{ "@id": "urn:uuid:a3ba2f30-ba46-4abd-8989-da37cb56ef84", "role": "Document Creator", "author": "https://tuxcare.com", "version": 47, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T15:44:00.094500+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 6.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 6.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 6.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 6.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 6.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 6.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 6.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T00:13:27.422359+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 6.23.0 of undici. not_affected \u2014 undici 6.23.0 already contains the upstream fix for CVE-2023-45143 (commit e041de35, GHSA-wqq4-5wpv-mx2g). On a cross-origin redirect, lib/web/fetch/index.js deletes authorization, proxy-authorization, cookie and host headers. The fix shipped in the upstream release, and HEAD has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 undici 6.23.0 already contains the upstream fix for CVE-2023-45143 (commit e041de35, GHSA-wqq4-5wpv-mx2g). On a cross-origin redirect, lib/web/fetch/index.js deletes authorization, proxy-authorization, cookie and host headers. The fix shipped in the upstream release, and HEAD has no TuxCare-domain commits." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 6.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T22:29:41.364992+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 6.23.0 of undici. not_affected \u2014 undici 6.23.0 already strips proxy-authorization on cross-origin redirects. The fix, upstream commit e041de35 (GHSA-wqq4-5wpv-mx2g), shipped in the upstream release that TuxCare onboarded, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 undici 6.23.0 already strips proxy-authorization on cross-origin redirects. The fix, upstream commit e041de35 (GHSA-wqq4-5wpv-mx2g), shipped in the upstream release that TuxCare onboarded, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T00:43:00.083587+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 6.23.0 of undici. not_affected \u2014 Not affected. Target undici 6.23.0 already contains the upstream fix for CVE-2024-30260. The redirect handler strips authorization, proxy-authorization and cookie headers when a redirect crosses origins. The fix commit 6805746680d27a5369d7fb67bc05f95a28247d75 is an ancestor of HEAD and was authored upstream (hello@matteocollina.com). HEAD has no commit from a TuxCare domain.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 Not affected. Target undici 6.23.0 already contains the upstream fix for CVE-2024-30260. The redirect handler strips authorization, proxy-authorization and cookie headers when a redirect crosses origins. The fix commit 6805746680d27a5369d7fb67bc05f95a28247d75 is an ancestor of HEAD and was authored upstream (hello@matteocollina.com). HEAD has no commit from a TuxCare domain." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T23:42:23.236565+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 6.23.0 of undici. not_affected \u2014 Undici 6.23.0 already contains the upstream CVE-2024-30261 fix (commit d542b8cd, GHSA-9qxr-qj54-h672, released in v6.11.1). The strongest-hash selection and filtering in lib/web/fetch/util.js match the patched logic. The fix was authored upstream and shipped in the release. No TuxCare-domain commit exists in HEAD's history, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Undici 6.23.0 already contains the upstream CVE-2024-30261 fix (commit d542b8cd, GHSA-9qxr-qj54-h672, released in v6.11.1). The strongest-hash selection and filtering in lib/web/fetch/util.js match the patched logic. The fix was authored upstream and shipped in the release. No TuxCare-domain commit exists in HEAD's history, so the verdict is not_affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 6.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T21:31:44.249794+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 6.23.0 of undici. not_affected \u2014 Not affected. The multipart/form-data boundary in lib/web/fetch/body.js is generated with crypto.randomInt, a CSPRNG, not Math.random. The upstream fix (c3acc605, Matteo Collina, \"Merge commit from fork\") is already part of the 6.23.0 release this target is built from, so no TuxCare backport is involved.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 Not affected. The multipart/form-data boundary in lib/web/fetch/body.js is generated with crypto.randomInt, a CSPRNG, not Math.random. The upstream fix (c3acc605, Matteo Collina, \"Merge commit from fork\") is already part of the 6.23.0 release this target is built from, so no TuxCare backport is involved." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T21:41:43.943334+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 6.23.0 of undici. not_affected \u2014 undici 6.23.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit 133387138c91). Pool's constructor registers a 'connectionError' listener that removes failed clients from the pool's client list, so failed-TLS clients no longer accumulate. The fix shipped in the upstream release. HEAD has no TuxCare-authored commits, so it is an upstream fix and not an already_f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 undici 6.23.