{ "@id": "urn:uuid:0871c260-7d86-4778-973f-1beeaa3ee4ba", "role": "Document Creator", "author": "https://tuxcare.com", "version": 52, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T15:58:50.517307+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 6.24.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 6.24.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 6.24.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 6.24.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 6.24.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 6.24.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 6.24.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T23:59:00.074519+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 6.24.1 of undici. not_affected \u2014 Undici 6.24.1 already deletes cookie and proxy-authorization, along with authorization, from the request header list on cross-origin redirects in fetch. The fix commit e041de35 (upstream, nodejs/undici, GHSA-wqq4-5wpv-mx2g) is an ancestor of HEAD. No TuxCare-domain commit exists in HEAD's history, so this is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Undici 6.24.1 already deletes cookie and proxy-authorization, along with authorization, from the request header list on cross-origin redirects in fetch. The fix commit e041de35 (upstream, nodejs/undici, GHSA-wqq4-5wpv-mx2g) is an ancestor of HEAD. No TuxCare-domain commit exists in HEAD's history, so this is an upstream fix." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 6.24.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T22:18:00.036497+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 6.24.1 of undici. not_affected \u2014 Target undici 6.24.1 already strips Proxy-Authorization on cross-origin redirects in both redirect paths. The upstream fix (b9da3e40, Matteo Collina) is an ancestor of HEAD, and HEAD's history contains no TuxCare commits, so the fix shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Target undici 6.24.1 already strips Proxy-Authorization on cross-origin redirects in both redirect paths. The upstream fix (b9da3e40, Matteo Collina) is an ancestor of HEAD, and HEAD's history contains no TuxCare commits, so the fix shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-14T00:26:22.471851+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 6.24.1 of undici. not_affected \u2014 The upstream fix (6805746, adds proxy-authorization to the headers stripped on cross-origin redirects) is already present in HEAD. It shipped in the upstream undici 6.24.1 release that TuxCare onboarded, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 The upstream fix (6805746, adds proxy-authorization to the headers stripped on cross-origin redirects) is already present in HEAD. It shipped in the upstream undici 6.24.1 release that TuxCare onboarded, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T23:33:00.074877+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 6.24.1 of undici. not_affected \u2014 The upstream fix for CVE-2024-30261 (undici commit d542b8cd, GHSA-9qxr-qj54-h672) is already in this undici 6.24.1 tree. Its author is Matteo Collina, and it shipped in the upstream release. Integrity metadata parsing in lib/web/fetch/util.js now keeps only supported sha256/sha384/sha512 tokens, and the strongest-hash selection works on those tokens only.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2024-30261 (undici commit d542b8cd, GHSA-9qxr-qj54-h672) is already in this undici 6.24.1 tree. Its author is Matteo Collina, and it shipped in the upstream release. Integrity metadata parsing in lib/web/fetch/util.js now keeps only supported sha256/sha384/sha512 tokens, and the strongest-hash selection works on those tokens only." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 6.24.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T21:30:26.243563+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 already generates the multipart/form-data boundary with crypto.randomInt. This is the upstream fix (c3acc605, Matteo Collina), and it shipped in the upstream release. The Math.random fallback is only used if node:crypto cannot be loaded, which matches upstream's own fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 undici 6.24.1 already generates the multipart/form-data boundary with crypto.randomInt. This is the upstream fix (c3acc605, Matteo Collina), and it shipped in the upstream release. The Math.random fallback is only used if node:crypto cannot be loaded, which matches upstream's own fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T21:37:00.197268+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 6.24.1 of undici. not_affected \u2014 Target (undici 6.24.1) already contains the upstream fix for CVE-2025-47279: upstream commit 133387138c91 (PR #4088, Matteo Collina). Pool registers a connectionError handler that removes failed clients from the pool, so repeated failed TLS connections no longer accumulate clients. The fix shipped in the upstream release; HEAD has no TuxCare-authored commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 Target (undici 6.24.1) already contains the upstream fix for CVE-2025-47279: upstream commit 133387138c91 (PR #4088, Matteo Collina). Pool registers a connectionError handler that removes failed clients from the pool, so repeated failed TLS connections no longer accumulate clients. The fix shipped in the upstream release; HEAD has no TuxCare-authored commits." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 6.24.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T21:14:00.047255+00:00", "status_notes": "Vulnerability CVE-2026-109829 does not affect version 6.24.1 of undici. not_affected \u2014 Target is undici 6.24.1. The HTTP cache interceptor (interceptors.cache, MemoryCacheStore, SqliteCacheStore, CacheHandler) was introduced in undici 7.0.0 and does not exist in this tree. Only the redirect interceptor exists. The only 'cache' code is the Web Cache API (lib/web/cache), which is unrelated and does not sit on the dispatcher path. The vulnerable compose(redirect(), cache()) composit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109829" }, "impact_statement": "not_affected \u2014 Target is undici 6.24.1. The HTTP cache interceptor (interceptors.cache, MemoryCacheStore, SqliteCacheStore, CacheHandler) was introduced in undici 7.0.0 and does not exist in this tree. Only the redirect interceptor exists. The only 'cache' code is the Web Cache API (lib/web/cache), which is unrelated and does not sit on the dispatcher path. The vulnerable compose(redirect(), cache()) composit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T21:17:27.820564+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 is not affected by CVE-2026-109841. parseMetadata() in lib/web/fetch/util.js lowercases the SRI algorithm token (groups.algo.toLowerCase(), line 658) before checking it against the supported-hash set, so SHA256-/Sha256- tokens are recognized and verified. The regression introduced in 7.15.0 (a lowercase-only lookup of the raw token) is absent. The fix commits were given only as UR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 undici 6.24.1 is not affected by CVE-2026-109841. parseMetadata() in lib/web/fetch/util.js lowercases the SRI algorithm token (groups.algo.toLowerCase(), line 658) before checking it against the supported-hash set, so SHA256-/Sha256- tokens are recognized and verified. The regression introduced in 7.15.0 (a lowercase-only lookup of the raw token) is absent. The fix commits were given only as UR..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-14T02:57:29.427470+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 6.24.1 of undici. not_affected \u2014 The target is undici 6.24.1. The CVE affects only 8.11.0 and 8.11.1, where WebSocket-over-HTTP/2 support was added. In 6.24.1 the WebSocket upgrade can never be carried over an HTTP/2 stream, so no orphaned ClientHttp2Stream can exist. Verdict: not_affected. I did not read the patch diff, because only its URL was supplied and remote access is not allowed.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 The target is undici 6.24.1. The CVE affects only 8.11.0 and 8.11.1, where WebSocket-over-HTTP/2 support was added. In 6.24.1 the WebSocket upgrade can never be carried over an HTTP/2 stream, so no orphaned ClientHttp2Stream can exist. Verdict: not_affected. I did not read the patch diff, because only its URL was supplied and remote access is not allowed." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-14T15:58:50.517307+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 6.24.1 of undici, and is fixed in 6.24.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 6.24.1 of undici, and is fixed in 6.24.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-14T15:58:50.517307+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 6.24.1 of undici, and is fixed in 6.24.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 6.24.1 of undici, and is fixed in 6.24.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-14T15:58:50.517307+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 6.24.1 of undici, and is fixed in 6.24.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 6.24.1 of undici, and is fixed in 6.24.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 6.24.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 6.24.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T21:26:00.042227+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 6.24.1 of undici. not_affected \u2014 Target is undici 6.24.1. CVE-2026-116630 affects only 7.x and 8.x, where a shared HTTP cache interceptor generates If-None-Match/If-Modified-Since validators that the redirect handler does not strip on cross-origin redirects. The 6.x tree has no cache interceptor, no cache store, and no cache-driven revalidation (304 handling), so the vulnerable chain cannot exist. The only HTTP cache code is t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 Target is undici 6.24.1. CVE-2026-116630 affects only 7.x and 8.x, where a shared HTTP cache interceptor generates If-None-Match/If-Modified-Since validators that the redirect handler does not strip on cross-origin redirects. The 6.x tree has no cache interceptor, no cache store, and no cache-driven revalidation (304 handling), so the vulnerable chain cannot exist. The only HTTP cache code is t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T21:21:48.734291+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 6.24.1 of undici. not_affected \u2014 Target is undici 6.24.1. The CVE concerns the HTTP cache interceptor, which was introduced in undici 7.0.0 and replays cached responses to downstream handlers. This 6.x tree has no cache interceptor, no cache handler and no cache store, so the vulnerable replay path does not exist. The product matches (undici), so this is not a false positive.