{ "@id": "urn:uuid:e7a17539-0524-46ef-a11b-82c04a9e0c5f", "role": "Document Creator", "author": "https://tuxcare.com", "version": 46, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:55:15.631011+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 6.19.5 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 6.19.5 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 6.19.5 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 6.19.5 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 6.19.5 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 6.19.5 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 6.19.5 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-13T23:59:46.060372+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 6.19.5 of undici. not_affected \u2014 Target undici 6.19.5 (tuxcare.7) already strips cookie (and host, authorization, proxy-authorization) headers on cross-origin redirects in fetch. The fix is upstream commit e041de3 (GHSA-wqq4-5wpv-mx2g, 5.26.2), which shipped in the upstream release before any TuxCare commit. The non-fetch redirect handler also strips cookie when the origin changes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Target undici 6.19.5 (tuxcare.7) already strips cookie (and host, authorization, proxy-authorization) headers on cross-origin redirects in fetch. The fix is upstream commit e041de3 (GHSA-wqq4-5wpv-mx2g, 5.26.2), which shipped in the upstream release before any TuxCare commit. The non-fetch redirect handler also strips cookie when the origin changes." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 6.19.5 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-13T22:18:00.036497+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 6.19.5 of undici. not_affected \u2014 Target 6.19.5 already strips Proxy-Authorization on cross-origin redirects in both the dispatcher redirect handler and the fetch redirect path. The fix is upstream commit b9da3e40 (Matteo Collina), which is in the upstream release before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Target 6.19.5 already strips Proxy-Authorization on cross-origin redirects in both the dispatcher redirect handler and the fetch redirect path. The fix is upstream commit b9da3e40 (Matteo Collina), which is in the upstream release before the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-14T00:30:26.670415+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 6.19.5 of undici. not_affected \u2014 undici 6.19.5 already contains the upstream CVE-2024-30260 fix. The request-API redirect handler (lib/handler/redirect-handler.js) strips authorization, proxy-authorization and cookie headers on cross-origin redirects. The fix shipped in the upstream release, before the first TuxCare commit, and was authored by an upstream maintainer, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 undici 6.19.5 already contains the upstream CVE-2024-30260 fix. The request-API redirect handler (lib/handler/redirect-handler.js) strips authorization, proxy-authorization and cookie headers on cross-origin redirects. The fix shipped in the upstream release, before the first TuxCare commit, and was authored by an upstream maintainer, so the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-13T23:33:00.074877+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 6.19.5 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2024-30261 (undici commit d542b8cd, GHSA-9qxr-qj54-h672) is already in this 6.19.5 tree. It shipped in the upstream release before any TuxCare commit, so it is an upstream fix and the vulnerable bytesMatch logic is gone.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2024-30261 (undici commit d542b8cd, GHSA-9qxr-qj54-h672) is already in this 6.19.5 tree. It shipped in the upstream release before any TuxCare commit, so it is an upstream fix and the vulnerable bytesMatch logic is gone." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 6.19.5 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-03T11:50:02.760921+00:00", "status_notes": "Vulnerability CVE-2025-22150 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2.", "vulnerability": { "name": "CVE-2025-22150" }, "action_statement": "Vulnerability CVE-2025-22150 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-03T11:50:02.760921+00:00", "status_notes": "Vulnerability CVE-2025-47279 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2.", "vulnerability": { "name": "CVE-2025-47279" }, "action_statement": "Vulnerability CVE-2025-47279 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-09T10:27:00.246457+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.7.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:06:00.064776+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 6.19.5 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-06T13:26:42.796685+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 6.19.5 of undici. not_affected \u2014 Target undici 6.19.5 predates the 7.15.0 regression. parseMetadata lowercases the SRI algorithm token before checking it against the supported-hash list, so SHA256-/Sha256- tokens are recognized and verified rather than skipped. The case-sensitive skip that caused the bypass is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 Target undici 6.19.5 predates the 7.15.0 regression. parseMetadata lowercases the SRI algorithm token before checking it against the supported-hash list, so SHA256-/Sha256- tokens are recognized and verified rather than skipped. The case-sensitive skip that caused the bypass is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-14T02:55:15.631011+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 6.19.5 of undici. not_affected \u2014 undici 6.19.5-tuxcare.7 is not affected. The CVE is a regression introduced in 8.11.0 that added WebSocket-over-HTTP/2 support. This 6.x tree has no such support. Over HTTP/2, writeH2 rejects every upgrade request before an h2 stream is created, so there is no orphaned ClientHttp2Stream.