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit 133387138c91). Pool's constructor registers a 'connectionError' listener that removes failed clients from the pool's client list, so failed-TLS clients no longer accumulate. The fix shipped in the upstream release. HEAD has no TuxCare-authored commits, so it is an upstream fix and not an already_f..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-10-16T20:22:00.069315+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 6.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T21:14:55.144640+00:00", "status_notes": "Vulnerability CVE-2026-109829 does not affect version 6.23.0 of undici. not_affected \u2014 The target is undici 6.23.0, which has no HTTP cache interceptor and no shared cache stores. The CVE says the cache interceptor was introduced in 7.0.0, and the repo confirms it is absent. The flaw needs compose(redirect(), cache()) with a shared MemoryCacheStore or SqliteCacheStore, so the vulnerable chain cannot be built here. The only 'cache' code is the WHATWG Cache API in lib/web/cache, wh...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109829" }, "impact_statement": "not_affected \u2014 The target is undici 6.23.0, which has no HTTP cache interceptor and no shared cache stores. The CVE says the cache interceptor was introduced in 7.0.0, and the repo confirms it is absent. The flaw needs compose(redirect(), cache()) with a shared MemoryCacheStore or SqliteCacheStore, so the vulnerable chain cannot be built here. The only 'cache' code is the WHATWG Cache API in lib/web/cache, wh..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T21:17:27.820564+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 6.23.0 of undici. not_affected \u2014 Target is undici 6.23.0 (v6 line). The CVE regression was introduced in 7.15.0 and releases up to 7.14.0 are unaffected. In the target, parseMetadata() lowercases the algorithm token before checking it against the supported hash list, so SHA256-/Sha256- tokens are recognized and verified, not skipped. A response body that does not match the pinned digest is not accepted. Residual case sensitivi...", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 Target is undici 6.23.0 (v6 line). The CVE regression was introduced in 7.15.0 and releases up to 7.14.0 are unaffected. In the target, parseMetadata() lowercases the algorithm token before checking it against the supported hash list, so SHA256-/Sha256- tokens are recognized and verified, not skipped. A response body that does not match the pinned digest is not accepted. Residual case sensitivi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T02:59:44.828253+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 6.23.0 of undici. not_affected \u2014 Not affected. undici 6.23.0 has no WebSocket-over-HTTP/2 support, which was added in 8.11.0 and is where the regression was introduced. In this version an upgrade request over H2 is rejected up front, and allowH2 is false by default. The vulnerable code path is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Not affected. undici 6.23.0 has no WebSocket-over-HTTP/2 support, which was added in 8.11.0 and is where the regression was introduced. In this version an upgrade request over H2 is rejected up front, and allowH2 is false by default. The vulnerable code path is absent." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-10-16T20:22:00.069315+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 6.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T15:44:00.094500+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 6.23.0 of undici, and is fixed in 6.23.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 6.23.0 of undici, and is fixed in 6.23.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T15:44:00.094500+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 6.23.0 of undici, and is fixed in 6.23.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 6.23.0 of undici, and is fixed in 6.23.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-10-15T12:23:19.034848+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 6.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 6.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T21:25:37.080118+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 6.23.0 of undici. not_affected \u2014 undici 6.23.0 does not ship the shared HTTP cache interceptor, which exists only from 7.0.0. The vulnerable chain needs a cache layer that generates If-None-Match / If-Modified-Since validators and composes with the redirect interceptor. That layer is absent, so the target is not affected. I could not fetch the patch URLs, so I reasoned from the CVE text and the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 undici 6.23.0 does not ship the shared HTTP cache interceptor, which exists only from 7.0.0. The vulnerable chain needs a cache layer that generates If-None-Match / If-Modified-Since validators and composes with the redirect