{
  "@id": "urn:uuid:4d311090-873c-4019-8537-b5b2c5617888",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 39,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T02:54:11.763221+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability AIKIDO-2024-10065 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.1.",
      "vulnerability": {
        "name": "AIKIDO-2024-10065"
      },
      "action_statement": "Vulnerability AIKIDO-2024-10065 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 5.28.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 5.28.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 5.28.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 5.28.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 5.28.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 5.28.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 5.28.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-13T23:58:04.151997+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 5.28.5 of undici. not_affected \u2014 The target (undici 5.28.5) already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, httpRedirectFetch in lib/fetch/index.js deletes authorization, proxy-authorization, cookie and host from the request header list. The fix is upstream commit e041de35, which was in the upstream release before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 The target (undici 5.28.5) already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, httpRedirectFetch in lib/fetch/index.js deletes authorization, proxy-authorization, cookie and host from the request header list. The fix is upstream commit e041de35, which was in the upstream release before the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 does not affect version 5.28.5 of undici. not_affected \u2014 Target version 5.28.5-tuxcare.5 is NOT AFFECTED by CVE-2024-24750. The GitHub Security Advisory (GHSA-9f24-jqhm-jfcw) explicitly states the vulnerable version range is >= 6.0.0 <= 6.6.0. The target version 5.28.5 predates the introduction of the vulnerable code. The vulnerable byteStream with async start callback that eagerly reads all response data was introduced in version 6.0.0 (commit af9aa...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "impact_statement": "not_affected \u2014 Target version 5.28.5-tuxcare.5 is NOT AFFECTED by CVE-2024-24750. The GitHub Security Advisory (GHSA-9f24-jqhm-jfcw) explicitly states the vulnerable version range is >= 6.0.0 <= 6.6.0. The target version 5.28.5 predates the introduction of the vulnerable code. The vulnerable byteStream with async start callback that eagerly reads all response data was introduced in version 6.0.0 (commit af9aa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 5.28.5 of undici. not_affected \u2014 CVE-2024-24758 is NOT present in undici 5.28.5-tuxcare.8. The vulnerability (failure to clear Proxy-Authorization headers on cross-origin redirects) was fixed in upstream version 5.28.3 by Matteo Collina. The fix was already present when TuxCare onboarded version 5.28.5. The defense code (request.headersList.delete('proxy-authorization', true)) is present at lib/fetch/index.js:1207 within the h...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-24758 is NOT present in undici 5.28.5-tuxcare.8. The vulnerability (failure to clear Proxy-Authorization headers on cross-origin redirects) was fixed in upstream version 5.28.3 by Matteo Collina. The fix was already present when TuxCare onboarded version 5.28.5. The defense code (request.headersList.delete('proxy-authorization', true)) is present at lib/fetch/index.js:1207 within the h..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-14T00:20:08.913417+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 does not affect version 5.28.5 of undici. not_affected \u2014 undici 5.28.5 already contains the upstream fix. RedirectHandler strips authorization, proxy-authorization and cookie headers when the redirect target origin differs from the original. The fix shipped in the upstream release (commit 64e3402, authored by Matteo Collina). It predates the first TuxCare commit, so this is not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.5 already contains the upstream fix. RedirectHandler strips authorization, proxy-authorization and cookie headers when the redirect target origin differs from the original. The fix shipped in the upstream release (commit 64e3402, authored by Matteo Collina). It predates the first TuxCare commit, so this is not a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-13T23:33:57.977509+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 5.28.5 of undici. not_affected \u2014 The target (undici 5.28.5-tuxcare.12) already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). The fix commit 2b39440b, by Matteo Collina, is an ancestor of HEAD and was already in the upstream release TuxCare onboarded. The integrity-metadata parser in lib/fetch/util.js matches the post-fix code.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 The target (undici 5.28.5-tuxcare.12) already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). The fix commit 2b39440b, by Matteo Collina, is an ancestor of HEAD and was already in the upstream release TuxCare onboarded. The integrity-metadata parser in lib/fetch/util.js matches the post-fix code."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 5.28.