{ "@id": "urn:uuid:9002232b-3c01-4c89-9bab-afde2b067abe", "role": "Document Creator", "author": "https://tuxcare.com", "version": 48, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T03:05:08.846671+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 6.28.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 6.28.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 6.28.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 6.28.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 6.28.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 6.28.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 6.28.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-14T00:10:24.062123+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 6.28.1 of undici. not_affected \u2014 Not affected. The upstream fix e041de35 (GHSA-wqq4-5wpv-mx2g, CVE-2023-45143) is already in the target. httpRedirectFetch in lib/web/fetch/index.js deletes the cookie and host headers (as well as authorization and proxy-authorization) on cross-origin redirects. The fix commit is authored and committed outside the TuxCare allowlist and predates the first TuxCare commit, so it shipped in the upst...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix e041de35 (GHSA-wqq4-5wpv-mx2g, CVE-2023-45143) is already in the target. httpRedirectFetch in lib/web/fetch/index.js deletes the cookie and host headers (as well as authorization and proxy-authorization) on cross-origin redirects. The fix commit is authored and committed outside the TuxCare allowlist and predates the first TuxCare commit, so it shipped in the upst..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 6.28.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-13T22:22:49.594925+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 6.28.1 of undici. not_affected \u2014 undici 6.28.1 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler path. The fix (upstream GHSA-wqq4-5wpv-mx2g, commit 6805746) is an ancestor of the first TuxCare commit, so it shipped in the upstream release. The attribution is upstream, not TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 undici 6.28.1 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler path. The fix (upstream GHSA-wqq4-5wpv-mx2g, commit 6805746) is an ancestor of the first TuxCare commit, so it shipped in the upstream release. The attribution is upstream, not TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-14T00:35:00.059132+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 6.28.1 of undici. not_affected \u2014 The target (undici 6.28.1) already strips Authorization, Proxy-Authorization and Cookie headers when a redirect crosses origins, in the shared RedirectHandler that undici.request() uses. The fix commit (6805746) is an upstream commit by Matteo Collina. It was already in the upstream release, before the first TuxCare commit, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 The target (undici 6.28.1) already strips Authorization, Proxy-Authorization and Cookie headers when a redirect crosses origins, in the shared RedirectHandler that undici.request() uses. The fix commit (6805746) is an upstream commit by Matteo Collina. It was already in the upstream release, before the first TuxCare commit, so the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-13T23:49:43.646715+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 6.28.1 of undici. not_affected \u2014 Not affected. Target undici 6.28.1 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd / 2b39440b). That commit is an ancestor of HEAD and of the first TuxCare commit, so the fix shipped in the upstream 6.28.1 release. It was authored by Matteo Collina (not a TuxCare identity). The pre-fix integrity logic is gone from lib/web/fetch/util.js.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Not affected. Target undici 6.28.1 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd / 2b39440b). That commit is an ancestor of HEAD and of the first TuxCare commit, so the fix shipped in the upstream 6.28.1 release. It was authored by Matteo Collina (not a TuxCare identity). The pre-fix integrity logic is gone from lib/web/fetch/util.js." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 6.28.