interceptor. That layer is absent, so the target is not affected. I could not fetch the patch URLs, so I reasoned from the CVE text and the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T21:23:00.051505+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 6.23.0 of undici. not_affected \u2014 Target is undici 6.23.0. CVE-2026-120222 affects the HTTP cache interceptor, which exists only in undici 7.x and 8.x. The v6 tree has no cache interceptor, cache store, cache-replay handler or decompress interceptor, so the vulnerable replay path is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 Target is undici 6.23.0. CVE-2026-120222 affects the HTTP cache interceptor, which exists only in undici 7.x and 8.x. The v6 tree has no cache interceptor, cache store, cache-replay handler or decompress interceptor, so the vulnerable replay path is absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T21:23:56.359249+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 6.23.0 of undici. not_affected \u2014 Target is undici 6.23.0. The CVE concerns 7.x/8.x. RedirectHandler.cleanRequestHeaders does read arrays as flat name/value lists, but a tuple-array header input cannot get through the target's own request construction to a redirect. The core Request constructor rejects it before any request is sent. The target also has no cache or deduplicate interceptor to re-serialize retained headers. The cr...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 Target is undici 6.23.0. The CVE concerns 7.x/8.x. RedirectHandler.cleanRequestHeaders does read arrays as flat name/value lists, but a tuple-array header input cannot get through the target's own request construction to a redirect. The core Request constructor rejects it before any request is sent. The target also has no cache or deduplicate interceptor to re-serialize retained headers. The cr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T21:25:37.080118+00:00", "status_notes": "Vulnerability CVE-2026-120423 does not affect version 6.23.0 of undici. not_affected \u2014 The target (undici 6.23.0) has the same single-space split in parseMetadata (lib/web/fetch/util.js:637). It does not exhibit the CVE's bypass, because the per-token hash-with-options regex is unanchored. A digest preceded or followed by a tab, newline or other whitespace is still recognized and enforced. Running bytesMatch on a mismatching body with whitespace-surrounded valid SRI returns false...", "vulnerability": { "name": "CVE-2026-120423" }, "impact_statement": "not_affected \u2014 The target (undici 6.23.0) has the same single-space split in parseMetadata (lib/web/fetch/util.js:637). It does not exhibit the CVE's bypass, because the per-token hash-with-options regex is unanchored. A digest preceded or followed by a tab, newline or other whitespace is still recognized and enforced. Running bytesMatch on a mismatching body with whitespace-surrounded valid SRI returns false..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T21:20:59.401455+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 6.23.0 of undici. not_affected \u2014 Target is undici 6.23.0. The HTTP response-cache interceptor (interceptors.cache, CacheHandler, cache stores) that the CVE requires does not exist in this tree. The CVE affects only 7.0.0-7.30.1 and 8.0.0-8.12.3, which are the lines that ship that cache interceptor. The redirect interceptor is present but has no shared response cache to poison.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 Target is undici 6.23.0. The HTTP response-cache interceptor (interceptors.cache, CacheHandler, cache stores) that the CVE requires does not exist in this tree. The CVE affects only 7.0.0-7.30.1 and 8.0.0-8.12.3, which are the lines that ship that cache interceptor. The redirect interceptor is present but has no shared response cache to poison." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-10-15T12:23:19.034848+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 6.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T04:01:20.773251+00:00", "status_notes": "Vulnerability CVE-2026-13697 does not affect version 6.23.0 of undici. not_affected \u2014 undici 6.23.0 has no HTTP cache interceptor and no lib/util/cache.js Cache-Control parser. The cache interceptor was added in the 7.x line. The flawed code path (private=\"\" stored in the shared cache, and the private/private=\"x\" concat crash) is absent, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-13697" }, "impact_statement": "not_affected \u2014 undici 6.23.0 has no HTTP cache interceptor and no lib/util/cache.js Cache-Control parser. The cache interceptor was added in the 7.x line. The flawed code path (private=\"\" stored in the shared cache, and the private/private=\"x\" concat crash) is absent, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T04:01:41.712738+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 6.23.0 of undici. not_affected \u2014 undici 6.23.0 has no HTTP cache interceptor (`interceptors.cache()`), no shared-cache store, and no response Cache-Control directive parser. The code CVE-2026-14643 fixes is absent, so this version is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 undici 6.23.0 has no HTTP cache interceptor (`interceptors.cache()`), no shared-cache store, and no response Cache-Control directive parser. The code CVE-2026-14643 fixes is absent, so this version is not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-10-15T12:23:19.034848+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 6.