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T10:55:02.115769+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 does not affect version 5.28.5 of undici. not_affected \u2014 The multipart/form-data boundary in lib/fetch/body.js is generated with crypto.randomInt (a CSPRNG) rather than Math.random. The upstream fix (c2d78cd, backported to 5.x as 711e2077 by Matteo Collina) is already in the 5.28.5 release that TuxCare onboarded. The Math.random fallback is reachable only if require('node:crypto') throws, which doesn't happen on supported Node versions.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "impact_statement": "not_affected \u2014 The multipart/form-data boundary in lib/fetch/body.js is generated with crypto.randomInt (a CSPRNG) rather than Math.random. The upstream fix (c2d78cd, backported to 5.x as 711e2077 by Matteo Collina) is already in the 5.28.5 release that TuxCare onboarded. The Math.random fallback is reachable only if require('node:crypto') throws, which doesn't happen on supported Node versions."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "action_statement": "Vulnerability CVE-2025-47279 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-31T12:29:02.753590+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:06:00.064776+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 5.28.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T13:30:25.835538+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 does not affect version 5.28.5 of undici. not_affected \u2014 Not affected. undici 5.28.5 lowercases the SRI algorithm token (lib/fetch/util.js:634) before checking it against the supported-hash list. Uppercase and mixed-case tokens such as SHA256-/Sha256- are therefore recognized and verified. The 7.15.0 regression (a lowercase-only lookup of the raw token) is not in this tree. I ran bytesMatch directly: a mismatched body with a SHA256- or Sha256- token ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "impact_statement": "not_affected \u2014 Not affected. undici 5.28.5 lowercases the SRI algorithm token (lib/fetch/util.js:634) before checking it against the supported-hash list. Uppercase and mixed-case tokens such as SHA256-/Sha256- are therefore recognized and verified. The 7.15.0 regression (a lowercase-only lookup of the raw token) is not in this tree. I ran bytesMatch directly: a mismatched body with a SHA256- or Sha256- token ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-14T02:54:11.763221+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 does not affect version 5.28.5 of undici. not_affected \u2014 Not affected (Type A2). The CVE is a regression introduced in undici 8.11.0, where WebSocket-over-HTTP/2 was added. This target is undici 5.28.5-tuxcare.12. Its HTTP/2 path (writeH2) explicitly rejects upgrade requests, so no orphaned ClientHttp2Stream can result from a failed WebSocket handshake. The default is also allowH2=false.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "impact_statement": "not_affected \u2014 Not affected (Type A2). The CVE is a regression introduced in undici 8.11.0, where WebSocket-over-HTTP/2 was added. This target is undici 5.28.5-tuxcare.12. Its HTTP/2 path (writeH2) explicitly rejects upgrade requests, so no orphaned ClientHttp2Stream can result from a failed WebSocket handshake. The default is also allowH2=false."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:31.171802+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 5.28.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T13:23:29.740738+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 does not affect version 5.28.5 of undici. not_affected \u2014 The target is undici 5.28.5-tuxcare.11, the same product as the advisory. It contains no EventSource client or SSE parser at all. The EventSource code the patch modifies (lib/web/eventsource/*) was added in a later undici major line, so the target is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "impact_statement": "not_affected \u2014 The target is undici 5.28.5-tuxcare.11, the same product as the advisory. It contains no EventSource client or SSE parser at all. The EventSource code the patch modifies (lib/web/eventsource/*) was added in a later undici major line, so the target is not affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-31T12:29:02.753590+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "action_statement": "Vulnerability CVE-2026-11525 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 5.28.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T10:28:00.097812+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 does not affect version 5.28.5 of undici. not_affected \u2014 Target is undici 5.28.5 (tuxcare.11). The CVE affects 7.0.0-7.30.1 and 8.0.0-8.12.3, which have a dispatcher-level shared cache interceptor that issues conditional revalidation requests. This 5.x tree has no such interceptor and no code that generates If-None-Match or If-Modified-Since from stored entries, so the chain cannot occur.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "impact_statement": "not_affected \u2014 Target is undici 5.28.5 (tuxcare.11). The CVE affects 7.0.0-7.30.1 and 8.0.0-8.12.3, which have a dispatcher-level shared cache interceptor that issues conditional revalidation requests. This 5.x tree has no such interceptor and no code that generates If-None-Match or If-Modified-Since from stored entries, so the chain cannot occur."