{ "@id": "urn:uuid:8427f497-32f7-40fa-8bfb-2b415608621c", "role": "Document Creator", "author": "https://tuxcare.com", "version": 45, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:59:19.400953+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 5.5.1 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 5.5.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45143 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1.", "vulnerability": { "name": "CVE-2023-45143" }, "action_statement": "Vulnerability CVE-2023-45143 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24750 does not affect version 5.5.1 of undici. not_affected \u2014 Version 5.5.1 is NOT affected by CVE-2024-24750. The vulnerable code pattern (byte streams with async start controller and while(true) eager pushing) was introduced 2939 commits later in v6.0.0 (commit af9aaea0, December 2023) and fixed in v6.6.1 (commit 87a48113, February 2024). Version 5.5.1 uses a fundamentally different architecture with pull-based ReadableStreams that have inherent backpre...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2024-24750" }, "impact_statement": "not_affected \u2014 Version 5.5.1 is NOT affected by CVE-2024-24750. The vulnerable code pattern (byte streams with async start controller and while(true) eager pushing) was introduced 2939 commits later in v6.0.0 (commit af9aaea0, December 2023) and fixed in v6.6.1 (commit 87a48113, February 2024). Version 5.5.1 uses a fundamentally different architecture with pull-based ReadableStreams that have inherent backpre..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24758 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1.", "vulnerability": { "name": "CVE-2024-24758" }, "action_statement": "Vulnerability CVE-2024-24758 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30260 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1.", "vulnerability": { "name": "CVE-2024-30260" }, "action_statement": "Vulnerability CVE-2024-30260 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 5.5.1 of undici. not_affected \u2014 Version 5.5.1 is not affected by CVE-2024-30261. The vulnerable integrity parsing and validation code does not exist in this version. The integrity checking feature was implemented starting in v5.10.0 with a flawed regex pattern that was later fixed in v5.28.4. Version 5.5.1 only contains a stub function `matchRequestIntegrity` that unconditionally returns `false`, causing all integrity-checked...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Version 5.5.1 is not affected by CVE-2024-30261. The vulnerable integrity parsing and validation code does not exist in this version. The integrity checking feature was implemented starting in v5.10.0 with a flawed regex pattern that was later fixed in v5.28.4. Version 5.5.1 only contains a stub function `matchRequestIntegrity` that unconditionally returns `false`, causing all integrity-checked..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 5.5.1 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 5.5.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-22150 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1.", "vulnerability": { "name": "CVE-2025-22150" }, "action_statement": "Vulnerability CVE-2025-22150 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47279 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1.", "vulnerability": { "name": "CVE-2025-47279" }, "action_statement": "Vulnerability CVE-2025-47279 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T15:04:44.386718+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-05T09:06:00.064776+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 5.5.1 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 5.5.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T13:30:25.835538+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 5.5.1 of undici. not_affected \u2014 undici 5.5.1 has no SRI parsing code. matchRequestIntegrity() in lib/fetch/util.js is a stub that always returns false, so any non-empty integrity value fails closed with 'integrity mismatch'. The case-sensitive token lookup that CVE-2026-109841 describes (introduced in 7.15.0) does not exist here. A response body can never be accepted without matching its digest.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 undici 5.5.1 has no SRI parsing code. matchRequestIntegrity() in lib/fetch/util.js is a stub that always returns false, so any non-empty integrity value fails closed with 'integrity mismatch'. The case-sensitive token lookup that CVE-2026-109841 describes (introduced in 7.15.0) does not exist here. A response body can never be accepted without matching its digest." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-14T02:59:19.400953+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 5.5.1 of undici. not_affected \u2014 Target is undici 5.5.1-tuxcare.4, an old release. CVE-2026-109855 is a regression introduced in undici 8.11.0, which added an HTTP/2 WebSocket handshake path. The target has no WebSocket client and no HTTP/2 support, so the vulnerable code is absent. Note: the patch was only a URL and could not be fetched, so the analysis relies on the CVE text.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 5.5.1-tuxcare.4, an old release. CVE-2026-109855 is a regression introduced in undici 8.11.0, which added an HTTP/2 WebSocket handshake path. The target has no WebSocket client and no HTTP/2 support, so the vulnerable code is absent. Note: the patch was only a URL and could not be fetched, so the analysis relies on the CVE text." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-05T09:05:31.171802+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 5.5.1 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 5.5.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T13:23:29.740738+00:00", "status_notes": "Vulnerability CVE-2026-109924 does not affect version 5.5.1 of undici. not_affected \u2014 The target is undici 5.5.1-tuxcare.3, which has no EventSource client. The CVE concerns unbounded retained parser state in undici's EventSource (Server-Sent Events) parser, and the source tree contains no such code. Type A1 (input absent), so not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109924" }, "impact_statement": "not_affected \u2014 The target is undici 5.5.1-tuxcare.3, which has no EventSource client. The CVE concerns unbounded retained parser state in undici's EventSource (Server-Sent Events) parser, and the source tree contains no such code. Type A1 (input absent), so not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T13:26:42.796685+00:00", "status_notes": "Vulnerability CVE-2026-109932 does not affect version 5.5.1 of undici. not_affected \u2014 undici 5.5.1-tuxcare.3 predates the WebSocket client, which was added in 5.15.0. The repo has no WebSocket receiver, frame parser, or PING/PONG handling, so the inbound-frame-to-unbounded-outbound-queue chain cannot exist. Same product lineage as the advisory, so not a false_positive.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109932" }, "impact_statement": "not_affected \u2014 undici 5.5.1-tuxcare.3 predates the WebSocket client, which was added in 5.15.0. The repo has no WebSocket receiver, frame parser, or PING/PONG handling, so the inbound-frame-to-unbounded-outbound-queue chain cannot exist. Same product lineage as the advisory, so not a false_positive." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 does not affect version 5.5.1 of undici. not_affected \u2014 The target (undici v5.5.1) is NOT AFFECTED by CVE-2026-11525. The vulnerability was introduced in undici v5.15.0 when the cookie parsing feature was added via commit 7ee93b26. Version 5.5.1 predates this feature introduction and does not contain any cookie parsing code. The vulnerable code path (lib/cookies/parse.js or lib/web/cookies/parse.js with substring-based SameSite matching) does not ex...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-11525" }, "impact_statement": "not_affected \u2014 The target (undici v5.5.1) is NOT AFFECTED by CVE-2026-11525. The vulnerability was introduced in undici v5.15.0 when the cookie parsing feature was added via commit 7ee93b26. Version 5.5.1 predates this feature introduction and does not contain any cookie parsing code. The vulnerable code path (lib/cookies/parse.js or lib/web/cookies/parse.js with substring-based SameSite matching) does not ex..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 5.5.1 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 5.5.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T10:32:00.039627+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 5.5.1 of undici. not_affected \u2014 Target is undici 5.5.1 (tuxcare.3). CVE-2026-116630 affects the shared-cache interceptor composed with the redirect interceptor in undici 7.x/8.x. Neither the interceptor API nor a cache store exists in this 5.x tree, so there is no revalidation path that could be satisfied by a cross-origin 304.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 Target is undici 5.5.1 (tuxcare.3). CVE-2026-116630 affects the shared-cache interceptor composed with the redirect interceptor in undici 7.x/8.x. Neither the interceptor API nor a cache store exists in this 5.x tree, so there is no revalidation path that could be satisfied by a cross-origin 304." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T10:16:59.893945+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 5.5.1 of undici. not_affected \u2014 Target is undici 5.5.1-tuxcare.3. It has no HTTP cache interceptor, no dump or decompress interceptor, and no compose/interceptor subsystem. The CVE's cached-response replay path (including 304 revalidation) therefore does not exist. Type A1: not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 Target is undici 5.5.1-tuxcare.3. It has no HTTP cache interceptor, no dump or decompress interceptor, and no compose/interceptor subsystem. The CVE's cached-response replay path (including 304 revalidation) therefore does not exist. Type A1: not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T10:17:15.295484+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 5.5.1 of undici. not_affected \u2014 undici 5.5.1-tuxcare.3 has the same flat-list handling in RedirectHandler's cleanRequestHeaders, but a tuple-array header input cannot get past request construction. Request rejects any non-primitive header value, so the first dispatch fails before any redirect. This version also has no cache or deduplicate interceptor. The chain to cross-origin credential disclosure is not reachable.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 undici 5.5.1-tuxcare.3 has the same flat-list handling in RedirectHandler's cleanRequestHeaders, but a tuple-array header input cannot get past request construction. Request rejects any non-primitive header value, so the first dispatch fails before any redirect. This version also has no cache or deduplicate interceptor. The chain to cross-origin credential disclosure is not reachable." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T10:18:00.081064+00:00", "status_notes": "Vulnerability CVE-2026-120423 does not affect version 5.5.1 of undici. not_affected \u2014 Target is undici 5.5.1-tuxcare.3, far older than the affected 7.15.0-7.30.1 / 8.0.0-8.12.3 ranges. Its fetch has no SRI parsing. matchRequestIntegrity() is a stub that always returns false, so any non-empty integrity value makes fetch fail with 'integrity mismatch'. A mismatching body can never be accepted through the whitespace-splitting flaw (Type A2).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120423" }, "impact_statement": "not_affected \u2014 Target is undici 5.5.1-tuxcare.3, far older than the affected 7.15.0-7.30.1 / 8.0.0-8.12.3 ranges. Its fetch has no SRI parsing. matchRequestIntegrity() is a stub that always returns false, so any non-empty integrity value makes fetch fail with 'integrity mismatch'. A mismatching body can never be accepted through the whitespace-splitting flaw (Type A2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T10:11:15.744985+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 5.5.1 of undici. not_affected \u2014 Target is undici 5.5.1-tuxcare.3, the same product lineage as the CVE but far older than 7.x/8.x. It has no response-cache interceptor or cache store, and no interceptor/composition API. The CVE's chain (redirect interceptor plus shared response cache storing the final response under the original request's key) cannot occur. Not affected.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 Target is undici 5.5.1-tuxcare.3, the same product lineage as the CVE but far older than 7.x/8.x. It has no response-cache interceptor or cache store, and no interceptor/composition API. The CVE's chain (redirect interceptor plus shared response cache storing the final response under the original request's key) cannot occur. Not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 does not affect version 5.5.1 of undici. Undici version 5.5.1 does not contain any WebSocket client implementation. The vulnerable code pattern (unbounded WebSocket fragment accumulation in ByteParser) cannot exist because the WebSocket client functionality (lib/web/websocket/, ByteParser class, frame parsing logic) was introduced after version 5.5.1. Git history confirms WebSocket code first appeared in version 6.11.1+. The CVE affects \"undici >= 6.17.0\" and while version metadata alone is not conclusive, exhaustive code search confirms the WebSocket client code is genuinely absent from 5.5.1. The INPUT (WebSocket continuation frames) cannot be received by this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-12151" }, "impact_statement": "Undici version 5.5.1 does not contain any WebSocket client implementation. The vulnerable code pattern (unbounded WebSocket fragment accumulation in ByteParser) cannot exist because the WebSocket client functionality (lib/web/websocket/, ByteParser class, frame parsing logic) was introduced after version 5.5.1. Git history confirms WebSocket code first appeared in version 6.11.1+. The CVE affects \"undici >= 6.17.0\" and while version metadata alone is not conclusive, exhaustive code search confirms the WebSocket client code is genuinely absent from 5.5.1. The INPUT (WebSocket continuation frames) cannot be received by this version." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 5.5.1 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 5.5.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T12:13:13.452143+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 5.5.1 of undici. not_affected \u2014 Undici 5.5.1-tuxcare.3 has no cache interceptor, cache store, or response Cache-Control parser. The flaw (OWS around '=' in qualified no-cache/private directives) lives in a feature introduced in 7.x, so it is not present here. Same product (undici) but the vulnerable component is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 Undici 5.5.1-tuxcare.3 has no cache interceptor, cache store, or response Cache-Control parser. The flaw (OWS around '=' in qualified no-cache/private directives) lives in a feature introduced in 7.x, so it is not present here. Same product (undici) but the vulnerable component is absent." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.2.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1525 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-1525" }, "action_statement": "Vulnerability CVE-2026-1525 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-10-06T18:19:00.080263+00:00", "status_notes": "Vulnerability CVE-2026-1526 does not affect version 5.5.1 of undici. not_affected \u2014 undici 5.5.1 is not affected by CVE-2026-1526: no WebSocket client (added v5.15.0) and no permessage-deflate (added v6.18.0); lib/websocket, PerMessageDeflate and RSV1 handling are absent. patches/CVE-2026-1526.patch on the branch is a Not-affected verdict, not a code fix. Reverts an incorrect manual move to done (2026-10-06).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1526" }, "impact_statement": "not_affected \u2014 undici 5.5.1 is not affected by CVE-2026-1526: no WebSocket client (added v5.15.0) and no permessage-deflate (added v6.18.0); lib/websocket, PerMessageDeflate and RSV1 handling are absent. patches/CVE-2026-1526.patch on the branch is a Not-affected verdict, not a code fix. Reverts an incorrect manual move to done (2026-10-06)." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-1527 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.3.", "vulnerability": { "name": "CVE-2026-1527" }, "action_statement": "Vulnerability CVE-2026-1527 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.3." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-13T22:08:00.481016+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 5.5.1 of undici. not_affected \u2014 The target is undici 5.5.1, which has no WebSocket client or frame parser. CVE-2026-1528 is an oversized 64-bit WebSocket frame length crashing the process through ByteParser. The code that parses WebSocket frames is not in this repository, so the vulnerability cannot occur here.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 The target is undici 5.5.1, which has no WebSocket client or frame parser. CVE-2026-1528 is an oversized 64-bit WebSocket frame length crashing the process through ByteParser. The code that parses WebSocket frames is not in this repository, so the vulnerability cannot occur here." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 does not affect version 5.5.1 of undici. not_affected \u2014 Target version 5.5.1 is not affected by CVE-2026-16728. The vulnerability requires interceptors.retry() functionality, which does not exist in this version. The retry handler feature (lib/handler/retry-handler.js) was introduced in commit f9960147 on 2023-11-13 and first appeared in v5.28.0, significantly after v5.5.1 was released. Without the retry handler, the vulnerable code path\u2014where Conte...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16728" }, "impact_statement": "not_affected \u2014 Target version 5.5.1 is not affected by CVE-2026-16728. The vulnerability requires interceptors.retry() functionality, which does not exist in this version. The retry handler feature (lib/handler/retry-handler.js) was introduced in commit f9960147 on 2023-11-13 and first appeared in v5.28.0, significantly after v5.5.1 was released. Without the retry handler, the vulnerable code path\u2014where Conte..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 does not affect version 5.5.1 of undici. not_affected \u2014 Version 5.5.1 is not affected by CVE-2026-16729. The vulnerable cookie validation module (lib/web/cookies/util.js containing setCookie, validateCookieDomain, and unparsed attribute handling) was introduced in version 5.23.0 (commit 7ee93b26, 2023-01-06). Version 5.5.1 predates this feature by multiple releases and contains no cookie parsing, validation, or attribute injection attack surface. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16729" }, "impact_statement": "not_affected \u2014 Version 5.5.1 is not affected by CVE-2026-16729. The vulnerable cookie validation module (lib/web/cookies/util.js containing setCookie, validateCookieDomain, and unparsed attribute handling) was introduced in version 5.23.0 (commit 7ee93b26, 2023-01-06). Version 5.5.1 predates this feature by multiple releases and contains no cookie parsing, validation, or attribute injection attack surface. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T13:10:47.628017+00:00", "status_notes": "Vulnerability CVE-2026-18149 does not affect version 5.5.1 of undici. not_affected \u2014 undici 5.5.1 (tuxcare.3) has no RetryHandler or any retry/resume-after-truncation mechanism. The flaw in CVE-2026-18149 lives in that handler, which was added in later releases, so the vulnerable chain cannot exist here. Product identity matches undici, so this is not a false_positive.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-18149" }, "impact_statement": "not_affected \u2014 undici 5.5.1 (tuxcare.3) has no RetryHandler or any retry/resume-after-truncation mechanism. The flaw in CVE-2026-18149 lives in that handler, which was added in later releases, so the vulnerable chain cannot exist here. Product identity matches undici, so this is not a false_positive." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-29T19:41:36.034129+00:00", "status_notes": "Vulnerability CVE-2026-18540 does not affect version 5.5.1 of undici. not_affected \u2014 CVE-2026-18540 affects undici's interceptors.retry() functionality, which can resume partial HTTP responses and append resumed bytes to an already-exposed response body, causing the delivered body to exceed the original Content-Length. The target version 5.5.1-tuxcare.3 does NOT have the retry interceptor functionality at all. The retry handler (lib/handler/retry-handler.js) and interceptor API...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-18540" }, "impact_statement": "not_affected \u2014 CVE-2026-18540 affects undici's interceptors.retry() functionality, which can resume partial HTTP responses and append resumed bytes to an already-exposed response body, causing the delivered body to exceed the original Content-Length. The target version 5.5.1-tuxcare.3 does NOT have the retry interceptor functionality at all. The retry handler (lib/handler/retry-handler.js) and interceptor API..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-05T09:05:31.171802+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 5.5.1 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 5.5.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22036 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-22036" }, "action_statement": "Vulnerability CVE-2026-22036 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-10-06T18:16:00.103341+00:00", "status_notes": "Vulnerability CVE-2026-2229 does not affect version 5.5.1 of undici. not_affected \u2014 undici 5.5.1 is not affected by CVE-2026-2229: isValidClientWindowBits, createInflateRaw, InflateRaw and server_max_window_bits are all absent; no window-bits value is ever parsed. patches/CVE-2026-2229.patch on the branch is a Not-affected verdict, not a code fix. Reverts an incorrect manual move to done (2026-10-06).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2229" }, "impact_statement": "not_affected \u2014 undici 5.5.1 is not affected by CVE-2026-2229: isValidClientWindowBits, createInflateRaw, InflateRaw and server_max_window_bits are all absent; no window-bits value is ever parsed. patches/CVE-2026-2229.patch on the branch is a Not-affected verdict, not a code fix. Reverts an incorrect manual move to done (2026-10-06)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-14T01:42:49.706188+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 5.5.1 of undici. not_affected \u2014 The target is undici 5.5.1-tuxcare.4, the same product lineage as the CVE, but it has no interceptor or deduplication feature. CVE-2026-2581 affects only interceptors.deduplicate(), which shares one upstream request between identical concurrent requests and accumulates the response body. That code does not exist here, so the vulnerable chain cannot be built. I did not have the diff, only its UR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 The target is undici 5.5.1-tuxcare.4, the same product lineage as the CVE, but it has no interceptor or deduplication feature. CVE-2026-2581 affects only interceptors.deduplicate(), which shares one upstream request between identical concurrent requests and accumulates the response body. That code does not exist here, so the vulnerable chain cannot be built. I did not have the diff, only its UR..