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T10:55:02.115769+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 6.28.1 of undici. not_affected \u2014 Not affected. Multipart boundary generation in lib/web/fetch/body.js uses crypto.randomInt (CSPRNG), the same fix as upstream c3acc605 for CVE-2025-22150. The fix shipped in the upstream 6.x release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 Not affected. Multipart boundary generation in lib/web/fetch/body.js uses crypto.randomInt (CSPRNG), the same fix as upstream c3acc605 for CVE-2025-22150. The fix shipped in the upstream 6.x release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T11:02:55.739585+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 6.28.1 of undici. not_affected \u2014 undici 6.28.1 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088). Pool registers a 'connectionError' listener that removes failed clients from its client list, so repeated handshake failures no longer leave dead clients accumulating. The fix commit is authored by Matteo Collina and shipped in the upstream release, before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 undici 6.28.1 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088). Pool registers a 'connectionError' listener that removes failed clients from its client list, so repeated handshake failures no longer leave dead clients accumulating. The fix commit is authored by Matteo Collina and shipped in the upstream release, before the first TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-07T14:42:00.047206+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 6.28.1 of undici, and is fixed in 6.28.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 6.28.1 of undici, and is fixed in 6.28.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:06:00.064776+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 6.28.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T13:30:25.835538+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 6.28.1 of undici. not_affected \u2014 undici 6.28.1 is not affected. parseMetadata() in lib/web/fetch/util.js lowercases the SRI algorithm token (line 658) before checking it against supportedHashes (line 662). Uppercase and mixed-case tokens such as SHA256- are therefore recognized and verified. The regression described in the CVE was introduced in the 7.15.0 line, and this 6.x tree keeps the pre-regression behavior.", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 undici 6.28.1 is not affected. parseMetadata() in lib/web/fetch/util.js lowercases the SRI algorithm token (line 658) before checking it against supportedHashes (line 662). Uppercase and mixed-case tokens such as SHA256- are therefore recognized and verified. The regression described in the CVE was introduced in the 7.15.0 line, and this 6.x tree keeps the pre-regression behavior." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-14T03:05:08.846671+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 6.28.1 of undici. not_affected \u2014 Target is undici 6.28.1-tuxcare.2. The CVE concerns WebSocket-over-HTTP/2 support, which was introduced in undici 8.11.0 and does not exist in this version. Here a WebSocket upgrade request over an H2 session is rejected up front, so no ClientHttp2Stream is created for a websocket handshake and nothing can be orphaned. Not affected (Type A2).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 6.28.1-tuxcare.2. The CVE concerns WebSocket-over-HTTP/2 support, which was introduced in undici 8.11.0 and does not exist in this version. Here a WebSocket upgrade request over an H2 session is rejected up front, so no ClientHttp2Stream is created for a websocket handshake and nothing can be orphaned. Not affected (Type A2)." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-07T14:42:00.047206+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 6.28.1 of undici, and is fixed in 6.28.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 6.28.1 of undici, and is fixed in 6.28.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-07T14:42:00.047206+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 6.28.1 of undici, and is fixed in 6.28.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 6.28.1 of undici, and is fixed in 6.28.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-07T14:42:00.047206+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 6.28.1 of undici, and is fixed in 6.28.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 6.28.1 of undici, and is fixed in 6.28.1-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T11:55:00.123511+00:00", "status_notes": "Vulnerability CVE-2026-11525 does not affect version 6.28.1 of undici. not_affected \u2014 Not affected. The SameSite parser in lib/web/cookies/parse.js already uses exact, case-insensitive equality against none, strict and lax, and ignores any other value. This is the upstream fix (nodejs/undici 5655ea43, cherry-picked as 25efa447 by Matteo Collina). It shipped in the upstream v6.27.0 release, before the first TuxCare commit, so the verdict is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-11525" }, "impact_statement": "not_affected \u2014 Not affected. The SameSite parser in lib/web/cookies/parse.js already uses exact, case-insensitive equality against none, strict and lax, and ignores any other value. This is the upstream fix (nodejs/undici 5655ea43, cherry-picked as 25efa447 by Matteo Collina). It shipped in the upstream v6.27.0 release, before the first TuxCare commit, so the verdict is not_affected rather than already_fixed." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 6.28.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T10:32:00.039627+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 6.28.1 of undici. not_affected \u2014 Target is undici 6.28.1. The CVE affects only 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3, where a shared cache interceptor is composed with the redirect interceptor. This tree has no HTTP cache interceptor, no cache store and no conditional-revalidation logic, so the chain from a cache-generated validator to a cross-origin 304 cannot exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 Target is undici 6.28.1. The CVE affects only 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3, where a shared cache interceptor is composed with the redirect interceptor. This tree has no HTTP cache interceptor, no cache store and no conditional-revalidation logic, so the chain from a cache-generated validator to a cross-origin 304 cannot exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T10:16:59.893945+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 6.28.1 of undici. not_affected \u2014 Target is undici 6.28.1. The CVE affects the HTTP cache interceptor, which exists only in 7.x and 8.x. This tree has no cache interceptor, cache handler, cache store or decompress interceptor, so the cached-response replay path where the throw escapes does not exist here.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 Target is undici 6.28.1. The CVE affects the HTTP cache interceptor, which exists only in 7.x and 8.x. This tree has no cache interceptor, cache handler, cache store or decompress interceptor, so the cached-response replay path where the throw escapes does not exist here." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T10:17:15.295484+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 6.28.1 of undici. not_affected \u2014 Target is undici 6.28.1, not the 7.x/8.x ranges in the CVE. lib/handler/redirect-handler.js cleanRequestHeaders does treat an array as a flat list, so tuple arrays would not be stripped. But the pre-fix chain cannot complete here: Request rejects tuple arrays before anything is sent, and 6.28.1 has no cache or deduplicate interceptor to serialize retained headers. No path leaks credentials to a...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 Target is undici 6.28.1, not the 7.x/8.x ranges in the CVE. lib/handler/redirect-handler.js cleanRequestHeaders does treat an array as a flat list, so tuple arrays would not be stripped. But the pre-fix chain cannot complete here: Request rejects tuple arrays before anything is sent, and 6.28.1 has no cache or deduplicate interceptor to serialize retained headers. No path leaks credentials to a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T10:18:00.081064+00:00", "status_notes": "Vulnerability CVE-2026-120423 does not affect version 6.28.1 of undici. not_affected \u2014 undici 6.28.1 (outside the CVE's 7.15.0-7.30.1 range) still splits integrity metadata on a single space in parseMetadata. The advertised bypass does not work here, because the hash-with-options regex is unanchored. A token such as \"\\tsha256-\" still yields a recognized algorithm and digest, so the digest is checked. In my test, whitespace-surrounded digests were enforced and a mismatched...", "vulnerability": { "name": "CVE-2026-120423" }, "impact_statement": "not_affected \u2014 undici 6.28.1 (outside the CVE's 7.15.0-7.30.1 range) still splits integrity metadata on a single space in parseMetadata. The advertised bypass does not work here, because the hash-with-options regex is unanchored. A token such as \"\\tsha256-\" still yields a recognized algorithm and digest, so the digest is checked. In my test, whitespace-surrounded digests were enforced and a mismatched..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T10:12:00.053178+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 6.28.1 of undici. not_affected \u2014 undici 6.28.1 has no HTTP response-cache interceptor or cache store. CVE-2026-120474 needs the redirect interceptor and a shared response cache used together. That cache only exists in undici 7.x/8.x, so the chain from redirected credentialed request to cross-user cached disclosure cannot form here.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 undici 6.28.1 has no HTTP response-cache interceptor or cache store. CVE-2026-120474 needs the redirect interceptor and a shared response cache used together. That cache only exists in undici 7.x/8.x, so the chain from redirected credentialed request to cross-user cached disclosure cannot form here." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-04T03:43:37.320617+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 6.28.