{
  "@id": "urn:uuid:7a73a070-cdb4-4089-a845-3f8fc41850d1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 30,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T00:03:28.204349+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 7.18.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-14T00:03:28.204349+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.18.2 of undici. not_affected \u2014 Not affected. undici 7.18.2 already contains the upstream fix for CVE-2023-45143 (commit e041de35, released in 5.26.2). On a cross-origin redirect, httpRedirectFetch deletes the cookie header along with authorization, proxy-authorization and host.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 Not affected. undici 7.18.2 already contains the upstream fix for CVE-2023-45143 (commit e041de35, released in 5.26.2). On a cross-origin redirect, httpRedirectFetch deletes the cookie header along with authorization, proxy-authorization and host."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "action_statement": "Vulnerability CVE-2024-24750 affects version 7.18.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:21:40.164913+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.18.2 of undici. not_affected \u2014 Not affected. Both redirect-handling paths in undici 7.18.2 already strip Proxy-Authorization on cross-origin redirects. The upstream fix for GHSA-wqq4-5wpv-mx2g (commit 6805746) shipped in the upstream release before any TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 Not affected. Both redirect-handling paths in undici 7.18.2 already strip Proxy-Authorization on cross-origin redirects. The upstream fix for GHSA-wqq4-5wpv-mx2g (commit 6805746) shipped in the upstream release before any TuxCare commit."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "action_statement": "Vulnerability CVE-2024-30260 affects version 7.18.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-13T23:34:04.416729+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.18.2 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2024-30261 (d542b8cd, GHSA-9qxr-qj54-h672) is an ancestor of HEAD and shipped in the upstream undici release that TuxCare onboarded. Its author is Matteo Collina and its committer is GitHub. The integrity check in 7.18.2 has been rewritten into a spec-compliant module that does not contain the pre-fix flaw.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2024-30261 (d542b8cd, GHSA-9qxr-qj54-h672) is an ancestor of HEAD and shipped in the upstream undici release that TuxCare onboarded. Its author is Matteo Collina and its committer is GitHub. The integrity check in 7.18.2 has been rewritten into a spec-compliant module that does not contain the pre-fix flaw."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 7.18.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:31:00.047911+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.18.2 of undici. not_affected \u2014 undici 7.18.2 already contains the upstream CVE-2025-22150 fix. The multipart boundary in lib/web/fetch/body.js is generated with node:crypto randomInt whenever crypto is available. Math.random is only a fallback for builds without crypto, the same as upstream. The fix is upstream commit c2d78cd1 (Matteo Collina), shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "impact_statement": "not_affected \u2014 undici 7.18.2 already contains the upstream CVE-2025-22150 fix. The multipart boundary in lib/web/fetch/body.js is generated with node:crypto randomInt whenever crypto is available. Math.random is only a fallback for builds without crypto, the same as upstream. The fix is upstream commit c2d78cd1 (Matteo Collina), shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:37:00.197268+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.18.2 of undici. not_affected \u2014 undici 7.18.2 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool now removes clients that hit a connectionError from its kClients list, so failed-TLS clients are not retained. The fix shipped in the upstream release, so this is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "impact_statement": "not_affected \u2014 undici 7.18.2 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool now removes clients that hit a connectionError from its kClients list, so failed-TLS clients are not retained. The fix shipped in the upstream release, so this is not_affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:44:00.132301+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:46:33.687871+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:47:21.529900+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "action_statement": "Vulnerability CVE-2026-109841 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:06:00.064776+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "action_statement": "Vulnerability CVE-2026-109855 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:29:00.261196+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:34:00.250279+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "action_statement": "Vulnerability CVE-2026-109924 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "action_statement": "Vulnerability CVE-2026-11525 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:20:26.750713+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "action_statement": "Vulnerability CVE-2026-116630 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "action_statement": "Vulnerability CVE-2026-120222 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "action_statement": "Vulnerability CVE-2026-120415 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "action_statement": "Vulnerability CVE-2026-120423 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:06:35.912230+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "action_statement": "Vulnerability CVE-2026-120474 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "action_statement": "Vulnerability CVE-2026-12151 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "action_statement": "Vulnerability CVE-2026-13697 