{ "@id": "urn:uuid:aee5c99d-0836-434d-a1de-e320cf48dfd3", "role": "Document Creator", "author": "https://tuxcare.com", "version": 50, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T16:15:51.210779+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 6.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 6.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 6.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 6.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 6.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 6.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 6.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T23:59:46.060372+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 6.25.0 of undici. not_affected \u2014 Target undici 6.25.0 already contains the upstream fix for CVE-2023-45143. On cross-origin redirects both the fetch path and the dispatcher redirect handler strip cookie, authorization and proxy-authorization. The fix commit e041de359221 is upstream-authored and is an ancestor of HEAD. HEAD's history has no commit from a @cloudlinux.com or @tuxcare.com address, so the fix came with the upstream...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Target undici 6.25.0 already contains the upstream fix for CVE-2023-45143. On cross-origin redirects both the fetch path and the dispatcher redirect handler strip cookie, authorization and proxy-authorization. The fix commit e041de359221 is upstream-authored and is an ancestor of HEAD. HEAD's history has no commit from a @cloudlinux.com or @tuxcare.com address, so the fix came with the upstream..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 6.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T22:21:34.173747+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 6.25.0 of undici. not_affected \u2014 CVE-2024-24758 (Proxy-Authorization not cleared on cross-origin redirect) is not present in undici 6.25.0. Both redirect paths already strip proxy-authorization on cross-origin redirects. The fix shipped in the upstream release (commit b9da3e40, GHSA-3787-6prv-h9w3, by Matteo Collina), and HEAD has no TuxCare-domain commits, so this is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 CVE-2024-24758 (Proxy-Authorization not cleared on cross-origin redirect) is not present in undici 6.25.0. Both redirect paths already strip proxy-authorization on cross-origin redirects. The fix shipped in the upstream release (commit b9da3e40, GHSA-3787-6prv-h9w3, by Matteo Collina), and HEAD has no TuxCare-domain commits, so this is an upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-14T00:30:26.670415+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 6.25.0 of undici. not_affected \u2014 The fix for CVE-2024-30260 (upstream commit 6805746) is already in undici 6.25.0. The redirect handler removes authorization and proxy-authorization headers, and cookie, on cross-origin redirects. This applies to undici.request() with maxRedirections as well as fetch(). The fix is upstream-authored and shipped in the release TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 The fix for CVE-2024-30260 (upstream commit 6805746) is already in undici 6.25.0. The redirect handler removes authorization and proxy-authorization headers, and cookie, on cross-origin redirects. This applies to undici.request() with maxRedirections as well as fetch(). The fix is upstream-authored and shipped in the release TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T23:39:20.408363+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 6.25.0 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2024-30261 (undici d542b8cd, GHSA-9qxr-qj54-h672, released in 6.11.1) is already in this 6.25.0 tree. bytesMatch in lib/web/fetch/util.js uses the patched logic. The fix shipped in the upstream release, before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2024-30261 (undici d542b8cd, GHSA-9qxr-qj54-h672, released in 6.11.1) is already in this 6.25.0 tree. bytesMatch in lib/web/fetch/util.js uses the patched logic. The fix shipped in the upstream release, before the first TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 6.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T21:30:44.648777+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 6.25.0 of undici. not_affected \u2014 Undici 6.25.0 already contains the upstream CVE-2025-22150 fix. The multipart/form-data boundary in lib/web/fetch/body.js is built from crypto.randomInt() and not from Math.random(). The fix is upstream commit c3acc6050b, authored by Matteo Collina. It is an ancestor of HEAD and shipped in the upstream release that this branch is based on.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 Undici 6.25.0 already contains the upstream CVE-2025-22150 fix. The multipart/form-data boundary in lib/web/fetch/body.js is built from crypto.randomInt() and not from Math.random(). The fix is upstream commit c3acc6050b, authored by Matteo Collina. It is an ancestor of HEAD and shipped in the upstream release that this branch is based on." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T21:37:00.197268+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 6.25.0 of undici. not_affected \u2014 undici 6.25.