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-6734 affects version 5.5.1 of undici.", "vulnerability": { "name": "CVE-2026-6734" }, "action_statement": "Vulnerability CVE-2026-6734 affects version 5.5.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T13:09:00.028899+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 5.5.1 of undici. not_affected \u2014 undici 5.5.1-tuxcare.3 has no interceptors.decompress() interceptor, which is the only component CVE-2026-84890 concerns. It has no interceptor API, no lib/interceptor directory and no maxSize or ResponseExceededMaxSizeError. The vulnerable component is absent, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 undici 5.5.1-tuxcare.3 has no interceptors.decompress() interceptor, which is the only component CVE-2026-84890 concerns. It has no interceptor API, no lib/interceptor directory and no maxSize or ResponseExceededMaxSizeError. The vulnerable component is absent, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T13:02:00.039785+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 5.5.1 of undici. not_affected \u2014 Target is undici 5.5.1-tuxcare.3. It has no HTTP response-cache interceptor (no interceptors.cache(), no shared/private cache store, no Cache-Control-driven storage), so a Set-Cookie response cannot be stored and re-served to another caller. The vulnerable component is absent (Type A1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 Target is undici 5.5.1-tuxcare.3. It has no HTTP response-cache interceptor (no interceptors.cache(), no shared/private cache store, no Cache-Control-driven storage), so a Set-Cookie response cannot be stored and re-served to another caller. The vulnerable component is absent (Type A1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T12:52:00.028717+00:00", "status_notes": "Vulnerability CVE-2026-84947 does not affect version 5.5.1 of undici. not_affected \u2014 Target is undici 5.5.1-tuxcare.3. It has no interceptors API, no dispatcher compose, and no lib/interceptor/dump.js, so the vulnerable dump interceptor does not exist here. The only 'dump' is the consumer-side BodyReadable.dump(), which is a different component and does not produce the CVE's outcome.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84947" }, "impact_statement": "not_affected \u2014 Target is undici 5.5.1-tuxcare.3. It has no interceptors API, no dispatcher compose, and no lib/interceptor/dump.js, so the vulnerable dump interceptor does not exist here. The only 'dump' is the consumer-side BodyReadable.dump(), which is a different component and does not produce the CVE's outcome." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 5.5.1 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 5.5.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T12:58:53.206755+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 5.5.1 of undici. not_affected \u2014 undici 5.5.1-tuxcare.3 has no cache interceptor, cache store, or response-caching handler. CVE-2026-85008 affects `interceptors.cache()`, which was added in 7.x and 8.x. The vulnerable code does not exist in this tree.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 undici 5.5.1-tuxcare.3 has no cache interceptor, cache store, or response-caching handler. CVE-2026-85008 affects `interceptors.cache()`, which was added in 7.x and 8.x. The vulnerable code does not exist in this tree." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T12:46:00.050274+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 5.5.1 of undici. not_affected \u2014 Not affected. The target is undici 5.5.1-tuxcare.3, which has no WebSocket client and no WebSocketStream. CVE-2026-85014 is in the WebSocketStream socket-close handler, which first appeared in undici 7.0.0. That code is absent from this repo (Type A1, input absent).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 Not affected. The target is undici 5.5.1-tuxcare.3, which has no WebSocket client and no WebSocketStream. CVE-2026-85014 is in the WebSocketStream socket-close handler, which first appeared in undici 7.0.0. That code is absent from this repo (Type A1, input absent)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-14T02:19:14.296675+00:00", "status_notes": "Vulnerability CVE-2026-85024 does not affect version 5.5.1 of undici. not_affected \u2014 The target is undici 5.5.1-tuxcare.4, which has no WebSocket client and no permessage-deflate code. The vulnerable cleanup (removeAllListeners on an InflateRaw stream in the size-limit path) cannot exist here. Type A1: the Brief's input is never received.