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "action_statement": "Vulnerability CVE-2026-14643 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "action_statement": "Vulnerability CVE-2026-15157 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "action_statement": "Vulnerability CVE-2026-1525 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "action_statement": "Vulnerability CVE-2026-1527 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "action_statement": "Vulnerability CVE-2026-1528 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "action_statement": "Vulnerability CVE-2026-16728 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "action_statement": "Vulnerability CVE-2026-16729 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "action_statement": "Vulnerability CVE-2026-18149 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "action_statement": "Vulnerability CVE-2026-18540 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "action_statement": "Vulnerability CVE-2026-19534 affects version 7.18.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:44:00.039648+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.18.2 of undici. not_affected \u2014 Target undici 7.18.2 already contains the upstream fix. Both fetch() and the decompress interceptor reject a Content-Encoding chain longer than 5 entries before any decoder stream is built. The fix commit b04e3cbb is authored by Matteo Collina (upstream) and was part of the upstream 7.18.2 release before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.18.2 already contains the upstream fix. Both fetch() and the decompress interceptor reject a Content-Encoding chain longer than 5 entries before any decoder stream is built. The fix commit b04e3cbb is authored by Matteo Collina (upstream) and was part of the upstream 7.18.2 release before the first TuxCare commit."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "action_statement": "Vulnerability CVE-2026-2581 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "action_statement": "Vulnerability CVE-2026-6733 affects version 7.18.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:09:39.760132+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 does not affect version 7.18.2 of undici. not_affected \u2014 Target is undici 7.18.2. Socks5ProxyAgent was introduced in 7.23.0 (PR #4385), so it does not exist here. No SOCKS code is present anywhere in the tree at HEAD, so there is no code path for the cross-origin pool reuse flaw.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.18.2. Socks5ProxyAgent was introduced in 7.23.0 (PR #4385), so it does not exist here. No SOCKS code is present anywhere in the tree at HEAD, so there is no code path for the cross-origin pool reuse flaw."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "action_statement": "Vulnerability CVE-2026-84890 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "action_statement": "Vulnerability CVE-2026-84933 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "action_statement": "Vulnerability CVE-2026-84947 affects version 7.18.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:41:41.011558+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 does not affect version 7.18.2 of undici. not_affected \u2014 undici 7.18.2 BalancedPool never JSON-clones its constructor options, so function-valued connect/tls options (checkServerIdentity, custom connector) reach each per-upstream Pool intact. The vulnerable pattern from CVE-2026-84961 is absent.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "impact_statement": "not_affected \u2014 undici 7.18.2 BalancedPool never JSON-clones its constructor options, so function-valued connect/tls options (checkServerIdentity, custom connector) reach each per-upstream Pool intact. The vulnerable pattern from CVE-2026-84961 is absent."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "action_statement": "Vulnerability CVE-2026-85008 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:27:17.765346+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "action_statement": "Vulnerability CVE-2026-85014 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:03.785272+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "action_statement": "Vulnerability CVE-2026-85024 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:03.785272+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "action_statement": "Vulnerability CVE-2026-85152 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:48:04.069265+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "action_statement": "Vulnerability CVE-2026-87029 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "action_statement": "Vulnerability CVE-2026-9675 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "action_statement": "Vulnerability CVE-2026-9678 affects version 7.18.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 affects version 7.18.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "action_statement": "Vulnerability CVE-2026-9679 affects version 7.18.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.18.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.18.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:14:58.005670+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 does not affect version 7.18.2 of undici. not_affected \u2014 undici 7.18.2 has no SOCKS5 support. The CVE says the bug was introduced in 7.23.0 together with Socks5ProxyAgent and the SOCKS5 branch of ProxyAgent. Neither exists here. The only ProxyAgent in this tree is the HTTP CONNECT one, and it honors requestTls on the tunneled TLS handshake. The fixed pattern is therefore not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "impact_statement": "not_affected \u2014 undici 7.18.2 has no SOCKS5 support. The CVE says the bug was introduced in 7.23.0 together with Socks5ProxyAgent and the SOCKS5 branch of ProxyAgent. Neither exists here. The only ProxyAgent in this tree is the HTTP CONNECT one, and it honors requestTls on the tunneled TLS handshake. The fixed pattern is therefore not present."
    }
  ]
}