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T10:16:59.893945+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 does not affect version 5.28.5 of undici. not_affected \u2014 The target is undici 5.28.5-tuxcare.11, which is the same product as the advisory but a much older line. It has none of the components the vulnerability needs. There is no HTTP cache interceptor, no dump interceptor, no decompress interceptor and no cache store. The advisory names affected versions 7.0.0-7.30.1 and 8.0.0-8.12.3, and the cache interceptor only exists in those lines.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "impact_statement": "not_affected \u2014 The target is undici 5.28.5-tuxcare.11, which is the same product as the advisory but a much older line. It has none of the components the vulnerability needs. There is no HTTP cache interceptor, no dump interceptor, no decompress interceptor and no cache store. The advisory names affected versions 7.0.0-7.30.1 and 8.0.0-8.12.3, and the cache interceptor only exists in those lines."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T10:17:31.948615+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 does not affect version 5.28.5 of undici. not_affected \u2014 undici 5.28.5-tuxcare.11 is not exploitable via CVE-2026-120415. RedirectHandler.cleanRequestHeaders does treat an array as a flat list, the same weakness as in the 7.x/8.x ranges. But 5.28.x's Request constructor rejects an array of [name, value] tuples before any request is sent, so no redirect can happen. This tree also has no cache or deduplicate interceptor that could re-serialize the reta...",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.5-tuxcare.11 is not exploitable via CVE-2026-120415. RedirectHandler.cleanRequestHeaders does treat an array as a flat list, the same weakness as in the 7.x/8.x ranges. But 5.28.x's Request constructor rejects an array of [name, value] tuples before any request is sent, so no redirect can happen. This tree also has no cache or deduplicate interceptor that could re-serialize the reta..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T10:18:00.081064+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 does not affect version 5.28.5 of undici. not_affected \u2014 Target undici 5.28.5-tuxcare.11 has the same space-only split in parseMetadata, but the per-token hash-with-options regex is unanchored. A token with leading or trailing tab, newline, or other whitespace still yields the digest, so the integrity list never becomes empty and mismatched bodies are rejected. The CVE's bypass (whitespace-wrapped digest skipped, empty list, response accepted) does n...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "impact_statement": "not_affected \u2014 Target undici 5.28.5-tuxcare.11 has the same space-only split in parseMetadata, but the per-token hash-with-options regex is unanchored. A token with leading or trailing tab, newline, or other whitespace still yields the digest, so the integrity list never becomes empty and mismatched bodies are rejected. The CVE's bypass (whitespace-wrapped digest skipped, empty list, response accepted) does n..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:52.132940+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 does not affect version 5.28.5 of undici. not_affected \u2014 The target is undici 5.28.5-tuxcare.11. It has a redirect interceptor but no shared HTTP response cache interceptor or cache store, so a redirected authenticated response is never stored under the original request's cache key. The CVE affects only undici 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3, which ship that cache interceptor.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "impact_statement": "not_affected \u2014 The target is undici 5.28.5-tuxcare.11. It has a redirect interceptor but no shared HTTP response cache interceptor or cache store, so a redirected authenticated response is never stored under the original request's cache key. The CVE affects only undici 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3, which ship that cache interceptor."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-23T14:00:29.259023+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "action_statement": "Vulnerability CVE-2026-12151 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:03.785272+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "action_statement": "Vulnerability CVE-2026-13697 affects version 5.28.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T12:13:13.452143+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 does not affect version 5.28.5 of undici. not_affected \u2014 Undici 5.28.5-tuxcare.11 has no HTTP cache interceptor and no Cache-Control response-directive parser. CVE-2026-14643 affects the `interceptors.cache()` shared-cache feature of undici 7.x/8.x, which was introduced after 5.x. The vulnerable code is not present in this repo.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "impact_statement": "not_affected \u2014 Undici 5.28.5-tuxcare.11 has no HTTP cache interceptor and no Cache-Control response-directive parser. CVE-2026-14643 affects the `interceptors.cache()` shared-cache feature of undici 7.x/8.x, which was introduced after 5.x. The vulnerable code is not present in this repo."