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85024" }, "impact_statement": "not_affected \u2014 The target is undici 5.5.1-tuxcare.4, which has no WebSocket client and no permessage-deflate code. The vulnerable cleanup (removeAllListeners on an InflateRaw stream in the size-limit path) cannot exist here. Type A1: the Brief's input is never received." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-14T02:34:53.666741+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 5.5.1 of undici. not_affected \u2014 Target is undici 5.5.1-tuxcare.4. The cache and deduplicate interceptors (introduced in 8.10.0) and the interceptor/composition API do not exist in this tree, so the origin-less cache/dedupe key flaw cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 5.5.1-tuxcare.4. The cache and deduplicate interceptors (introduced in 8.10.0) and the interceptor/composition API do not exist in this tree, so the origin-less cache/dedupe key flaw cannot occur." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T15:04:44.386718+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 5.5.1 of undici, and is fixed in 5.5.1-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T13:36:00.057506+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 5.5.1 of undici. not_affected \u2014 Target is undici 5.5.1-tuxcare.3. It has no `decompress` or `dump` interceptor and no interceptor/compose API. The vulnerable pattern (zlib stream callbacks pushing decompressed data into a throwing downstream dispatch handler) therefore does not exist. Fetch decompression uses stream.pipeline, which routes errors to the stream's error path.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 Target is undici 5.5.1-tuxcare.3. It has no `decompress` or `dump` interceptor and no interceptor/compose API. The vulnerable pattern (zlib stream callbacks pushing decompressed data into a throwing downstream dispatch handler) therefore does not exist. Fetch decompression uses stream.pipeline, which routes errors to the stream's error path." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-14T01:58:40.749057+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 5.5.1 of undici. not_affected \u2014 Target is undici 5.5.1-tuxcare.4, which has no WebSocket client, no frame receiver, and no maxPayloadSize feature. CVE-2026-9675 is a regression specific to the 8.1.0 line (new WebSocket client). The fragmented-message accumulation path it fixes does not exist in this tree.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 Target is undici 5.5.1-tuxcare.4, which has no WebSocket client, no frame receiver, and no maxPayloadSize feature. CVE-2026-9675 is a regression specific to the 8.1.0 line (new WebSocket client). The fragmented-message accumulation path it fixes does not exist in this tree." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-06T12:28:55.213155+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 5.5.1 of undici. not_affected \u2014 Target is undici 5.5.1-tuxcare.3. It has no cache interceptor, no response cache store and no Cache-Control response parser, so whitespace-padded private/no-cache qualified directives can never cause a response to be stored and replayed across users. Not affected (Type A1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Target is undici 5.5.1-tuxcare.3. It has no cache interceptor, no response cache store and no Cache-Control response parser, so whitespace-padded private/no-cache qualified directives can never cause a response to be stored and replayed across users. Not affected (Type A1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 5.5.1 of undici. not_affected \u2014 The target version undici 5.5.1 does not contain the vulnerable cookie parsing functionality. The parseSetCookie/parseCookie/getSetCookies functions and the lib/web/cookies/parse.js file that would contain the percent-decoding vulnerability do not exist in this version. Cookie parsing was first introduced in v5.15.0 (without the vulnerability), the vulnerability was introduced in v7.0.0 via com...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 The target version undici 5.5.1 does not contain the vulnerable cookie parsing functionality. The parseSetCookie/parseCookie/getSetCookies functions and the lib/web/cookies/parse.js file that would contain the percent-decoding vulnerability do not exist in this version. Cookie parsing was first introduced in v5.15.0 (without the vulnerability), the vulnerability was introduced in v7.0.0 via com..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.5.1", "identifiers": { "purl": "pkg:npm/undici@5.5.1" } } ], "timestamp": "2026-11-05T09:04:00.091712+00:00", "status_notes": "Vulnerability CVE-2026-9697 affects version 5.5.1 of undici.", "vulnerability": { "name": "CVE-2026-9697" }, "action_statement": "Vulnerability CVE-2026-9697 affects version 5.5.1 of undici." } ] }