{ "@id": "urn:uuid:1df0b8e2-c2e6-4f15-bfab-b4e3043a257e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 43, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T03:05:08.846671+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 6.19.7 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 6.19.7 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 6.19.7 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 6.19.7 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 6.19.7 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 6.19.7 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 6.19.7 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-14T00:11:00.100629+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 6.19.7 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2023-45143 (e041de35, which deletes the cookie header on cross-origin fetch redirects) is already in the shipped upstream release. The target (6.19.7-tuxcare.7) deletes authorization, proxy-authorization, cookie and host on cross-origin redirects in lib/web/fetch/index.js. The dispatcher-level redirect handler also strips cookie when the target origin is u...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2023-45143 (e041de35, which deletes the cookie header on cross-origin fetch redirects) is already in the shipped upstream release. The target (6.19.7-tuxcare.7) deletes authorization, proxy-authorization, cookie and host on cross-origin redirects in lib/web/fetch/index.js. The dispatcher-level redirect handler also strips cookie when the target origin is u..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 6.19.7 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-13T22:25:50.460321+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 6.19.7 of undici. not_affected \u2014 The fix is already in the target. shouldRemoveHeader in lib/handler/redirect-handler.js strips proxy-authorization, along with authorization and cookie, when the redirect goes to a different origin. The fix came from the upstream nodejs/undici release (commit b9da3e40, merge of GHSA-3787-6prv-h9w3). It was in the release before the first TuxCare commit, so this is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 The fix is already in the target. shouldRemoveHeader in lib/handler/redirect-handler.js strips proxy-authorization, along with authorization and cookie, when the redirect goes to a different origin. The fix came from the upstream nodejs/undici release (commit b9da3e40, merge of GHSA-3787-6prv-h9w3). It was in the release before the first TuxCare commit, so this is an upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-14T00:33:00.117062+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 6.19.7 of undici. not_affected \u2014 The undici 6.19.7 target already contains the upstream fix for CVE-2024-30260. On a cross-origin redirect, lib/handler/redirect-handler.js strips authorization, proxy-authorization and cookie from the request headers. The fix commit 68057466 is an ancestor of HEAD and was already in the upstream release before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 The undici 6.19.7 target already contains the upstream fix for CVE-2024-30260. On a cross-origin redirect, lib/handler/redirect-handler.js strips authorization, proxy-authorization and cookie from the request headers. The fix commit 68057466 is an ancestor of HEAD and was already in the upstream release before the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-13T23:48:08.256840+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 6.19.7 of undici. not_affected \u2014 The upstream fix for CVE-2024-30261 (commit d542b8cd, \"Merge pull request from GHSA-9qxr-qj54-h672\", by Matteo Collina) is already in this undici 6.19.7 tree. It rewrote integrity matching in lib/web/fetch/util.js. The first TuxCare commit in HEAD's history (a67a8505) comes after the fix, so the fix shipped in the upstream release. The vulnerable pre-fix code is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2024-30261 (commit d542b8cd, \"Merge pull request from GHSA-9qxr-qj54-h672\", by Matteo Collina) is already in this undici 6.19.7 tree. It rewrote integrity matching in lib/web/fetch/util.js. The first TuxCare commit in HEAD's history (a67a8505) comes after the fix, so the fix shipped in the upstream release. The vulnerable pre-fix code is not present." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 6.19.7 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-09-27T20:51:00.089207+00:00", "status_notes": "Vulnerability CVE-2025-22150 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1.", "vulnerability": { "name": "CVE-2025-22150" }, "action_statement": "Vulnerability CVE-2025-22150 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-09-27T20:51:00.089207+00:00", "status_notes": "Vulnerability CVE-2025-47279 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1.", "vulnerability": { "name": "CVE-2025-47279" }, "action_statement": "Vulnerability CVE-2025-47279 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.6.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:06:00.064776+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 6.19.7 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-06T13:28:52.174352+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 6.19.7 of undici. not_affected \u2014 Not affected. In undici 6.19.7-tuxcare.6, parseMetadata() matches the SRI algorithm token with a case-insensitive regex and lowercases it before the supported-hash lookup. Tokens such as SHA256-... or Sha256-... are therefore recognized and verified, not skipped. The CVE says the regression was introduced in 7.15.0 and that 7.14.0 and earlier lowercase the token. The 6.19.x code matches that ea...", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 Not affected. In undici 6.19.7-tuxcare.6, parseMetadata() matches the SRI algorithm token with a case-insensitive regex and lowercases it before the supported-hash lookup. Tokens such as SHA256-... or Sha256-... are therefore recognized and verified, not skipped. The CVE says the regression was introduced in 7.15.0 and that 7.14.0 and earlier lowercase the token. The 6.19.x code matches that ea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-14T03:05:08.846671+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 6.19.7 of undici. not_affected \u2014 Target is undici 6.19.7-tuxcare.7. The vulnerable HTTP/2 WebSocket path was introduced in 8.11.0 and is absent. In this tree, writeH2 rejects every upgrade request on an HTTP/2 session, so a WebSocket handshake never creates a ClientHttp2Stream.