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit 133387138c91). Pool now removes clients from its client list on 'connectionError', so repeated TLS or connection failures no longer accumulate dead clients. The fix is authored by upstream (Matteo Collina) and was already in the upstream release before the first TuxCare automation commit. The targ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 undici 6.25.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit 133387138c91). Pool now removes clients from its client list on 'connectionError', so repeated TLS or connection failures no longer accumulate dead clients. The fix is authored by upstream (Matteo Collina) and was already in the upstream release before the first TuxCare automation commit. The targ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-14T16:15:51.210779+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 6.25.0 of undici, and is fixed in 6.25.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 6.25.0 of undici, and is fixed in 6.25.0-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T21:14:00.047255+00:00", "status_notes": "Vulnerability CVE-2026-109829 does not affect version 6.25.0 of undici. not_affected \u2014 Target is undici 6.25.0. The HTTP cache interceptor (interceptors.cache) and the MemoryCacheStore/SqliteCacheStore stores were introduced in undici 7.0.0 and do not exist in this 6.x tree. The vulnerable composition compose(redirect(), cache()) with a shared cache therefore cannot be built, and the cache-key/origin confusion cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109829" }, "impact_statement": "not_affected \u2014 Target is undici 6.25.0. The HTTP cache interceptor (interceptors.cache) and the MemoryCacheStore/SqliteCacheStore stores were introduced in undici 7.0.0 and do not exist in this 6.x tree. The vulnerable composition compose(redirect(), cache()) with a shared cache therefore cannot be built, and the cache-key/origin confusion cannot occur." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T21:17:00.039866+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 6.25.0 of undici. not_affected \u2014 Not affected. undici 6.25.0 never contained the 7.15.0 regression. In lib/web/fetch/util.js, parseMetadata() lowercases the SRI algorithm token before the supported-hash check, so SHA256-/Sha256- tokens are recognized and verified rather than skipped. Mixed-case tokens can make the strongest-algorithm filter reject a response. They cannot make bytesMatch accept a body that doesn't match the dig...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 Not affected. undici 6.25.0 never contained the 7.15.0 regression. In lib/web/fetch/util.js, parseMetadata() lowercases the SRI algorithm token before the supported-hash check, so SHA256-/Sha256- tokens are recognized and verified rather than skipped. Mixed-case tokens can make the strongest-algorithm filter reject a response. They cannot make bytesMatch accept a body that doesn't match the dig..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-14T02:56:38.976735+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 6.25.0 of undici. not_affected \u2014 undici 6.25.0 is not affected. The CVE is a regression introduced in undici 8.11.0, where WebSocket handshakes run over HTTP/2 with allowH2 enabled by default. In this 6.25.0 tree, an HTTP/2 stream is never opened for a WebSocket upgrade, so the orphaned-stream crash cannot occur. The upstream patch diff was only a URL and could not be fetched, so this rests on the CVE text and code inspection.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 undici 6.25.0 is not affected. The CVE is a regression introduced in undici 8.11.0, where WebSocket handshakes run over HTTP/2 with allowH2 enabled by default. In this 6.25.0 tree, an HTTP/2 stream is never opened for a WebSocket upgrade, so the orphaned-stream crash cannot occur. The upstream patch diff was only a URL and could not be fetched, so this rests on the CVE text and code inspection." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-14T16:15:51.210779+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 6.25.0 of undici, and is fixed in 6.25.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 6.25.0 of undici, and is fixed in 6.25.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-14T16:15:51.210779+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 6.25.0 of undici, and is fixed in 6.25.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 6.25.0 of undici, and is fixed in 6.25.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-14T16:15:51.210779+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 6.25.0 of undici, and is fixed in 6.25.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 6.25.0 of undici, and is fixed in 6.25.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 6.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 6.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T21:25:37.080118+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 6.25.0 of undici. not_affected \u2014 Target is undici 6.25.0. The shared HTTP cache interceptor (interceptors.cache, CacheHandler, cache stores) added in 7.0.0 is absent, so no cache-generated If-None-Match/If-Modified-Since validators are produced on revalidation. The CVE affects only 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3. The same product lineage means this is not a false positive.