipeline with no handler callbacks that forward data from zlib events. Not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.4 has no `decompress` interceptor and no `dump` interceptor, so the vulnerable code does not exist here. Its only zlib use is the fetch() body decoder, a stream pipeline with no handler callbacks that forward data from zlib events. Not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-14T01:57:58.189171+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 does not affect version 5.28.4 of undici. not_affected \u2014 undici 5.28.4-tuxcare.3 has no WebSocket maxPayloadSize option at all. CVE-2026-9675 is a bug in that 8.1.0 feature: the per-frame limit was enforced but the cumulative size of fragments was not. The CVE says the 7.x line, which never had the option, is unaffected, and 5.28.4 is in the same position. The vulnerable code (a per-frame limit missing its cumulative counterpart) is not present. Cave...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.4-tuxcare.3 has no WebSocket maxPayloadSize option at all. CVE-2026-9675 is a bug in that 8.1.0 feature: the per-frame limit was enforced but the cumulative size of fragments was not. The CVE says the 7.x line, which never had the option, is unaffected, and 5.28.4 is in the same position. The vulnerable code (a per-frame limit missing its cumulative counterpart) is not present. Cave..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-06T12:28:55.213155+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 does not affect version 5.28.4 of undici. not_affected \u2014 undici 5.28.4 has no HTTP cache interceptor (interceptors.cache()) and no code that parses response Cache-Control directives for a shared cache. The vulnerable component, the cache-control parser and cache store/interceptor added in undici 7.x/8.x, is not in this tree, so this version is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.4 has no HTTP cache interceptor (interceptors.cache()) and no code that parses response Cache-Control directives for a shared cache. The vulnerable component, the cache-control parser and cache store/interceptor added in undici 7.x/8.x, is not in this tree, so this version is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-10-13T14:15:48.189419+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 does not affect version 5.28.4 of undici. not_affected \u2014 Target version 5.28.4 does not contain the vulnerable percent-decoding code pattern described in CVE-2026-9679. The vulnerability was introduced in undici 7.0.0 when `qsUnescape` was added to decode cookie values. Version 5.28.4 predates this introduction and returns cookie values as-is without any percent-decoding (lib/cookies/parse.js:80), preventing HTTP header injection even when applicatio...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "impact_statement": "not_affected \u2014 Target version 5.28.4 does not contain the vulnerable percent-decoding code pattern described in CVE-2026-9679. The vulnerability was introduced in undici 7.0.0 when `qsUnescape` was added to decode cookie values. Version 5.28.4 predates this introduction and returns cookie values as-is without any percent-decoding (lib/cookies/parse.js:80), preventing HTTP header injection even when applicatio..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:04:00.091712+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 affects version 5.28.4 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "action_statement": "Vulnerability CVE-2026-9697 affects version 5.28.4 of undici."
    }
  ]
}