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T15:44:00.094500+00:00", "status_notes": "Vulnerability CVE-2026-1525 affects version 6.23.0 of undici, and is fixed in 6.23.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-1525" }, "action_statement": "Vulnerability CVE-2026-1525 affects version 6.23.0 of undici, and is fixed in 6.23.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-10-15T12:28:47.949005+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 6.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T15:44:00.094500+00:00", "status_notes": "Vulnerability CVE-2026-1527 affects version 6.23.0 of undici, and is fixed in 6.23.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-1527" }, "action_statement": "Vulnerability CVE-2026-1527 affects version 6.23.0 of undici, and is fixed in 6.23.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-10-15T12:28:47.949005+00:00", "status_notes": "Vulnerability CVE-2026-1528 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2026-1528" }, "action_statement": "Vulnerability CVE-2026-1528 affects version 6.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-10-15T12:23:19.034848+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 6.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-10-15T12:23:19.034848+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 6.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-05T09:05:31.171802+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 6.23.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T15:44:00.094500+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 6.23.0 of undici, and is fixed in 6.23.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 6.23.0 of undici, and is fixed in 6.23.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T15:44:00.094500+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 6.23.0 of undici, and is fixed in 6.23.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 6.23.0 of undici, and is fixed in 6.23.0-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T21:47:00.051716+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 6.23.0 of undici. not_affected \u2014 The target (undici 6.23.0) already contains the upstream fix for CVE-2026-22036. fetch() now rejects any response whose Content-Encoding lists more than 5 codings, before any decoder is built. The fix commit d3aafea7 was authored upstream by Matteo Collina and shipped in the 6.23.0 release. TuxCare did not add it.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 The target (undici 6.23.0) already contains the upstream fix for CVE-2026-22036. fetch() now rejects any response whose Content-Encoding lists more than 5 codings, before any decoder is built. The fix commit d3aafea7 was authored upstream by Matteo Collina and shipped in the 6.23.0 release. TuxCare did not add it." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-10-15T12:28:47.949005+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 6.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T01:40:03.504280+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 6.23.0 of undici. not_affected \u2014 undici 6.23.0 has no deduplicate interceptor, so the CVE-2026-2581 flaw cannot occur here. The CVE concerns interceptors.deduplicate() buffering full response bodies for concurrent identical requests. The target's interceptors export contains only redirect, retry, dump and dns, and there is no deduplication code anywhere in lib/, types/ or docs/.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 undici 6.23.0 has no deduplicate interceptor, so the CVE-2026-2581 flaw cannot occur here. The CVE concerns interceptors.deduplicate() buffering full response bodies for concurrent identical requests. The target's interceptors export contains only redirect, retry, dump and dns, and there is no deduplication code anywhere in lib/, types/ or docs/." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-10-15T12:23:19.034848+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 6.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T03:43:00.043161+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 6.23.0 of undici. not_affected \u2014 The target is undici 6.23.0. It has no Socks5ProxyAgent and no SOCKS5 code of any kind. CVE-2026-6734 was introduced in 7.23.0 by PR #4385, which added Socks5ProxyAgent, so a 6.x tree never had the vulnerable component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 The target is undici 6.23.0. It has no Socks5ProxyAgent and no SOCKS5 code of any kind. CVE-2026-6734 was introduced in 7.23.0 by PR #4385, which added Socks5ProxyAgent, so a 6.x tree never had the vulnerable component." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T20:49:50.518578+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 6.23.0 of undici. not_affected \u2014 The affected component, the `interceptors.decompress()` interceptor, does not exist in undici 6.23.0. The upstream fix adds a `maxSize` limit to that interceptor, so there is nothing to patch here. The 6.x interceptors export is only redirect, retry, dump and dns. fetch() does decompress responses with no output cap, but that is separate Web-standard code the advisory and patch do not cover.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 The affected component, the `interceptors.decompress()` interceptor, does not exist in undici 6.23.0. The upstream fix adds a `maxSize` limit to that interceptor, so there is nothing to patch here. The 6.x interceptors export is only redirect, retry, dump and dns. fetch() does decompress responses with no output cap, but that is separate Web-standard code the advisory and patch do not cover." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T20:43:37.800265+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 6.23.0 of undici. not_affected \u2014 undici 6.23.0 does not ship the HTTP cache interceptor (interceptors.cache / shared cache store). CVE-2026-84933 concerns that component, which was added in the 7.x line, so the vulnerable code is absent from this tree.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 undici 6.23.0 does not ship the HTTP cache interceptor (interceptors.cache / shared cache store). CVE-2026-84933 concerns that component, which was added in the 7.x line, so the vulnerable code is absent from this tree." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 6.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T20:42:00.077125+00:00", "status_notes": "Vulnerability CVE-2026-84961 does not affect version 6.23.0 of undici. not_affected \u2014 undici 6.23.0 BalancedPool does not JSON-clone its constructor options, so function-valued connect/tls options (e.g. checkServerIdentity, custom connector) are not dropped. BalancedPool passes a shallow copy to each per-upstream Pool, and Pool destructures connect/tls before its own deepClone. The vulnerable chain step is absent, so the TLS callback is preserved and the CVE does not apply to th...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-84961" }, "impact_statement": "not_affected \u2014 undici 6.23.0 BalancedPool does not JSON-clone its constructor options, so function-valued connect/tls options (e.g. checkServerIdentity, custom connector) are not dropped. BalancedPool passes a shallow copy to each per-upstream Pool, and Pool destructures connect/tls before its own deepClone. The vulnerable chain step is absent, so the TLS callback is preserved and the CVE does not apply to th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T20:33:00.084290+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 6.23.0 of undici. not_affected \u2014 Target is undici 6.23.0, which has no `interceptors.cache()`, no cache store (MemoryCacheStore/SqliteCacheStore), no cache handler and no `canCacheResponse`. The vulnerable HTTP cache interceptor was added in later releases (7.x/8.x), so the flaw cannot occur here.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 Target is undici 6.23.0, which has no `interceptors.cache()`, no cache store (MemoryCacheStore/SqliteCacheStore), no cache handler and no `canCacheResponse`. The vulnerable HTTP cache interceptor was added in later releases (7.x/8.x), so the flaw cannot occur here." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T20:19:00.066324+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 6.23.0 of undici. not_affected \u2014 Target is undici 6.23.0. The CVE concerns WebSocketStream, which was introduced in undici 7.0.0. The target has no WebSocketStream implementation, so the vulnerable socket-close handler that calls abort() on a locked writable stream does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 Target is undici 6.23.0. The CVE concerns WebSocketStream, which was introduced in undici 7.0.0. The target has no WebSocketStream implementation, so the vulnerable socket-close handler that calls abort() on a locked writable stream does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T02:22:26.105847+00:00", "status_notes": "Vulnerability CVE-2026-85024 does not affect version 6.23.0 of undici. not_affected \u2014 undici 6.23.0 is not affected by the CVE-2026-85024 crash. The vulnerable code is the decompressed-size-limit cleanup that calls removeAllListeners() on the internal InflateRaw and so drops its 'error' listener. lib/web/websocket/permessage-deflate.js in this tree has no size limit and no such cleanup, and its 'error' listener is never removed. The patch diffs were not available (URLs only), so...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-85024" }, "impact_statement": "not_affected \u2014 undici 6.23.0 is not affected by the CVE-2026-85024 crash. The vulnerable code is the decompressed-size-limit cleanup that calls removeAllListeners() on the internal InflateRaw and so drops its 'error' listener. lib/web/websocket/permessage-deflate.js in this tree has no size limit and no such cleanup, and its 'error' listener is never removed. The patch diffs were not available (URLs only), so..