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 Target is undici 6.25.0. The shared HTTP cache interceptor (interceptors.cache, CacheHandler, cache stores) added in 7.0.0 is absent, so no cache-generated If-None-Match/If-Modified-Since validators are produced on revalidation. The CVE affects only 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3. The same product lineage means this is not a false positive." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T21:22:00.453604+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 6.25.0 of undici. not_affected \u2014 Target is undici 6.25.0, a v6 branch with no HTTP cache interceptor, cache store or cached-response replay code. The CVE affects only 7.0.0-7.30.1 and 8.0.0-8.12.3, where the cache interceptor replays cached responses. The vulnerable replay chain does not exist here.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 Target is undici 6.25.0, a v6 branch with no HTTP cache interceptor, cache store or cached-response replay code. The CVE affects only 7.0.0-7.30.1 and 8.0.0-8.12.3, where the cache interceptor replays cached responses. The vulnerable replay chain does not exist here." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T21:23:15.305445+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 6.25.0 of undici. not_affected \u2014 undici 6.25.0 is not exploitable via CVE-2026-120415. The redirect handler (lib/handler/redirect-handler.js:212-230) still has the flat-list-only reading that the CVE describes. But tuple-array headers (the CVE's trigger input) are rejected by the Request constructor (lib/core/request.js:163-169) before any dispatch, so no redirect ever happens with that input. Non-array iterables (Map/Headers)...", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 undici 6.25.0 is not exploitable via CVE-2026-120415. The redirect handler (lib/handler/redirect-handler.js:212-230) still has the flat-list-only reading that the CVE describes. But tuple-array headers (the CVE's trigger input) are rejected by the Request constructor (lib/core/request.js:163-169) before any dispatch, so no redirect ever happens with that input. Non-array iterables (Map/Headers)..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 6.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T21:20:05.659204+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 6.25.0 of undici. not_affected \u2014 undici 6.25.0 has no HTTP response-cache interceptor or cache stores. The CVE needs the redirect interceptor and a shared response cache working together, so the vulnerable chain cannot exist in this tree. The affected range is 7.0.0-7.30.1 and 8.0.0-8.12.3, which does not include 6.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 undici 6.25.0 has no HTTP response-cache interceptor or cache stores. The CVE needs the redirect interceptor and a shared response cache working together, so the vulnerable chain cannot exist in this tree. The affected range is 7.0.0-7.30.1 and 8.0.0-8.12.3, which does not include 6.x." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 6.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T20:08:00.042663+00:00", "status_notes": "Vulnerability CVE-2026-13697 does not affect version 6.25.0 of undici. not_affected \u2014 undici 6.25.0 has no HTTP cache interceptor (interceptors.cache()) and no lib/util/cache.js with the Cache-Control response parser. The vulnerable parser and the shared-cache storage logic that CVE-2026-13697 patches do not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-13697" }, "impact_statement": "not_affected \u2014 undici 6.25.0 has no HTTP cache interceptor (interceptors.cache()) and no lib/util/cache.js with the Cache-Control response parser. The vulnerable parser and the shared-cache storage logic that CVE-2026-13697 patches do not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T20:07:00.106745+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 6.25.0 of undici. not_affected \u2014 undici 6.25.0 does not ship the HTTP cache interceptor (interceptors.cache(), CacheHandler, cache stores, Cache-Control parser) that CVE-2026-14643 concerns. The Cache-Control qualified-directive parser that mishandles whitespace around '=' is absent from the tree, so the flaw cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 undici 6.25.0 does not ship the HTTP cache interceptor (interceptors.cache(), CacheHandler, cache stores, Cache-Control parser) that CVE-2026-14643 concerns. The Cache-Control qualified-directive parser that mishandles whitespace around '=' is absent from the tree, so the flaw cannot occur." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 6.