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "action_statement": "Vulnerability CVE-2026-15157 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "action_statement": "Vulnerability CVE-2026-1525 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 does not affect version 5.28.5 of undici. Target undici version 5.28.5 does not contain the permessage-deflate WebSocket extension implementation. The vulnerable decompression code (PerMessageDeflate class) was introduced in version 6.17.0, well after this version. The extension is explicitly disabled in the handshake code (connection.js line 97), never requested from servers, and no zlib-based decompression code exists in the websocket implementation. Since the vulnerability requires permessage-deflate negotiation and active decompression, and this version cannot perform either, the vulnerability chain cannot exist.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "impact_statement": "Target undici version 5.28.5 does not contain the permessage-deflate WebSocket extension implementation. The vulnerable decompression code (PerMessageDeflate class) was introduced in version 6.17.0, well after this version. The extension is explicitly disabled in the handshake code (connection.js line 97), never requested from servers, and no zlib-based decompression code exists in the websocket implementation. Since the vulnerability requires permessage-deflate negotiation and active decompression, and this version cannot perform either, the vulnerability chain cannot exist."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "action_statement": "Vulnerability CVE-2026-1527 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "action_statement": "Vulnerability CVE-2026-1528 affects version 5.28.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "action_statement": "Vulnerability CVE-2026-16728 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "action_statement": "Vulnerability CVE-2026-16729 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.7."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T13:17:00.025815+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 does not affect version 5.28.5 of undici. not_affected \u2014 undici 5.28.5-tuxcare.11 uses the legacy callback-style RetryHandler (lib/handler/RetryHandler.js). It has no throwOnError or onResponseStart path that forwards a replacement response after an earlier response was already exposed. After a truncated response, every terminal failure on the retried request goes through abort() followed by onError() and handler.onError(), so the original body is al...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.5-tuxcare.11 uses the legacy callback-style RetryHandler (lib/handler/RetryHandler.js). It has no throwOnError or onResponseStart path that forwards a replacement response after an earlier response was already exposed. After a truncated response, every terminal failure on the retried request goes through abort() followed by onError() and handler.onError(), so the original body is al..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "action_statement": "Vulnerability CVE-2026-18540 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:31.171802+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "action_statement": "Vulnerability CVE-2026-19534 affects version 5.28.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "action_statement": "Vulnerability CVE-2026-22036 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.6."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 does not affect version 5.28.5 of undici. Target version 5.28.5 does not have permessage-deflate support. The vulnerable feature was introduced in undici v6.18.0 (May 2024), multiple major versions after the target. The client never advertises permessage-deflate capability (header append is commented out), the extension negotiation code is disabled with a TODO comment, and the required files (lib/web/websocket/permessage-deflate.js, lib/web/websocket/util.js with isValidClientWindowBits) do not exist. Version 5.28.5 uses the old lib/websocket/ directory structure, predating the lib/web/websocket/ reorganization that accompanied the permessage-deflate feature addition.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "impact_statement": "Target version 5.28.5 does not have permessage-deflate support. The vulnerable feature was introduced in undici v6.18.0 (May 2024), multiple major versions after the target. The client never advertises permessage-deflate capability (header append is commented out), the extension negotiation code is disabled with a TODO comment, and the required files (lib/web/websocket/permessage-deflate.js, lib/web/websocket/util.js with isValidClientWindowBits) do not exist. Version 5.28.5 uses the old lib/websocket/ directory structure, predating the lib/web/websocket/ reorganization that accompanied the permessage-deflate feature addition."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-14T01:25:13.546710+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 does not affect version 5.28.5 of undici. not_affected \u2014 Target is undici 5.28.5-tuxcare.12. The request-deduplication interceptor (interceptors.deduplicate(), added in undici 7.x) does not exist in this tree. No component coalesces identical in-flight requests or buffers response bodies for multiple waiting handlers, so the vulnerable pattern is absent.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "impact_statement": "not_affected \u2014 Target is undici 5.28.5-tuxcare.12. The request-deduplication interceptor (interceptors.deduplicate(), added in undici 7.x) does not exist in this tree. No component coalesces identical in-flight requests or buffers response bodies for multiple waiting handlers, so the vulnerable pattern is absent."