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T02:42:09.185511+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 6.23.0 of undici. not_affected \u2014 Target is undici 6.23.0. The `interceptors.cache()` and `interceptors.deduplicate()` interceptors, and the cache store and key-building code the fix patches, do not exist in this tree. They were introduced in 8.10.0, so the cross-origin key-collision flaw cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 6.23.0. The `interceptors.cache()` and `interceptors.deduplicate()` interceptors, and the cache store and key-building code the fix patches, do not exist in this tree. They were introduced in 8.10.0, so the cross-origin key-collision flaw cannot occur." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-10-16T20:08:00.152629+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 6.23.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 6.23.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T21:20:05.659204+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 6.23.0 of undici. not_affected \u2014 undici 6.23.0 has no `decompress` interceptor. lib/interceptor contains only dns, dump, redirect, response-error and retry, and index.js exports only redirect, retry, dump and dns. The only zlib use for HTTP responses is fetch's pipeline of decoders, which has an error callback and is not composed with a throwing dispatch handler. The flawed chain (zlib callback \u2192 downstream handler that throws...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 undici 6.23.0 has no `decompress` interceptor. lib/interceptor contains only dns, dump, redirect, response-error and retry, and index.js exports only redirect, retry, dump and dns. The only zlib use for HTTP responses is fetch's pipeline of decoders, which has an error callback and is not composed with a throwing dispatch handler. The flawed chain (zlib callback \u2192 downstream handler that throws..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T02:06:45.296491+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 6.23.0 of undici. not_affected \u2014 Target is undici 6.23.0. CVE-2026-9675 is a regression specific to undici 8.1.0, where the `maxPayloadSize` feature was added with a per-frame check but no cumulative check across fragments. The 6.x and 7.x lines are unaffected. This tree has no `maxPayloadSize` feature, so the regressed code is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 Target is undici 6.23.0. CVE-2026-9675 is a regression specific to undici 8.1.0, where the `maxPayloadSize` feature was added with a per-frame check but no cumulative check across fragments. The 6.x and 7.x lines are unaffected. This tree has no `maxPayloadSize` feature, so the regressed code is absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T20:11:32.988243+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 6.23.0 of undici. not_affected \u2014 Target is undici 6.23.0 (same product as the advisory). It has no HTTP cache interceptor, no shared-cache mode and no Cache-Control directive parser, so the whitespace-padded private/no-cache qualified-name flaw (CVE-2026-9678) cannot occur. The only cache code is the WHATWG Cache API in lib/web/cache, which is a different feature.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Target is undici 6.23.0 (same product as the advisory). It has no HTTP cache interceptor, no shared-cache mode and no Cache-Control directive parser, so the whitespace-padded private/no-cache qualified-name flaw (CVE-2026-9678) cannot occur. The only cache code is the WHATWG Cache API in lib/web/cache, which is a different feature." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-14T03:27:00.044993+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 6.23.0 of undici. not_affected \u2014 undici 6.23.0 does not percent-decode cookie values. The CVE says the decoding was introduced in 7.0.0 by PR #3789, and the 6.x cookie parser never had it. parseSetCookie returns the raw trimmed value, and it rejects any header containing raw CTL characters (CR, LF, NUL).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 undici 6.23.0 does not percent-decode cookie values. The CVE says the decoding was introduced in 7.0.0 by PR #3789, and the 6.x cookie parser never had it. parseSetCookie returns the raw trimmed value, and it rejects any header containing raw CTL characters (CR, LF, NUL)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.23.0", "identifiers": { "purl": "pkg:npm/undici@6.23.0" } } ], "timestamp": "2026-11-13T20:14:00.045604+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 6.23.0 of undici. not_affected \u2014 undici 6.23.0 has no SOCKS5 support (it was added in 7.23.0), so the SOCKS5 path that drops requestTls does not exist here. ProxyAgent only supports HTTP CONNECT tunneling, and that path passes requestTls to the target TLS handshake.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 undici 6.23.0 has no SOCKS5 support (it was added in 7.23.0), so the SOCKS5 path that drops requestTls does not exist here. ProxyAgent only supports HTTP CONNECT tunneling, and that path passes requestTls to the target TLS handshake." } ] }