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 undici 6.19.5-tuxcare.7 is not affected. The CVE is a regression introduced in 8.11.0 that added WebSocket-over-HTTP/2 support. This 6.x tree has no such support. Over HTTP/2, writeH2 rejects every upgrade request before an h2 stream is created, so there is no orphaned ClientHttp2Stream." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:05:31.171802+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 6.19.5 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-04T17:17:55.442628+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.6.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-09T10:27:00.246457+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.7.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-03T11:50:02.760921+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 6.19.5 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-06T10:28:00.097812+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 6.19.5 of undici. not_affected \u2014 undici 6.19.5-tuxcare.6 has no shared HTTP cache interceptor or cache store. The vulnerability needs the redirect interceptor composed with the cache interceptor, which generates the conditional validators. This version has neither the cache interceptor nor any code that generates them, so the flaw cannot occur. The CVE affects only 7.0.0-7.30.1 and 8.0.0-8.12.3.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 undici 6.19.5-tuxcare.6 has no shared HTTP cache interceptor or cache store. The vulnerability needs the redirect interceptor composed with the cache interceptor, which generates the conditional validators. This version has neither the cache interceptor nor any code that generates them, so the flaw cannot occur. The CVE affects only 7.0.0-7.30.1 and 8.0.0-8.12.3." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-06T10:16:59.893945+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 6.19.5 of undici. not_affected \u2014 Target is undici 6.19.5-tuxcare.6. It has no HTTP cache interceptor, cache store, or cached-response replay code, and no decompress interceptor. The CVE affects 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3, where the cache interceptor was introduced. The vulnerable replay path does not exist in this tree.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 Target is undici 6.19.5-tuxcare.6. It has no HTTP cache interceptor, cache store, or cached-response replay code, and no decompress interceptor. The CVE affects 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3, where the cache interceptor was introduced. The vulnerable replay path does not exist in this tree." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-06T10:17:15.295484+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 6.19.5 of undici. not_affected \u2014 undici 6.19.5-tuxcare.6 has the same flat-list misreading in cleanRequestHeaders, but the CVE's exploit chain cannot be completed here. Request construction rejects tuple-array headers with a TypeError, so the first dispatch fails and no redirect happens. The tree also has no cache or deduplicate interceptor to re-serialize the retained headers. The version is also outside the CVE's affected ra...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 undici 6.19.5-tuxcare.6 has the same flat-list misreading in cleanRequestHeaders, but the CVE's exploit chain cannot be completed here. Request construction rejects tuple-array headers with a TypeError, so the first dispatch fails and no redirect happens. The tree also has no cache or deduplicate interceptor to re-serialize the retained headers. The version is also outside the CVE's affected ra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-06T10:18:00.081064+00:00", "status_notes": "Vulnerability CVE-2026-120423 does not affect version 6.19.5 of undici. not_affected \u2014 Target is undici 6.19.5-tuxcare.6, outside the CVE's stated ranges (7.15.0-7.30.1, 8.0.0-8.12.3). parseMetadata() does split on ' ' only, but the per-token regex is unanchored, so a token with a leading tab or other whitespace is still recognized. The tab-prefixed integrity bypass therefore does not occur: runtime tests with mismatching bytes return false for every whitespace variant.", "vulnerability": { "name": "CVE-2026-120423" }, "impact_statement": "not_affected \u2014 Target is undici 6.19.5-tuxcare.6, outside the CVE's stated ranges (7.15.0-7.30.1, 8.0.0-8.12.3). parseMetadata() does split on ' ' only, but the per-token regex is unanchored, so a token with a leading tab or other whitespace is still recognized. The tab-prefixed integrity bypass therefore does not occur: runtime tests with mismatching bytes return false for every whitespace variant." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 6.19.5 of undici. not_affected \u2014 undici 6.19.5-tuxcare.6 has no HTTP response-cache interceptor or cache store (introduced in 7.x). Only the redirect interceptor exists. The cache-plus-redirect key mismatch in CVE-2026-120474 therefore cannot occur. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 undici 6.19.5-tuxcare.6 has no HTTP response-cache interceptor or cache store (introduced in 7.x). Only the redirect interceptor exists. The cache-plus-redirect key mismatch in CVE-2026-120474 therefore cannot occur. Not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-03T11:50:02.760921+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 6.19.5 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-06T12:14:00.044444+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 6.19.5 of undici. not_affected \u2014 The target is undici 6.19.5-tuxcare.6. It has no HTTP cache interceptor (interceptors.cache()), no cache stores and no Cache-Control response parser. The vulnerable parser from the 7.x/8.x line does not exist here, so CVE-2026-14643 does not apply.