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "action_statement": "Vulnerability CVE-2026-6733 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:03.785272+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "action_statement": "Vulnerability CVE-2026-6734 affects version 5.28.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T13:02:26.327888+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 does not affect version 5.28.5 of undici. not_affected \u2014 The CVE concerns interceptors.decompress(), an interceptor that does not exist in undici 5.28.5-tuxcare.11. lib/interceptor contains only redirectInterceptor.js, and index.js exposes no decompress interceptor. Same product, but the affected component is absent in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "impact_statement": "not_affected \u2014 The CVE concerns interceptors.decompress(), an interceptor that does not exist in undici 5.28.5-tuxcare.11. lib/interceptor contains only redirectInterceptor.js, and index.js exposes no decompress interceptor. Same product, but the affected component is absent in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T12:58:53.206755+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 does not affect version 5.28.5 of undici. not_affected \u2014 undici 5.28.5-tuxcare.11 has no HTTP cache interceptor (interceptors.cache(), CacheHandler or cache stores). The CVE concerns that interceptor in the 7.x/8.x lines. The 5.x tree only has a redirect interceptor and the Web Cache API (lib/cache/cache.js). The Cache API stores only what the caller explicitly passes to put()/add(). It does no automatic shared-cache storage of upstream responses. Th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.5-tuxcare.11 has no HTTP cache interceptor (interceptors.cache(), CacheHandler or cache stores). The CVE concerns that interceptor in the 7.x/8.x lines. The 5.x tree only has a redirect interceptor and the Web Cache API (lib/cache/cache.js). The Cache API stores only what the caller explicitly passes to put()/add(). It does no automatic shared-cache storage of upstream responses. Th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T12:52:00.028717+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 does not affect version 5.28.5 of undici. not_affected \u2014 undici 5.28.5-tuxcare.11 has no `interceptors.dump()` / dump interceptor. The vulnerable component (lib/interceptor/dump.js) does not exist in this tree, so the CVE-2026-84947 pattern is absent. The only interceptor shipped is redirectInterceptor. The unrelated `BodyReadable.dump()` is an explicit caller-invoked body discard and does not reproduce the Goal.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.5-tuxcare.11 has no `interceptors.dump()` / dump interceptor. The vulnerable component (lib/interceptor/dump.js) does not exist in this tree, so the CVE-2026-84947 pattern is absent. The only interceptor shipped is redirectInterceptor. The unrelated `BodyReadable.dump()` is an explicit caller-invoked body discard and does not reproduce the Goal."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:03.785272+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "action_statement": "Vulnerability CVE-2026-84961 affects version 5.28.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T12:58:00.042642+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 does not affect version 5.28.5 of undici. not_affected \u2014 undici 5.28.5-tuxcare.11 has no `interceptors.cache()` HTTP cache interceptor, no cache store and no `canCacheResponse` gate. The CVE-2026-85008 component only exists in 7.x/8.x. The target is the same product (undici), so this is not a false positive. The only cache code is the script-driven fetch Cache/CacheStorage API, which is not an HTTP response cache and rejects non-GET requests in `put`.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.5-tuxcare.11 has no `interceptors.cache()` HTTP cache interceptor, no cache store and no `canCacheResponse` gate. The CVE-2026-85008 component only exists in 7.x/8.x. The target is the same product (undici), so this is not a false positive. The only cache code is the script-driven fetch Cache/CacheStorage API, which is not an HTTP response cache and rejects non-GET requests in `put`."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T12:39:00.470719+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 does not affect version 5.28.5 of undici. not_affected \u2014 undici 5.28.5-tuxcare.11 does not contain the WebSocketStream API (added in undici 7.0.0). The vulnerable socket-close handler that calls abort() on a locked writable stream does not exist in this tree.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.5-tuxcare.11 does not contain the WebSocketStream API (added in undici 7.0.0). The vulnerable socket-close handler that calls abort() on a locked writable stream does not exist in this tree."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-14T02:13:19.192215+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 does not affect version 5.28.5 of undici. not_affected \u2014 undici 5.28.5 has no permessage-deflate support. lib/websocket/ has no permessage-deflate.js and no zlib/InflateRaw usage. The client sends no extension offer and fails the connection if the server returns any Sec-WebSocket-Extensions value. The vulnerable cleanup path (removeAllListeners on an InflateRaw) does not exist, so the process-crash chain cannot occur.