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T21:51:37.743034+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 6.25.0 of undici. not_affected \u2014 undici 6.25.0 already contains the upstream fix for CVE-2026-1525. processHeader() in lib/core/request.js lowercases every header name and throws on a second content-length (and host) header, whatever its case. The fix is upstream commit 4e0179ae (Matteo Collina). It ships in the upstream 6.24.x line, and HEAD's history has no TuxCare-authored commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 undici 6.25.0 already contains the upstream fix for CVE-2026-1525. processHeader() in lib/core/request.js lowercases every header name and throws on a second content-length (and host) header, whatever its case. The fix is upstream commit 4e0179ae (Matteo Collina). It ships in the upstream 6.24.x line, and HEAD's history has no TuxCare-authored commits." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 6.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T22:11:00.043442+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 6.25.0 of undici. not_affected \u2014 undici 6.25.0 already contains the upstream fix for CVE-2026-1527. Request construction validates the upgrade option and rejects CR/LF before it can be written to the socket. The fix is upstream commit e43e8986 (Matteo Collina). It is an ancestor of HEAD, and HEAD has no TuxCare-domain commits, so it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 undici 6.25.0 already contains the upstream fix for CVE-2026-1527. Request construction validates the upgrade option and rejects CR/LF before it can be written to the socket. The fix is upstream commit e43e8986 (Matteo Collina). It is an ancestor of HEAD, and HEAD has no TuxCare-domain commits, so it shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T21:59:00.039965+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 6.25.0 of undici. not_affected \u2014 Target undici 6.25.0 already contains the upstream fix for CVE-2026-1528 (commit 5a97f089, cherry-pick of 84235c62, by Matteo Collina). ByteParser's PAYLOADLENGTH_64 state now rejects any 64-bit length with a non-zero upper word or a lower word above 2^31-1 via failWebsocketConnection, so the overflow and fatal TypeError cannot occur. The fix is in the upstream release; no TuxCare-domain commit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 Target undici 6.25.0 already contains the upstream fix for CVE-2026-1528 (commit 5a97f089, cherry-pick of 84235c62, by Matteo Collina). ByteParser's PAYLOADLENGTH_64 state now rejects any 64-bit length with a non-zero upper word or a lower word above 2^31-1 via failWebsocketConnection, so the overflow and fatal TypeError cannot occur. The fix is in the upstream release; no TuxCare-domain commit..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 6.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 6.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-05T09:05:18.396710+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 6.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-14T16:15:51.210779+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 6.25.0 of undici, and is fixed in 6.25.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 6.25.0 of undici, and is fixed in 6.25.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-14T16:15:51.210779+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 6.25.0 of undici, and is fixed in 6.25.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 6.25.0 of undici, and is fixed in 6.25.0-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T21:43:00.063150+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 6.25.0 of undici. not_affected \u2014 Target undici 6.25.0 already contains the upstream fix. lib/web/fetch/index.js caps the Content-Encoding chain at 5 and rejects the response before any decoder is created. The fix commit is by Matteo Collina (upstream); HEAD has no TuxCare-domain commits, so it shipped in the upstream release. The decompress interceptor does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 Target undici 6.25.0 already contains the upstream fix. lib/web/fetch/index.js caps the Content-Encoding chain at 5 and rejects the response before any decoder is created. The fix commit is by Matteo Collina (upstream); HEAD has no TuxCare-domain commits, so it shipped in the upstream release. The decompress interceptor does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 6.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-14T01:31:24.180392+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 6.25.0 of undici. not_affected \u2014 The target is undici 6.25.0 (6.x line). It has no deduplicate interceptor, no deduplication handler, and no response cache, so the vulnerable pattern in CVE-2026-2581 (buffering a response body for deduplicated waiting handlers) does not exist here. Same product, so not a false_positive. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 The target is undici 6.25.0 (6.x line). It has no deduplicate interceptor, no deduplication handler, and no response cache, so the vulnerable pattern in CVE-2026-2581 (buffering a response body for deduplicated waiting handlers) does not exist here. Same product, so not a false_positive. Not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 6.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T20:09:39.760132+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 6.25.0 of undici. not_affected \u2014 Target is undici 6.25.0. Socks5ProxyAgent, the vulnerable component, was introduced in undici 7.23.0 (PR #4385) and does not exist in this tree. The repo has no SOCKS5 code at all, so no chain from multi-origin requests to cross-origin routing exists. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Target is undici 6.25.0. Socks5ProxyAgent, the vulnerable component, was introduced in undici 7.23.0 (PR #4385) and does not exist in this tree. The repo has no SOCKS5 code at all, so no chain from multi-origin requests to cross-origin routing exists. Not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T20:49:07.060769+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 6.25.0 of undici. not_affected \u2014 undici 6.25.0 does not contain the `interceptors.decompress()` interceptor that CVE-2026-84890 concerns, so the vulnerable component is absent. The exported interceptors are only redirect, retry, dump and dns. The decompress interceptor is not part of the 6.x line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 undici 6.25.0 does not contain the `interceptors.decompress()` interceptor that CVE-2026-84890 concerns, so the vulnerable component is absent. The exported interceptors are only redirect, retry, dump and dns. The decompress interceptor is not part of the 6.x line." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T20:43:37.800265+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 6.25.0 of undici. not_affected \u2014 The target is undici 6.25.0, the same product as the advisory. It has no HTTP cache interceptor and no shared-cache store, so no path takes a cacheable Set-Cookie response into a shared cache. `interceptors.cache()`, the vulnerable component, does not exist in this version. Not affected (Type A1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 The target is undici 6.25.0, the same product as the advisory. It has no HTTP cache interceptor and no shared-cache store, so no path takes a cacheable Set-Cookie response into a shared cache. `interceptors.cache()`, the vulnerable component, does not exist in this version. Not affected (Type A1)." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 6.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T20:39:05.138761+00:00", "status_notes": "Vulnerability CVE-2026-84961 does not affect version 6.25.0 of undici. not_affected \u2014 undici 6.25.0 BalancedPool does not JSON-clone its options. It stores them with a shallow rest spread and passes a shallow Object.assign copy to each Pool. Pool destructures connect and tls before its own deepClone. Function-valued connect/tls options such as checkServerIdentity therefore reach the TLS connector intact. The lossy-clone flaw described in CVE-2026-84961 is not present in this ver...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-84961" }, "impact_statement": "not_affected \u2014 undici 6.25.0 BalancedPool does not JSON-clone its options. It stores them with a shallow rest spread and passes a shallow Object.assign copy to each Pool. Pool destructures connect and tls before its own deepClone. Function-valued connect/tls options such as checkServerIdentity therefore reach the TLS connector intact. The lossy-clone flaw described in CVE-2026-84961 is not present in this ver..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T20:33:15.400563+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 6.25.0 of undici. not_affected \u2014 undici 6.25.0 has no `interceptors.cache()` and no cache store, so the vulnerable code does not exist in this version. The CVE concerns the cache interceptor added in the 7.x line, which skips the skip-list for unsafe methods and then stores and replays their responses. The 6.x target only exports redirect, retry, dump and dns interceptors. The patch contents were not available, so the analysis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 undici 6.25.0 has no `interceptors.cache()` and no cache store, so the vulnerable code does not exist in this version. The CVE concerns the cache interceptor added in the 7.x line, which skips the skip-list for unsafe methods and then stores and replays their responses. The 6.x target only exports redirect, retry, dump and dns interceptors. The patch contents were not available, so the analysis..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T20:19:00.066324+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 6.25.0 of undici. not_affected \u2014 Target is undici 6.25.0, which has no WebSocketStream implementation. The CVE affects the WebSocketStream API introduced in undici 7.0.0, so the vulnerable code (abort() on a locked writable stream in the socket-close handler) does not exist in this tree.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 Target is undici 6.25.0, which has no WebSocketStream implementation. The CVE affects the WebSocketStream API introduced in undici 7.0.0, so the vulnerable code (abort() on a locked writable stream in the socket-close handler) does not exist in this tree." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-14T16:15:51.210779+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 6.25.0 of undici, and is fixed in 6.25.