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 Target is undici 6.24.1. The CVE concerns the HTTP cache interceptor, which was introduced in undici 7.0.0 and replays cached responses to downstream handlers. This 6.x tree has no cache interceptor, no cache handler and no cache store, so the vulnerable replay path does not exist. The product matches (undici), so this is not a false positive." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T21:23:24.194195+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 is outside the affected range (7.0.0-7.30.1 and 8.0.0-8.12.3). The redirect handler's cleanRequestHeaders treats array headers as a flat list, so a tuple array would not be filtered. But v6 rejects tuple-array headers when it builds the Request, so the unfiltered headers cannot reach a cross-origin redirect. v6 also has no cache or deduplicate interceptor to serialize retained hea...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 undici 6.24.1 is outside the affected range (7.0.0-7.30.1 and 8.0.0-8.12.3). The redirect handler's cleanRequestHeaders treats array headers as a flat list, so a tuple array would not be filtered. But v6 rejects tuple-array headers when it builds the Request, so the unfiltered headers cannot reach a cross-origin redirect. v6 also has no cache or deduplicate interceptor to serialize retained hea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T21:24:42.697192+00:00", "status_notes": "Vulnerability CVE-2026-120423 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 still splits integrity metadata on ' ' (lib/web/fetch/util.js:637), as the vulnerable 7.x/8.x code does. But its hash-with-options regex is unanchored, so a token with a leading tab or other whitespace still yields a recognized algorithm and digest. The digest stays enforced and mismatched bodies are rejected. The target version (6.x) is also outside the CVE's affected ranges (7.1...", "vulnerability": { "name": "CVE-2026-120423" }, "impact_statement": "not_affected \u2014 undici 6.24.1 still splits integrity metadata on ' ' (lib/web/fetch/util.js:637), as the vulnerable 7.x/8.x code does. But its hash-with-options regex is unanchored, so a token with a leading tab or other whitespace still yields a recognized algorithm and digest. The digest stays enforced and mismatched bodies are rejected. The target version (6.x) is also outside the CVE's affected ranges (7.1..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T21:20:05.659204+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 has no HTTP response-cache interceptor or cache store (that feature appeared in the 7.x line). The CVE's chain of redirected authenticated request, response stored under the original key, and replay to another user cannot occur. The only cache code is the WHATWG Cache API (CacheStorage), which a caller drives explicitly and which has no tie to the redirect interceptor. The CVE lis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 undici 6.24.1 has no HTTP response-cache interceptor or cache store (that feature appeared in the 7.x line). The CVE's chain of redirected authenticated request, response stored under the original key, and replay to another user cannot occur. The only cache code is the WHATWG Cache API (CacheStorage), which a caller drives explicitly and which has no tie to the redirect interceptor. The CVE lis..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 6.24.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T20:08:00.042663+00:00", "status_notes": "Vulnerability CVE-2026-13697 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 has no HTTP cache interceptor and no lib/util/cache.js Cache-Control parser, so the vulnerable component is absent. The CVE's cache interceptor (interceptors.cache(), shared-cache storage, parseCacheControlHeader) was added in the 7.x line. The v6 tree contains only the Web Cache API (lib/web/cache) and fetch, and neither parses response Cache-Control directives.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-13697" }, "impact_statement": "not_affected \u2014 undici 6.24.1 has no HTTP cache interceptor and no lib/util/cache.js Cache-Control parser, so the vulnerable component is absent. The CVE's cache interceptor (interceptors.cache(), shared-cache storage, parseCacheControlHeader) was added in the 7.x line. The v6 tree contains only the Web Cache API (lib/web/cache) and fetch, and neither parses response Cache-Control directives." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T20:07:00.106745+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 has no HTTP cache interceptor. The CVE concerns the v7/v8 `interceptors.cache()` Cache-Control parser, which parses qualified `no-cache`/`private` directives. That code does not exist in this tree, so the flaw is absent (Type A1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 undici 6.24.1 has no HTTP cache interceptor. The CVE concerns the v7/v8 `interceptors.cache()` Cache-Control parser, which parses qualified `no-cache`/`private` directives. That code does not exist in this tree, so the flaw is absent (Type A1)." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 6.24.