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 6.28.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T12:14:00.044444+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 6.28.1 of undici. not_affected \u2014 undici 6.28.1 has no HTTP cache interceptor (interceptors.cache()) and no Cache-Control response parser. The vulnerable parsing of qualified no-cache/private directives and the shared-cache storage decision do not exist in this tree, so CVE-2026-14643 does not apply. The cache interceptor and its parser first appear in the 7.x line, which is where the advisory's fixed versions (7.29.0 and 8.9.0...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 undici 6.28.1 has no HTTP cache interceptor (interceptors.cache()) and no Cache-Control response parser. The vulnerable parsing of qualified no-cache/private directives and the shared-cache storage decision do not exist in this tree, so CVE-2026-14643 does not apply. The cache interceptor and its parser first appear in the 7.x line, which is where the advisory's fixed versions (7.29.0 and 8.9.0..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T12:02:00.043216+00:00", "status_notes": "Vulnerability CVE-2026-15157 does not affect version 6.28.1 of undici. not_affected \u2014 Undici 6.28.1 already contains the upstream fix for CVE-2026-15157. The blob-like body branch in lib/dispatcher/client-h1.js validates body.type with isValidHeaderValue() before writing the content-type header. The fix is upstream commit 740a0b7c, which shipped in v6.28.0, before any TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-15157" }, "impact_statement": "not_affected \u2014 Undici 6.28.1 already contains the upstream fix for CVE-2026-15157. The blob-like body branch in lib/dispatcher/client-h1.js validates body.type with isValidHeaderValue() before writing the content-type header. The fix is upstream commit 740a0b7c, which shipped in v6.28.0, before any TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T11:14:41.071379+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 6.28.1 of undici. not_affected \u2014 Not affected. The fix for CVE-2026-1525 (upstream commit 4e0179ae, cherry-pick of 74495c63) is already in the target. It shipped in the upstream v6.28.1 release, before any TuxCare commit. lib/core/request.js rejects a second content-length header, comparing on the lowercased header name, so case-variant duplicates are caught.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 Not affected. The fix for CVE-2026-1525 (upstream commit 4e0179ae, cherry-pick of 74495c63) is already in the target. It shipped in the upstream v6.28.1 release, before any TuxCare commit. lib/core/request.js rejects a second content-length header, comparing on the lowercased header name, so case-variant duplicates are caught." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 6.28.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T11:21:00.046457+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 6.28.1 of undici. not_affected \u2014 Target undici 6.28.1 already contains the upstream CVE-2026-1527 fix (upstream commit e43e8986, \"validate upgrade header to prevent CRLF injection\"). The Request constructor rejects any upgrade value with CR/LF or other invalid header characters before it can reach the socket write in client-h1.js. The fix shipped in the upstream release that TuxCare onboarded, so the verdict is not_affected, n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 Target undici 6.28.1 already contains the upstream CVE-2026-1527 fix (upstream commit e43e8986, \"validate upgrade header to prevent CRLF injection\"). The Request constructor rejects any upgrade value with CR/LF or other invalid header characters before it can reach the socket write in client-h1.js. The fix shipped in the upstream release that TuxCare onboarded, so the verdict is not_affected, n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-13T22:07:57.178051+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 6.28.1 of undici. not_affected \u2014 The upstream fix for CVE-2026-1528 (nodejs/undici commit 5a97f089, \"Fix websocket 64-bit length overflow\") is already in the 6.28.1 base release. lib/web/websocket/receiver.js rejects any 64-bit frame length with a nonzero upper word or a lower word above 2^31-1, and fails the connection gracefully. The pre-fix pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-1528 (nodejs/undici commit 5a97f089, \"Fix websocket 64-bit length overflow\") is already in the 6.28.1 base release. lib/web/websocket/receiver.js rejects any 64-bit frame length with a nonzero upper word or a lower word above 2^31-1, and fails the connection gracefully. The pre-fix pattern is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T12:02:00.043216+00:00", "status_notes": "Vulnerability CVE-2026-16728 does not affect version 6.28.1 of undici. not_affected \u2014 Target undici 6.28.1 already contains the upstream fix for CVE-2026-16728. It is commit cba3a52a, \"fix(retry): reject partial content length mismatch\", by Matteo Collina. It is in the upstream v6.28.1 release, before the first TuxCare commit. RetryHandler rejects a 206 response whose Content-Length differs from its Content-Range span, on both the first response and the resumed one. The stale-Co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16728" }, "impact_statement": "not_affected \u2014 Target undici 6.28.1 already contains the upstream fix for CVE-2026-16728. It is commit cba3a52a, \"fix(retry): reject partial content length mismatch\", by Matteo Collina. It is in the upstream v6.28.1 release, before the first TuxCare commit. RetryHandler rejects a 206 response whose Content-Length differs from its Content-Range span, on both the first response and the resumed one. The stale-Co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T12:09:00.049774+00:00", "status_notes": "Vulnerability CVE-2026-16729 does not affect version 6.28.1 of undici. not_affected \u2014 Target undici 6.28.1 already contains the upstream fix (af748404, \"harden cookie domain, path, and unparsed attribute validation\"), shipped in the upstream 6.28.0/6.28.1 release. validateCookieDomain enforces RFC 1034 letter-digit-hyphen syntax and so rejects ';'. The unparsed loop in stringify runs validateCookieName on the key and validateCookieValue on the value, both of which reject ';'.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16729" }, "impact_statement": "not_affected \u2014 Target undici 6.28.1 already contains the upstream fix (af748404, \"harden cookie domain, path, and unparsed attribute validation\"), shipped in the upstream 6.28.0/6.28.1 release. validateCookieDomain enforces RFC 1034 letter-digit-hyphen syntax and so rejects ';'. The unparsed loop in stringify runs validateCookieName on the key and validateCookieValue on the value, both of which reject ';'." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:05:18.396710+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 6.28.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T13:14:50.137315+00:00", "status_notes": "Vulnerability CVE-2026-18540 does not affect version 6.28.1 of undici. not_affected \u2014 Target (undici 6.28.1) already contains the upstream fix for CVE-2026-18540 / GHSA-r53p-7pc4-xj5r (commit ce31bc82 by Matteo Collina). It was part of the upstream v6.28.1 release before any TuxCare commit, so it is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-18540" }, "impact_statement": "not_affected \u2014 Target (undici 6.28.1) already contains the upstream fix for CVE-2026-18540 / GHSA-r53p-7pc4-xj5r (commit ce31bc82 by Matteo Collina). It was part of the upstream v6.28.1 release before any TuxCare commit, so it is not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:05:31.171802+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 6.28.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T11:10:00.366748+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 6.28.1 of undici. not_affected \u2014 undici 6.28.1 already contains the upstream fix. fetch() rejects responses with more than 5 content-encodings before building any decoder. The decompress interceptor named in the CVE does not exist in this tree. The fix commit is upstream-authored and shipped in the release TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 undici 6.28.1 already contains the upstream fix. fetch() rejects responses with more than 5 content-encodings before building any decoder. The decompress interceptor named in the CVE does not exist in this tree. The fix commit is upstream-authored and shipped in the release TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 6.28.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-14T01:39:18.932791+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 6.28.1 of undici. not_affected \u2014 undici 6.28.1 has no deduplicate interceptor. The vulnerable code from CVE-2026-2581, which buffers response bodies for deduplicated requests, is absent. The only interceptors exported are redirect, retry, dump and dns, and nothing in the repo coalesces concurrent identical requests.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 undici 6.28.1 has no deduplicate interceptor. The vulnerable code from CVE-2026-2581, which buffers response bodies for deduplicated requests, is absent. The only interceptors exported are redirect, retry, dump and dns, and nothing in the repo coalesces concurrent identical requests." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T11:56:00.025719+00:00", "status_notes": "Vulnerability CVE-2026-6733 does not affect version 6.28.1 of undici. not_affected \u2014 undici 6.28.1 already contains the upstream fix for CVE-2026-6733, the idle keep-alive socket validation. The commit is authored by Matteo Collina and shipped in the upstream release before the first TuxCare commit. The target is therefore not vulnerable, and the verdict is not_affected with code_not_present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6733" }, "impact_statement": "not_affected \u2014 undici 6.28.1 already contains the upstream fix for CVE-2026-6733, the idle keep-alive socket validation. The commit is authored by Matteo Collina and shipped in the upstream release before the first TuxCare commit. The target is therefore not vulnerable, and the verdict is not_affected with code_not_present." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-6734 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2026-6734" }, "action_statement": "Vulnerability CVE-2026-6734 affects version 6.28.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T13:10:39.482712+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 6.28.1 of undici. not_affected \u2014 Undici 6.28.1 does not contain the `interceptors.decompress()` interceptor that CVE-2026-84890 concerns. The interceptor was added in commit 80d5f321 (#4317), which is not an ancestor of HEAD. It ships only in 7.x tags. The patch hunks that add `maxSize` to that interceptor have nothing to apply to here. Product identity matches (undici), so this is not a false positive.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 Undici 6.28.1 does not contain the `interceptors.decompress()` interceptor that CVE-2026-84890 concerns. The interceptor was added in commit 80d5f321 (#4317), which is not an ancestor of HEAD. It ships only in 7.x tags. The patch hunks that add `maxSize` to that interceptor have nothing to apply to here. Product identity matches (undici), so this is not a false positive." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T13:02:26.327888+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 6.28.1 of undici. not_affected \u2014 undici 6.28.1 has no HTTP cache interceptor. The vulnerable `interceptors.cache()` was added in 7.x, and the shared-mode Set-Cookie storage and replay flaw can't occur here. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 undici 6.28.1 has no HTTP cache interceptor. The vulnerable `interceptors.cache()` was added in 7.x, and the shared-mode Set-Cookie storage and replay flaw can't occur here. Not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 6.28.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 6.28.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T12:58:00.042642+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 6.28.1 of undici. not_affected \u2014 Undici 6.28.1 has no HTTP cache interceptor (interceptors.cache), no cache store, and no canCacheResponse logic. The vulnerable component was introduced in later 7.x/8.x lines. The repo is the same product (undici), so it is not a false positive. The vulnerable code is absent (Type A1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 Undici 6.28.1 has no HTTP cache interceptor (interceptors.cache), no cache store, and no canCacheResponse logic. The vulnerable component was introduced in later 7.x/8.x lines. The repo is the same product (undici), so it is not a false positive. The vulnerable code is absent (Type A1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T12:42:00.092476+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 6.28.1 of undici. not_affected \u2014 undici 6.28.1 has no WebSocketStream implementation. The API was introduced in undici 7.0.0, so the vulnerable close handler (which aborts a locked writable stream and discards the rejected promise) does not exist in this tree. Only the classic WebSocket API is exported.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 undici 6.28.1 has no WebSocketStream implementation. The API was introduced in undici 7.0.0, so the vulnerable close handler (which aborts a locked writable stream and discards the rejected promise) does not exist in this tree. Only the classic WebSocket API is exported." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-14T02:19:34.424699+00:00", "status_notes": "Vulnerability CVE-2026-85024 does not affect version 6.28.1 of undici. not_affected \u2014 The target already contains the upstream fix for CVE-2026-85024. In lib/web/websocket/permessage-deflate.js, the size-limit cleanup now calls this.#inflate.destroy() after removeAllListeners(), so a late Z_DATA_ERROR cannot become an unhandled 'error' event. The fix is upstream commit 07c60d9c (Matteo Collina). It sits in the upstream release that TuxCare onboarded, before the first TuxCare com...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85024" }, "impact_statement": "not_affected \u2014 The target already contains the upstream fix for CVE-2026-85024. In lib/web/websocket/permessage-deflate.js, the size-limit cleanup now calls this.