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 6.19.7-tuxcare.7. The vulnerable HTTP/2 WebSocket path was introduced in 8.11.0 and is absent. In this tree, writeH2 rejects every upgrade request on an HTTP/2 session, so a WebSocket handshake never creates a ClientHttp2Stream." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:05:31.171802+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 6.19.7 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-10-27T18:32:18.576206+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.5.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.6.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-09-27T20:51:00.089207+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 6.19.7 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-06T10:28:00.097812+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 6.19.7 of undici. not_affected \u2014 Target is undici 6.19.7-tuxcare.6. The CVE concerns the shared HTTP cache interceptor (introduced in undici 7.x) composed with the redirect interceptor. This tree has no cache interceptor, no cache store, and no code that generates If-None-Match/If-Modified-Since revalidation requests. The vulnerable chain cannot exist, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 Target is undici 6.19.7-tuxcare.6. The CVE concerns the shared HTTP cache interceptor (introduced in undici 7.x) composed with the redirect interceptor. This tree has no cache interceptor, no cache store, and no code that generates If-None-Match/If-Modified-Since revalidation requests. The vulnerable chain cannot exist, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-06T10:16:59.893945+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 6.19.7 of undici. not_affected \u2014 The target is undici 6.19.7-tuxcare.6. It has no HTTP cache interceptor, no cache stores, and no decompress interceptor. These components were added in undici 7.x, and the CVE's chain depends on them. The only built-in interceptors are redirect, retry and dump. The Web Cache API under lib/web/cache is unrelated to dispatcher-level response replay.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 The target is undici 6.19.7-tuxcare.6. It has no HTTP cache interceptor, no cache stores, and no decompress interceptor. These components were added in undici 7.x, and the CVE's chain depends on them. The only built-in interceptors are redirect, retry and dump. The Web Cache API under lib/web/cache is unrelated to dispatcher-level response replay." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-06T10:17:31.948615+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 6.19.7 of undici. not_affected \u2014 Not affected. The target is undici 6.19.7-tuxcare.6, outside the 7.x/8.x affected ranges. Its redirect handler does treat an array as a flat list, but an array of [name, value] tuples is rejected by the Request constructor with a TypeError. Tuple headers therefore never reach the redirect path, and no cross-origin credential leak can occur. This version also has no cache or deduplicate intercep...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 Not affected. The target is undici 6.19.7-tuxcare.6, outside the 7.x/8.x affected ranges. Its redirect handler does treat an array as a flat list, but an array of [name, value] tuples is rejected by the Request constructor with a TypeError. Tuple headers therefore never reach the redirect path, and no cross-origin credential leak can occur. This version also has no cache or deduplicate intercep..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-06T10:19:00.088475+00:00", "status_notes": "Vulnerability CVE-2026-120423 does not affect version 6.19.7 of undici. not_affected \u2014 undici 6.19.7-tuxcare.6 still splits SRI metadata on a single space (lib/web/fetch/util.js:637), but the SRI bypass does not work here. The token regex at util.js:622 is unanchored and tolerates surrounding whitespace, so a digest preceded or followed by a tab or other whitespace is still parsed and enforced. I ran bytesMatch against a mismatching body with several whitespace variants, and it r...", "vulnerability": { "name": "CVE-2026-120423" }, "impact_statement": "not_affected \u2014 undici 6.19.7-tuxcare.6 still splits SRI metadata on a single space (lib/web/fetch/util.js:637), but the SRI bypass does not work here. The token regex at util.js:622 is unanchored and tolerates surrounding whitespace, so a digest preceded or followed by a tab or other whitespace is still parsed and enforced. I ran bytesMatch against a mismatching body with several whitespace variants, and it r..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-06T10:12:00.053178+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 6.19.7 of undici. not_affected \u2014 Target is undici 6.19.7-tuxcare.6. The vulnerable feature, the shared HTTP response-cache interceptor (interceptors.cache plus its cache stores), does not exist in the 6.x line, so redirect-plus-cache aliasing cannot occur. The advisory covers 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3 only.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 Target is undici 6.19.7-tuxcare.6. The vulnerable feature, the shared HTTP response-cache interceptor (interceptors.cache plus its cache stores), does not exist in the 6.x line, so redirect-plus-cache aliasing cannot occur. The advisory covers 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3 only." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-09-27T20:51:00.089207+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 6.19.7 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-06T12:21:00.044836+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 6.19.7 of undici. not_affected \u2014 Target is undici 6.19.7-tuxcare.6, which has no HTTP cache interceptor, Cache-Control directive parser, or cache stores. The flawed qualified no-cache/private parsing in CVE-2026-14643 exists only in the 7.x/8.x cache interceptor (the advisory fixes are 7.29.0 and 8.9.0), so the code is absent here.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 Target is undici 6.19.7-tuxcare.6, which has no HTTP cache interceptor, Cache-Control directive parser, or cache stores. The flawed qualified no-cache/private parsing in CVE-2026-14643 exists only in the 7.x/8.x cache interceptor (the advisory fixes are 7.29.0 and 8.9.0), so the code is absent here." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-09-27T20:51:00.089207+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-09-27T20:51:00.089207+00:00", "status_notes": "Vulnerability CVE-2026-1525 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1.", "vulnerability": { "name": "CVE-2026-1525" }, "action_statement": "Vulnerability CVE-2026-1525 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-10-01T13:26:37.692920+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.2.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-09-27T20:51:00.089207+00:00", "status_notes": "Vulnerability CVE-2026-1527 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1.", "vulnerability": { "name": "CVE-2026-1527" }, "action_statement": "Vulnerability CVE-2026-1527 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-09-27T20:51:00.089207+00:00", "status_notes": "Vulnerability CVE-2026-1528 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1.", "vulnerability": { "name": "CVE-2026-1528" }, "action_statement": "Vulnerability CVE-2026-1528 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-09-27T20:51:00.089207+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-09-27T20:51:00.089207+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:05:18.396710+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 6.19.7 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-10-12T09:52:00.156667+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.4.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-10-01T13:26:37.692920+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.2.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-09-27T20:51:00.089207+00:00", "status_notes": "Vulnerability CVE-2026-22036 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1.", "vulnerability": { "name": "CVE-2026-22036" }, "action_statement": "Vulnerability CVE-2026-22036 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-09-27T20:51:00.089207+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-14T01:40:23.313914+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 6.19.7 of undici. not_affected \u2014 Undici 6.19.7-tuxcare.7 has no deduplicate interceptor or deduplication handler. The code the CVE and patch modify does not exist here, so the vulnerability is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 Undici 6.19.7-tuxcare.7 has no deduplicate interceptor or deduplication handler. The code the CVE and patch modify does not exist here, so the vulnerability is not present." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-10-10T11:21:00.091415+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.3.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-6734 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2026-6734" }, "action_statement": "Vulnerability CVE-2026-6734 affects version 6.19.7 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-06T13:10:39.482712+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 6.19.7 of undici. not_affected \u2014 CVE-2026-84890 affects only the interceptors.decompress() interceptor (lib/interceptor/decompress.js). This undici 6.19.7-tuxcare tree has no such interceptor, so the vulnerable component is absent. Only redirect, retry and dump interceptors exist. The vendor fix commits touch only lib/interceptor/decompress.js plus its docs, tests and types. Those commits are not ancestors of HEAD, because the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 CVE-2026-84890 affects only the interceptors.decompress() interceptor (lib/interceptor/decompress.js). This undici 6.19.7-tuxcare tree has no such interceptor, so the vulnerable component is absent. Only redirect, retry and dump interceptors exist. The vendor fix commits touch only lib/interceptor/decompress.js plus its docs, tests and types. Those commits are not ancestors of HEAD, because the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-06T13:02:26.327888+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 6.19.7 of undici. not_affected \u2014 undici 6.19.7-tuxcare.6 has no HTTP cache interceptor (interceptors.cache) and no shared/private cache store. Only redirect, retry and dump interceptors exist. The component that CVE-2026-84933 concerns is absent, so the target is not affected (Type A1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 undici 6.19.7-tuxcare.6 has no HTTP cache interceptor (interceptors.cache) and no shared/private cache store. Only redirect, retry and dump interceptors exist. The component that CVE-2026-84933 concerns is absent, so the target is not affected (Type A1)." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 6.19.7 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 6.19.7 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-06T12:58:53.206755+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 6.19.7 of undici. not_affected \u2014 The target is undici 6.19.7-tuxcare.6. It has no HTTP cache interceptor, so the vulnerable code is not present. interceptors.cache(), the cache handler and the cache stores were added in the 7.x line. The patch URLs could not be fetched, so the brief rests on the CVE text and its description of the fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 The target is undici 6.19.7-tuxcare.6. It has no HTTP cache interceptor, so the vulnerable code is not present. interceptors.cache(), the cache handler and the cache stores were added in the 7.x line. The patch URLs could not be fetched, so the brief rests on the CVE text and its description of the fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-06T12:45:34.125314+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 6.19.7 of undici. not_affected \u2014 Target is undici 6.19.7-tuxcare.6. The WebSocketStream API, which was introduced in undici 7.0.0, does not exist in this tree. The only WebSocket implementation is the classic WebSocket class, which has no writable-stream or writer-lock abort path. The vulnerable pattern is absent, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 Target is undici 6.19.7-tuxcare.6. The WebSocketStream API, which was introduced in undici 7.0.0, does not exist in this tree. The only WebSocket implementation is the classic WebSocket class, which has no writable-stream or writer-lock abort path. The vulnerable pattern is absent, so the target is not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 6.19.7 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-14T02:34:53.666741+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 6.19.7 of undici. not_affected \u2014 Target is undici 6.19.7-tuxcare.7. The vulnerable feature, interceptors.cache() and interceptors.deduplicate() (introduced in undici 8.10.0), does not exist in this tree. The only interceptors are dump, redirect and retry.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 6.19.7-tuxcare.7. The vulnerable feature, interceptors.cache() and interceptors.deduplicate() (introduced in undici 8.10.0), does not exist in this tree. The only interceptors are dump, redirect and retry." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-09T11:03:51.417884+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.7.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 6.19.7 of undici, and is fixed in 6.19.7-tuxcare.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-06T13:36:00.057506+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 6.19.7 of undici. not_affected \u2014 undici 6.19.7-tuxcare.6 has no `decompress` interceptor, so the flaw is not present. `lib/interceptor` holds only dump, redirect, redirect-interceptor and retry, and `index.js` exports only redirect, retry and dump. The CVE needs the decompress interceptor to call a downstream handler from zlib stream callbacks. That component was added in 7.x and does not exist here. The patch diff was not ava...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 undici 6.19.7-tuxcare.6 has no `decompress` interceptor, so the flaw is not present. `lib/interceptor` holds only dump, redirect, redirect-interceptor and retry, and `index.js` exports only redirect, retry and dump. The CVE needs the decompress interceptor to call a downstream handler from zlib stream callbacks. That component was added in 7.x and does not exist here. The patch diff was not ava..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:04:00.091712+00:00", "status_notes": "Vulnerability CVE-2026-9675 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2026-9675" }, "action_statement": "Vulnerability CVE-2026-9675 affects version 6.19.7 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-06T12:31:33.338681+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 6.19.7 of undici. not_affected \u2014 Target is undici 6.19.7-tuxcare.6. It has no HTTP cache interceptor (interceptors.cache()) and no response Cache-Control parser, so the whitespace-padded private/no-cache field-name flaw cannot occur. The advisory's fix is in undici 7.28.0 and 8.5.0, where the cache interceptor exists. I could not read the patch diff, only its URLs, so the patch brief rests on the CVE text.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Target is undici 6.19.7-tuxcare.6. It has no HTTP cache interceptor (interceptors.cache()) and no response Cache-Control parser, so the whitespace-padded private/no-cache field-name flaw cannot occur. The advisory's fix is in undici 7.28.0 and 8.5.0, where the cache interceptor exists. I could not read the patch diff, only its URLs, so the patch brief rests on the CVE text." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-10-09T08:57:00.112786+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 6.19.7 of undici. not_affected \u2014 Target version 6.19.7-tuxcare.2 is NOT vulnerable to CVE-2026-9679. The vulnerable code pattern (percent-decoding cookie values via qsUnescape) was never present in any v6.x release. The CVE explicitly states the vulnerability was \"introduced in undici 7.0.0 via #3789\" (commit dac8e73d). Version 6.19.7, tagged on Aug 9, 2024, predates v7.0.0 and lacks the vulnerable code entirely. The current c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 Target version 6.19.7-tuxcare.2 is NOT vulnerable to CVE-2026-9679. The vulnerable code pattern (percent-decoding cookie values via qsUnescape) was never present in any v6.x release. The CVE explicitly states the vulnerability was \"introduced in undici 7.0.0 via #3789\" (commit dac8e73d). Version 6.19.7, tagged on Aug 9, 2024, predates v7.0.0 and lacks the vulnerable code entirely. The current c..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.19.7", "identifiers": { "purl": "pkg:npm/undici@6.19.7" } } ], "timestamp": "2026-11-05T09:04:00.091712+00:00", "status_notes": "Vulnerability CVE-2026-9697 affects version 6.19.7 of undici.", "vulnerability": { "name": "CVE-2026-9697" }, "action_statement": "Vulnerability CVE-2026-9697 affects version 6.19.7 of undici." } ] }