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 6.25.0 of undici, and is fixed in 6.25.0-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-14T02:32:59.548927+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 6.25.0 of undici. not_affected \u2014 Target is undici 6.25.0. The CVE affects only 8.10.0 and 8.10.1, where interceptors.cache() and interceptors.deduplicate() were introduced. Neither interceptor, nor any HTTP cache store (MemoryCacheStore, SqliteCacheStore, CacheStore), exists in this tree. index.js exports only the redirect, retry, dump and dns interceptors. The vulnerable key-building code is absent, so the cross-origin cache ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 6.25.0. The CVE affects only 8.10.0 and 8.10.1, where interceptors.cache() and interceptors.deduplicate() were introduced. Neither interceptor, nor any HTTP cache store (MemoryCacheStore, SqliteCacheStore, CacheStore), exists in this tree. index.js exports only the redirect, retry, dump and dns interceptors. The vulnerable key-building code is absent, so the cross-origin cache ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 6.25.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 6.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T21:20:05.659204+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 6.25.0 of undici. not_affected \u2014 undici 6.25.0 has no `decompress` interceptor, so the flaw described in CVE-2026-87029 cannot occur. The interceptor forwarded decoded data to a downstream handler from asynchronous zlib callbacks, and a throw there escaped as an uncaught exception. This tree's interceptors are only redirect, retry, dump and dns (index.js:41-46). None of them decompresses. The only response decompression is in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 undici 6.25.0 has no `decompress` interceptor, so the flaw described in CVE-2026-87029 cannot occur. The interceptor forwarded decoded data to a downstream handler from asynchronous zlib callbacks, and a throw there escaped as an uncaught exception. This tree's interceptors are only redirect, retry, dump and dns (index.js:41-46). None of them decompresses. The only response decompression is in ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-14T01:54:00.066706+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 6.25.0 of undici. not_affected \u2014 undici 6.25.0 is not affected. The receiver tracks cumulative bytes across fragments of uncompressed messages and fails the connection once the total exceeds maxPayloadSize. This is the check CVE-2026-9675 says the 8.1.0 regression lacked. The CVE itself states that 6.25.0 shipped the cumulative check from the start.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 undici 6.25.0 is not affected. The receiver tracks cumulative bytes across fragments of uncompressed messages and fails the connection once the total exceeds maxPayloadSize. This is the check CVE-2026-9675 says the 8.1.0 regression lacked. The CVE itself states that 6.25.0 shipped the cumulative check from the start." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T20:11:32.988243+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 6.25.0 of undici. not_affected \u2014 Target is undici 6.25.0. The shared-cache interceptor (interceptors.cache(), Cache-Control directive parser) from the CVE does not exist in this v6 tree. The repo is the same product lineage, so this is not a false_positive. The affected code is simply absent, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Target is undici 6.25.0. The shared-cache interceptor (interceptors.cache(), Cache-Control directive parser) from the CVE does not exist in this v6 tree. The repo is the same product lineage, so this is not a false_positive. The affected code is simply absent, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T20:01:00.036985+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 6.25.0 of undici. not_affected \u2014 Target is undici 6.25.0 (same product as the advisory). Its cookie parser never percent-decodes cookie values, so the CVE-2026-9679 flaw is absent. The flaw was introduced in 7.0.0 by PR #3789, which this 6.x line does not contain. Fixed 6.x release per the advisory is 6.27.0.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 Target is undici 6.25.0 (same product as the advisory). Its cookie parser never percent-decodes cookie values, so the CVE-2026-9679 flaw is absent. The flaw was introduced in 7.0.0 by PR #3789, which this 6.x line does not contain. Fixed 6.x release per the advisory is 6.27.0." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.25.0", "identifiers": { "purl": "pkg:npm/undici@6.25.0" } } ], "timestamp": "2026-11-13T20:11:32.988243+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 6.25.0 of undici. not_affected \u2014 Target is undici 6.25.0. SOCKS5 proxy support (Socks5ProxyAgent and the socks5:// / socks:// branch in ProxyAgent) was added in 7.23.0 and is absent from this tree. The vulnerable path, where requestTls is dropped for a SOCKS5 tunnel, does not exist. ProxyAgent here only handles HTTP(S) proxies and passes requestTls to buildConnector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 Target is undici 6.25.0. SOCKS5 proxy support (Socks5ProxyAgent and the socks5:// / socks:// branch in ProxyAgent) was added in 7.23.0 and is absent from this tree. The vulnerable path, where requestTls is dropped for a SOCKS5 tunnel, does not exist. ProxyAgent here only handles HTTP(S) proxies and passes requestTls to buildConnector." } ] }