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T21:50:50.189403+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 already contains the upstream fix for CVE-2026-1525 (commit 4e0179ae, cherry-pick of 74495c63, authored by Matteo Collina). Header processing rejects a second content-length or host header regardless of case. No TuxCare-domain commits exist in HEAD's history; the fix shipped with the upstream 6.24.0 release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 undici 6.24.1 already contains the upstream fix for CVE-2026-1525 (commit 4e0179ae, cherry-pick of 74495c63, authored by Matteo Collina). Header processing rejects a second content-length or host header regardless of case. No TuxCare-domain commits exist in HEAD's history; the fix shipped with the upstream 6.24.0 release." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 6.24.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T22:11:00.043442+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 already contains the upstream fix for CVE-2026-1527. lib/core/request.js rejects non-string upgrade values and upgrade values containing characters invalid in a header value (including CR/LF). The fix is upstream commit e43e8986 by Matteo Collina. It shipped in the upstream v6.24.0 release, and HEAD has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 undici 6.24.1 already contains the upstream fix for CVE-2026-1527. lib/core/request.js rejects non-string upgrade values and upgrade values containing characters invalid in a header value (including CR/LF). The fix is upstream commit e43e8986 by Matteo Collina. It shipped in the upstream v6.24.0 release, and HEAD has no TuxCare-domain commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T22:00:03.479197+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 already contains the upstream fix for CVE-2026-1528. In lib/web/websocket/receiver.js, the PAYLOADLENGTH_64 state rejects any 64-bit length with a non-zero upper word or a lower word above 2^31-1. It then calls failWebsocketConnection instead of doing overflowing math. The fix is upstream commit 5a97f0893b53 (Matteo Collina), which is an ancestor of HEAD. HEAD's history has no Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 undici 6.24.1 already contains the upstream fix for CVE-2026-1528. In lib/web/websocket/receiver.js, the PAYLOADLENGTH_64 state rejects any 64-bit length with a non-zero upper word or a lower word above 2^31-1. It then calls failWebsocketConnection instead of doing overflowing math. The fix is upstream commit 5a97f0893b53 (Matteo Collina), which is an ancestor of HEAD. HEAD's history has no Tux..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 6.24.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 6.24.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-05T09:05:18.396710+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 6.24.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-14T15:58:50.517307+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 6.24.1 of undici, and is fixed in 6.24.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 6.24.1 of undici, and is fixed in 6.24.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-14T15:58:50.517307+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 6.24.1 of undici, and is fixed in 6.24.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 6.24.1 of undici, and is fixed in 6.24.1-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T21:43:00.063150+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 already contains the upstream fix for CVE-2026-22036. fetch() rejects responses whose Content-Encoding lists more than 5 codings before building any decoder. The fix commit d3aafea7 was authored by the upstream maintainer and shipped in v6.23.0. The 6.x tree has no decompress interceptor, so the second affected path does not exist here.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 undici 6.24.1 already contains the upstream fix for CVE-2026-22036. fetch() rejects responses whose Content-Encoding lists more than 5 codings before building any decoder. The fix commit d3aafea7 was authored by the upstream maintainer and shipped in v6.23.0. The 6.x tree has no decompress interceptor, so the second affected path does not exist here." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 6.24.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-14T01:30:50.391236+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 has no deduplicate interceptor, so CVE-2026-2581 does not apply. The interceptor was added in the 7.x line. The v6 `interceptors` export has only redirect, retry, dump and dns, and none of them fans one upstream response out to several waiting requests.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 undici 6.24.1 has no deduplicate interceptor, so CVE-2026-2581 does not apply. The interceptor was added in the 7.x line. The v6 `interceptors` export has only redirect, retry, dump and dns, and none of them fans one upstream response out to several waiting requests." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 6.24.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T20:09:39.760132+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 6.24.1 of undici. not_affected \u2014 Target is undici 6.24.1, which has no SOCKS5 proxy agent. The CVE concerns Socks5ProxyAgent, added in undici 7.23.0 via PR #4385. It is absent from the working tree and from HEAD's history. The fix commit 3805b8f8 is not an ancestor of HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Target is undici 6.24.1, which has no SOCKS5 proxy agent. The CVE concerns Socks5ProxyAgent, added in undici 7.23.0 via PR #4385. It is absent from the working tree and from HEAD's history. The fix commit 3805b8f8 is not an ancestor of HEAD." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T20:49:00.046850+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 has no interceptors.decompress() interceptor, which is the component CVE-2026-84890 concerns. The interceptors export only redirect, retry, dump and dns, so the vulnerable component is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 undici 6.24.1 has no interceptors.decompress() interceptor, which is the component CVE-2026-84890 concerns. The interceptors export only redirect, retry, dump and dns, so the vulnerable component is absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T20:43:37.800265+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 has no cache interceptor and no shared HTTP response cache. The vulnerable component (interceptors.cache() with type 'shared') was introduced in later undici lines (7.x/8.x), so this tree does not contain it.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 undici 6.24.1 has no cache interceptor and no shared HTTP response cache. The vulnerable component (interceptors.cache() with type 'shared') was introduced in later undici lines (7.x/8.x), so this tree does not contain it." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 6.24.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T20:37:00.086722+00:00", "status_notes": "Vulnerability CVE-2026-84961 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 BalancedPool never JSON-deep-clones its options. The constructor stores the rest options by reference, and addUpstream passes a shallow Object.assign copy to the factory, so function-valued connect/tls options (custom checkServerIdentity or connector) reach each per-upstream Pool unchanged. The JSON-clone step that drops them is absent, so the CVE-2026-84961 flaw does not exist in...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-84961" }, "impact_statement": "not_affected \u2014 undici 6.24.1 BalancedPool never JSON-deep-clones its options. The constructor stores the rest options by reference, and addUpstream passes a shallow Object.assign copy to the factory, so function-valued connect/tls options (custom checkServerIdentity or connector) reach each per-upstream Pool unchanged. The JSON-clone step that drops them is absent, so the CVE-2026-84961 flaw does not exist in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T20:33:00.084290+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 has no HTTP cache interceptor (interceptors.cache, CacheHandler, canCacheResponse, cache stores). That feature was added in undici 7.x. The vulnerable code from CVE-2026-85008 is absent. The tuxcare backports of this CVE sit on 7.x branches, not on this one.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 undici 6.24.1 has no HTTP cache interceptor (interceptors.cache, CacheHandler, canCacheResponse, cache stores). That feature was added in undici 7.x. The vulnerable code from CVE-2026-85008 is absent. The tuxcare backports of this CVE sit on 7.x branches, not on this one." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T20:19:00.066324+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 6.24.1 of undici. not_affected \u2014 Target is undici 6.24.1. The CVE concerns WebSocketStream, which was introduced in undici 7.0.0. The 6.x tree has no WebSocketStream implementation: lib/web/websocket contains only the classic WebSocket (connection, events, frame, receiver, sender, websocket and related files). The only WebSocketStream references are WPT test fixtures. No code path can call abort() on a locked writable stream f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 Target is undici 6.24.1. The CVE concerns WebSocketStream, which was introduced in undici 7.0.0. The 6.x tree has no WebSocketStream implementation: lib/web/websocket contains only the classic WebSocket (connection, events, frame, receiver, sender, websocket and related files). The only WebSocketStream references are WPT test fixtures. No code path can call abort() on a locked writable stream f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-14T02:22:47.090523+00:00", "status_notes": "Vulnerability CVE-2026-85024 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 is not affected. The size-limit cleanup in lib/web/websocket/permessage-deflate.js calls removeAllListeners() and then immediately destroy() on the InflateRaw stream. That destroy() is the fix the vendor patch applies. A destroyed stream does not emit a later 'error' event, so no unhandled error event reaches the process. The destroy() was shipped upstream by Matteo Collina in com...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85024" }, "impact_statement": "not_affected \u2014 undici 6.24.1 is not affected. The size-limit cleanup in lib/web/websocket/permessage-deflate.js calls removeAllListeners() and then immediately destroy() on the InflateRaw stream. That destroy() is the fix the vendor patch applies. A destroyed stream does not emit a later 'error' event, so no unhandled error event reaches the process. The destroy() was shipped upstream by Matteo Collina in com..