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.5 has no permessage-deflate support. lib/websocket/ has no permessage-deflate.js and no zlib/InflateRaw usage. The client sends no extension offer and fails the connection if the server returns any Sec-WebSocket-Extensions value. The vulnerable cleanup path (removeAllListeners on an InflateRaw) does not exist, so the process-crash chain cannot occur."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-14T02:24:22.247125+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 does not affect version 5.28.5 of undici. not_affected \u2014 Target is undici 5.28.5-tuxcare.12. The cache() and deduplicate() interceptors, and the cache stores they use, were introduced in undici 8.10.0 and do not exist in this tree. The shared-key cross-origin poisoning flaw has no code to live in.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "impact_statement": "not_affected \u2014 Target is undici 5.28.5-tuxcare.12. The cache() and deduplicate() interceptors, and the cache stores they use, were introduced in undici 8.10.0 and do not exist in this tree. The shared-key cross-origin poisoning flaw has no code to live in."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T15:03:00.026943+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.12.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 5.28.5 of undici, and is fixed in 5.28.5-tuxcare.12."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T13:30:25.835538+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 does not affect version 5.28.5 of undici. not_affected \u2014 undici 5.28.5 (tuxcare.11) has no `decompress` interceptor and no `dump` interceptor. The vulnerable pattern (a downstream handler called from zlib stream event callbacks without try/catch) does not exist. Only lib/interceptor/redirectInterceptor.js is present. Response decompression happens only in fetch, via stream.pipeline.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "impact_statement": "not_affected \u2014 undici 5.28.5 (tuxcare.11) has no `decompress` interceptor and no `dump` interceptor. The vulnerable pattern (a downstream handler called from zlib stream event callbacks without try/catch) does not exist. Only lib/interceptor/redirectInterceptor.js is present. Response decompression happens only in fetch, via stream.pipeline."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-14T01:54:00.066706+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 does not affect version 5.28.5 of undici. not_affected \u2014 CVE-2026-9675 is a regression in the undici 8.1.0 `maxPayloadSize` feature: the per-frame check was added without a cumulative check across fragments. The target is undici 5.28.5-tuxcare.12 and has no `maxPayloadSize` option anywhere, so the regressed code and the limit it fails to enforce are not present. The CVE states that lines without this feature (7.x) are unaffected, and 5.x is in the sa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-9675 is a regression in the undici 8.1.0 `maxPayloadSize` feature: the per-frame check was added without a cumulative check across fragments. The target is undici 5.28.5-tuxcare.12 and has no `maxPayloadSize` option anywhere, so the regressed code and the limit it fails to enforce are not present. The CVE states that lines without this feature (7.x) are unaffected, and 5.x is in the sa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-06T12:28:00.043617+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 does not affect version 5.28.5 of undici. not_affected \u2014 Target is undici 5.28.5-tuxcare.11. It has no HTTP cache interceptor (interceptors.cache()) and no shared-cache logic. The code that parses private/no-cache qualified field names from response Cache-Control does not exist in this tree. Type A1: not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "impact_statement": "not_affected \u2014 Target is undici 5.28.5-tuxcare.11. It has no HTTP cache interceptor (interceptors.cache()) and no shared-cache logic. The code that parses private/no-cache qualified field names from response Cache-Control does not exist in this tree. Type A1: not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 does not affect version 5.28.5 of undici. not_affected \u2014 Target repository version 5.28.5-tuxcare.4 is not affected by CVE-2026-9679. The vulnerability was introduced in undici 7.0.0 via commit dac8e73d (PR #3789), which added percent-decoding of cookie values using querystring.unescape(). Git history analysis confirms this commit is NOT an ancestor of the target's current HEAD. The target's cookie parser at lib/cookies/parse.js has never contained p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "impact_statement": "not_affected \u2014 Target repository version 5.28.5-tuxcare.4 is not affected by CVE-2026-9679. The vulnerability was introduced in undici 7.0.0 via commit dac8e73d (PR #3789), which added percent-decoding of cookie values using querystring.unescape(). Git history analysis confirms this commit is NOT an ancestor of the target's current HEAD. The target's cookie parser at lib/cookies/parse.js has never contained p..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@5.28.5",
          "identifiers": {
            "purl": "pkg:npm/undici@5.28.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:04:00.091712+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 affects version 5.28.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "action_statement": "Vulnerability CVE-2026-9697 affects version 5.28.5 of undici."
    }
  ]
}