#inflate.destroy() after removeAllListeners(), so a late Z_DATA_ERROR cannot become an unhandled 'error' event. The fix is upstream commit 07c60d9c (Matteo Collina). It sits in the upstream release that TuxCare onboarded, before the first TuxCare com..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-14T02:39:01.689801+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 6.28.1 of undici. not_affected \u2014 Not affected. The target is undici 6.28.1-tuxcare.2, an older release than the 8.10.0 and 8.10.1 versions the CVE names. It has no interceptors.cache() or interceptors.deduplicate(), so no shared cache or dedup key can mix responses across origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Not affected. The target is undici 6.28.1-tuxcare.2, an older release than the 8.10.0 and 8.10.1 versions the CVE names. It has no interceptors.cache() or interceptors.deduplicate(), so no shared cache or dedup key can mix responses across origins." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-09T13:50:16.036984+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 6.28.1 of undici, and is fixed in 6.28.1-tuxcare.2.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 6.28.1 of undici, and is fixed in 6.28.1-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T13:30:25.835538+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 6.28.1 of undici. not_affected \u2014 undici 6.28.1 has no `decompress` dispatch interceptor. The CVE-2026-87029 flaw (zlib stream-event callbacks calling a downstream handler that may throw, with no try/catch) therefore cannot occur. The only zlib use on the HTTP response path is fetch's pipeline-based decoding, which has no throwing downstream dispatch handler and routes errors to onError. The websocket permessage-deflate code is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 undici 6.28.1 has no `decompress` dispatch interceptor. The CVE-2026-87029 flaw (zlib stream-event callbacks calling a downstream handler that may throw, with no try/catch) therefore cannot occur. The only zlib use on the HTTP response path is fetch's pipeline-based decoding, which has no throwing downstream dispatch handler and routes errors to onError. The websocket permessage-deflate code is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-14T02:06:45.296491+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 6.28.1 of undici. not_affected \u2014 undici 6.28.1-tuxcare.2 is not affected. Its WebSocket receiver already enforces the cumulative fragmented-message limit, so the 8.1.0 regression is absent. The check came in with the upstream maxPayloadSize feature, before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 undici 6.28.1-tuxcare.2 is not affected. Its WebSocket receiver already enforces the cumulative fragmented-message limit, so the 8.1.0 regression is absent. The check came in with the upstream maxPayloadSize feature, before the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T12:28:55.213155+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 6.28.1 of undici. not_affected \u2014 Target is undici 6.28.1, which has no HTTP cache interceptor (interceptors.cache()), no cache-control response parser and no shared/private cache store. The vulnerable component introduced in the 7.x line is absent, so the whitespace-padded private/no-cache qualified field-name flaw cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Target is undici 6.28.1, which has no HTTP cache interceptor (interceptors.cache()), no cache-control response parser and no shared/private cache store. The vulnerable component introduced in the 7.x line is absent, so the whitespace-padded private/no-cache qualified field-name flaw cannot occur." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-06T11:56:00.025719+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 6.28.1 of undici. not_affected \u2014 undici 6.28.1 is not affected. Its Set-Cookie parser (lib/web/cookies/parse.js) never percent-decodes cookie values, so encoded sequences such as %0D%0A, %00, %3B and %3D are returned verbatim. The qsUnescape decoding came from PR #3789 in 7.0.0 and was never present in this 6.x line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 undici 6.28.1 is not affected. Its Set-Cookie parser (lib/web/cookies/parse.js) never percent-decodes cookie values, so encoded sequences such as %0D%0A, %00, %3B and %3D are returned verbatim. The qsUnescape decoding came from PR #3789 in 7.0.0 and was never present in this 6.x line." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.1", "identifiers": { "purl": "pkg:npm/undici@6.28.1" } } ], "timestamp": "2026-11-05T09:04:00.091712+00:00", "status_notes": "Vulnerability CVE-2026-9697 affects version 6.28.1 of undici.", "vulnerability": { "name": "CVE-2026-9697" }, "action_statement": "Vulnerability CVE-2026-9697 affects version 6.28.1 of undici." } ] }