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 The target is undici 6.19.5-tuxcare.6. It has no HTTP cache interceptor (interceptors.cache()), no cache stores and no Cache-Control response parser. The vulnerable parser from the 7.x/8.x line does not exist here, so CVE-2026-14643 does not apply." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-03T11:50:02.760921+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-03T11:50:02.760921+00:00", "status_notes": "Vulnerability CVE-2026-1525 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-1525" }, "action_statement": "Vulnerability CVE-2026-1525 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-13T12:46:00.149682+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.5.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-03T11:50:02.760921+00:00", "status_notes": "Vulnerability CVE-2026-1527 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-1527" }, "action_statement": "Vulnerability CVE-2026-1527 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-03T11:50:02.760921+00:00", "status_notes": "Vulnerability CVE-2026-1528 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-1528" }, "action_statement": "Vulnerability CVE-2026-1528 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-03T11:50:02.760921+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-03T11:49:00.929976+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:05:18.396710+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 6.19.5 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-12T14:22:02.231466+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.4.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-01T22:53:00.070822+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.1.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-03T11:50:02.760921+00:00", "status_notes": "Vulnerability CVE-2026-22036 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-22036" }, "action_statement": "Vulnerability CVE-2026-22036 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-05T09:25:02.115730+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.3.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.3." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-14T01:25:58.286686+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 6.19.5 of undici. not_affected \u2014 Undici 6.19.5-tuxcare.7 has no deduplicate interceptor. The vulnerable code from CVE-2026-2581 (response accumulation in interceptors.deduplicate()) does not exist in this tree.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 Undici 6.19.5-tuxcare.7 has no deduplicate interceptor. The vulnerable code from CVE-2026-2581 (response accumulation in interceptors.deduplicate()) does not exist in this tree." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-10-12T14:22:02.231466+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.4.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-6734 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2026-6734" }, "action_statement": "Vulnerability CVE-2026-6734 affects version 6.19.5 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-06T13:10:39.482712+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 6.19.5 of undici. not_affected \u2014 The vulnerable component, the `interceptors.decompress()` interceptor, does not exist in undici 6.19.5-tuxcare.6. The only interceptors shipped are redirect, retry and dump. The advisory's flaw is an unbounded decompressed size in that interceptor, so the target is not affected. fetch() has a separate decoder pipeline that is not what this CVE or its fix covers.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 The vulnerable component, the `interceptors.decompress()` interceptor, does not exist in undici 6.19.5-tuxcare.6. The only interceptors shipped are redirect, retry and dump. The advisory's flaw is an unbounded decompressed size in that interceptor, so the target is not affected. fetch() has a separate decoder pipeline that is not what this CVE or its fix covers." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-06T13:02:00.039785+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 6.19.5 of undici. not_affected \u2014 Target is undici 6.19.5-tuxcare.6. It has no HTTP cache interceptor (`interceptors.cache()`), no cache store, and no shared-cache logic. The CVE's vulnerable component, which first appears in the 7.x line, is absent, so the Set-Cookie leak chain cannot exist. The only caching code is the fetch Cache API (`lib/web/cache`), which is a separate component the CVE does not describe.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 Target is undici 6.19.5-tuxcare.6. It has no HTTP cache interceptor (`interceptors.cache()`), no cache store, and no shared-cache logic. The CVE's vulnerable component, which first appears in the 7.x line, is absent, so the Set-Cookie leak chain cannot exist. The only caching code is the fetch Cache API (`lib/web/cache`), which is a separate component the CVE does not describe." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 6.19.5 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 6.19.5 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-06T12:58:00.042642+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 6.19.5 of undici. not_affected \u2014 undici 6.19.5-tuxcare.6 does not ship the HTTP cache interceptor (interceptors.cache(), cache handler, cache stores) that CVE-2026-85008 concerns. The only interceptors exported are redirect, retry and dump. The vulnerable code that stores and replays responses for unsafe methods is absent, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 undici 6.19.5-tuxcare.6 does not ship the HTTP cache interceptor (interceptors.cache(), cache handler, cache stores) that CVE-2026-85008 concerns. The only interceptors exported are redirect, retry and dump. The vulnerable code that stores and replays responses for unsafe methods is absent, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-06T12:42:00.092476+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 6.19.5 of undici. not_affected \u2014 undici 6.19.5-tuxcare.6 has no WebSocketStream implementation. The CVE concerns WebSocketStream, which was introduced in undici 7.0.0, so the vulnerable close handler that aborts a locked writable stream does not exist in this tree. Not affected (Type A1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 undici 6.19.5-tuxcare.6 has no WebSocketStream implementation. The CVE concerns WebSocketStream, which was introduced in undici 7.0.0, so the vulnerable close handler that aborts a locked writable stream does not exist in this tree. Not affected (Type A1)." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 6.19.5 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-14T02:30:33.490414+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 6.19.5 of undici. not_affected \u2014 Target is undici 6.19.5-tuxcare.7. The CVE concerns interceptors.cache() and interceptors.deduplicate(), introduced in 8.10.0 and affecting 8.10.0 and 8.10.1. This tree does not contain them, so the origin-less key flaw cannot exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 6.19.5-tuxcare.7. The CVE concerns interceptors.cache() and interceptors.deduplicate(), introduced in 8.10.0 and affecting 8.10.0 and 8.10.1. This tree does not contain them, so the origin-less key flaw cannot exist." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-09T10:27:00.246457+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.7.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 6.19.5 of undici, and is fixed in 6.19.5-tuxcare.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-06T13:30:25.835538+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 6.19.5 of undici. not_affected \u2014 undici 6.19.5 has no `decompress` interceptor. The interceptors are redirect, retry and dump. The vulnerable pattern, a dispatch-handler wrapper that calls downstream handlers from zlib stream callbacks, is absent. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 undici 6.19.5 has no `decompress` interceptor. The interceptors are redirect, retry and dump. The vulnerable pattern, a dispatch-handler wrapper that calls downstream handlers from zlib stream callbacks, is absent. Not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-14T01:58:18.621399+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 6.19.5 of undici. not_affected \u2014 Not affected. The target is undici 6.19.5 with a TuxCare backport of maxPayloadSize (CVE-2026-12151), not the 8.1.0 line where the regression was introduced. The backport includes a cumulative check across fragments from the start. Separately, a default maxFragments cap of 131072 limits how much an attacker can buffer, so the unbounded-growth goal is blocked. One weakness remains: the cumulativ...", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 Not affected. The target is undici 6.19.5 with a TuxCare backport of maxPayloadSize (CVE-2026-12151), not the 8.1.0 line where the regression was introduced. The backport includes a cumulative check across fragments from the start. Separately, a default maxFragments cap of 131072 limits how much an attacker can buffer, so the unbounded-growth goal is blocked. One weakness remains: the cumulativ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-06T12:26:00.035392+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 6.19.5 of undici. not_affected \u2014 undici 6.19.5 has no HTTP cache interceptor and no code that parses response Cache-Control for storage decisions. The cache interceptor (interceptors.cache()) that CVE-2026-9678 concerns was introduced in the 7.x line, so the vulnerable parsing and storage logic is absent from this target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 undici 6.19.5 has no HTTP cache interceptor and no code that parses response Cache-Control for storage decisions. The cache interceptor (interceptors.cache()) that CVE-2026-9678 concerns was introduced in the 7.x line, so the vulnerable parsing and storage logic is absent from this target." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-09-30T14:14:06.589033+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 6.19.5 of undici. not_affected \u2014 Target version 6.19.5 is not affected by CVE-2026-9679. The vulnerability (percent-decoding cookie values via querystring.unescape, enabling HTTP response header injection) was introduced in undici 7.0.0 via PR #3789 (commit dac8e73d, Oct 30 2024). The target is on a TuxCare maintenance branch that diverged from the upstream main branch before this vulnerability was introduced. The target's coo...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 Target version 6.19.5 is not affected by CVE-2026-9679. The vulnerability (percent-decoding cookie values via querystring.unescape, enabling HTTP response header injection) was introduced in undici 7.0.0 via PR #3789 (commit dac8e73d, Oct 30 2024). The target is on a TuxCare maintenance branch that diverged from the upstream main branch before this vulnerability was introduced. The target's coo..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.5", "identifiers": { "purl": "pkg:npm/undici@6.19.5" } } ], "timestamp": "2026-11-05T09:04:00.091712+00:00", "status_notes": "Vulnerability CVE-2026-9697 affects version 6.19.5 of undici.", "vulnerability": { "name": "CVE-2026-9697" }, "action_statement": "Vulnerability CVE-2026-9697 affects version 6.19.5 of undici." } ] }