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-14T02:32:59.548927+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 6.24.1 of undici. not_affected \u2014 Target is undici 6.24.1. The vulnerable `interceptors.cache()` and `interceptors.deduplicate()` do not exist in this tree. Per the CVE they were introduced in 8.10.0. Only redirect, retry, dump and dns interceptors are exported, so the cross-origin cache/dedup key flaw cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 6.24.1. The vulnerable `interceptors.cache()` and `interceptors.deduplicate()` do not exist in this tree. Per the CVE they were introduced in 8.10.0. Only redirect, retry, dump and dns interceptors are exported, so the cross-origin cache/dedup key flaw cannot occur." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 6.24.1 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 6.24.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T21:20:05.659204+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 has no `decompress` interceptor, so the affected component does not exist in this target. The interceptor was added in the 7.x/8.x lines. The CVE-2026-87029 flaw lives in that interceptor, which forwards decompressed data from zlib stream callbacks without catching errors from a downstream handler such as `dump`. This tree is the same product (undici), so the verdict is not_affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 undici 6.24.1 has no `decompress` interceptor, so the affected component does not exist in this target. The interceptor was added in the 7.x/8.x lines. The CVE-2026-87029 flaw lives in that interceptor, which forwards decompressed data from zlib stream callbacks without catching errors from a downstream handler such as `dump`. This tree is the same product (undici), so the verdict is not_affect..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-14T01:51:00.048861+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 6.24.1 of undici. not_affected \u2014 CVE-2026-9675 is a regression in undici 8.1.0, where the new maxPayloadSize option was enforced per frame but not cumulatively across fragments. Target 6.24.1 has no maxPayloadSize feature at all, so there is no configured limit for fragmented messages to bypass. The vulnerable limit-enforcement code is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 CVE-2026-9675 is a regression in undici 8.1.0, where the new maxPayloadSize option was enforced per frame but not cumulatively across fragments. Target 6.24.1 has no maxPayloadSize feature at all, so there is no configured limit for fragmented messages to bypass. The vulnerable limit-enforcement code is absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T20:11:00.069805+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 6.24.1 of undici. not_affected \u2014 Target is undici 6.24.1, which has no HTTP cache interceptor (interceptors.cache()), no cache-control response parser and no shared-cache store. The CVE affects only that component, which first appears in later 7.x/8.x lines. The vulnerable code is absent, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Target is undici 6.24.1, which has no HTTP cache interceptor (interceptors.cache()), no cache-control response parser and no shared-cache store. The CVE affects only that component, which first appears in later 7.x/8.x lines. The vulnerable code is absent, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T20:02:00.043521+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 6.24.1 of undici. not_affected \u2014 undici 6.24.1 does not percent-decode cookie values. The vulnerable decoding step (qsUnescape in parseSetCookie, introduced in 7.0.0 by PR #3789) does not exist in this tree. parseSetCookie keeps the value verbatim after trim(), and parseCookie only splits on ';' and '=' without decoding. The locked Goal (encoded input turned into literal CR/LF/NUL/;/= bytes) cannot occur here.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 undici 6.24.1 does not percent-decode cookie values. The vulnerable decoding step (qsUnescape in parseSetCookie, introduced in 7.0.0 by PR #3789) does not exist in this tree. parseSetCookie keeps the value verbatim after trim(), and parseCookie only splits on ';' and '=' without decoding. The locked Goal (encoded input turned into literal CR/LF/NUL/;/= bytes) cannot occur here." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.1", "identifiers": { "purl": "pkg:npm/undici@6.24.1" } } ], "timestamp": "2026-11-13T20:14:00.045604+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 6.24.1 of undici. not_affected \u2014 Target is undici 6.24.1. SOCKS5 proxy support (Socks5ProxyAgent and the socks5:// / socks:// branch in ProxyAgent) was added in undici 7.23.0 and does not exist in this tree. The CVE's flaw, requestTls being dropped on the SOCKS5 path, therefore cannot occur here. ProxyAgent only handles HTTP(S) proxies, and its requestTls option is applied there.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 Target is undici 6.24.1. SOCKS5 proxy support (Socks5ProxyAgent and the socks5:// / socks:// branch in ProxyAgent) was added in undici 7.23.0 and does not exist in this tree. The CVE's flaw, requestTls being dropped on the SOCKS5 path, therefore cannot occur here. ProxyAgent only handles HTTP(S) proxies, and its requestTls option is applied there." } ] }