{ "@id": "urn:uuid:91282f5c-672a-4c60-ace2-6cc883666292", "role": "Document Creator", "author": "https://tuxcare.com", "version": 35, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:57:29.427470+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 7.19.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-14T00:03:00.081204+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.19.1 of undici. not_affected \u2014 Target undici 7.19.1 already strips Cookie (plus Authorization, Proxy-Authorization and Host) on cross-origin redirects, in both the fetch implementation and the dispatcher redirect handler. The fix is upstream commit e041de3 (GHSA-wqq4-5wpv-mx2g), authored by a non-TuxCare identity and an ancestor of HEAD. No TuxCare-domain commit exists in HEAD's history, so the fix is upstream-shipped and th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Target undici 7.19.1 already strips Cookie (plus Authorization, Proxy-Authorization and Host) on cross-origin redirects, in both the fetch implementation and the dispatcher redirect handler. The fix is upstream commit e041de3 (GHSA-wqq4-5wpv-mx2g), authored by a non-TuxCare identity and an ancestor of HEAD. No TuxCare-domain commit exists in HEAD's history, so the fix is upstream-shipped and th..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 7.19.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-13T22:18:45.848472+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.19.1 of undici. not_affected \u2014 Undici 7.19.1 already strips Proxy-Authorization on cross-origin redirects (lib/handler/redirect-handler.js:208-210). This is an upstream fix present in the release, and HEAD has no TuxCare commits, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Undici 7.19.1 already strips Proxy-Authorization on cross-origin redirects (lib/handler/redirect-handler.js:208-210). This is an upstream fix present in the release, and HEAD has no TuxCare commits, so the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-14T00:30:00.611450+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.19.1 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2024-30260 (commit 68057466) is already in this undici 7.19.1 tree. The redirect handler strips authorization and proxy-authorization on cross-origin redirects. The fix was shipped in the upstream release before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2024-30260 (commit 68057466) is already in this undici 7.19.1 tree. The redirect handler strips authorization and proxy-authorization on cross-origin redirects. The fix was shipped in the upstream release before the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-13T23:33:57.977509+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.19.1 of undici. not_affected \u2014 undici 7.19.1 already contains the upstream fix for CVE-2024-30261. The SRI logic was rewritten to follow the spec: parseMetadata keeps only valid sha256/sha384/sha512 tokens, getStrongestMetadata picks the strongest algorithm by ordered index, and bytesMatch compares only against that set. The fix commit d542b8cd is an ancestor of HEAD and predates the first ELS-automation commit, so it is an ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 undici 7.19.1 already contains the upstream fix for CVE-2024-30261. The SRI logic was rewritten to follow the spec: parseMetadata keeps only valid sha256/sha384/sha512 tokens, getStrongestMetadata picks the strongest algorithm by ordered index, and bytesMatch compares only against that set. The fix commit d542b8cd is an ancestor of HEAD and predates the first ELS-automation commit, so it is an ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 7.19.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-13T21:30:44.648777+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.19.1 of undici. not_affected \u2014 Undici 7.19.1 already contains the upstream fix for CVE-2025-22150. The multipart/form-data boundary is generated with node:crypto randomInt, not Math.random. Math.random is only a fallback when the crypto runtime feature is unavailable, which matches the upstream fix design. The fix commit c2d78cd1 (Matteo Collina, upstream) is an ancestor of HEAD and comes from the upstream release. No TuxCar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 Undici 7.19.1 already contains the upstream fix for CVE-2025-22150. The multipart/form-data boundary is generated with node:crypto randomInt, not Math.random. Math.random is only a fallback when the crypto runtime feature is unavailable, which matches the upstream fix design. The fix commit c2d78cd1 (Matteo Collina, upstream) is an ancestor of HEAD and comes from the upstream release. No TuxCar..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-13T21:37:00.197268+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.19.1 of undici. not_affected \u2014 undici 7.19.1 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool now removes clients from its list on 'connectionError'. The fix is in the upstream release that TuxCare onboarded, so it is an upstream fix rather than a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 undici 7.19.1 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool now removes clients from its list on 'connectionError'. The fix is in the upstream release that TuxCare onboarded, so it is an upstream fix rather than a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 7.19.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-14T02:57:29.427470+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.19.1 of undici. not_affected \u2014 Target undici 7.19.1 has H2 WebSocket support but lacks the 8.11.0 regression. The H2 websocket stream always has a persistent 'error' listener, and request.completed is not set on upgrade, so abort() is not a no-op. A failed-handshake abort closes the stream, and a later server-side destroy cannot emit an unhandled stream error that crashes the process.", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target undici 7.19.1 has H2 WebSocket support but lacks the 8.11.0 regression. The H2 websocket stream always has a persistent 'error' listener, and request.completed is not set on upgrade, so abort() is not a no-op. A failed-handshake abort closes the stream, and a later server-side destroy cannot emit an unhandled stream error that crashes the process." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-10-15T18:28:00.152357+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-10-15T18:33:00.174668+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-06T10:20:26.750713+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-14643 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-14643" }, "action_statement": "Vulnerability CVE-2026-14643 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1525 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-1525" }, "action_statement": "Vulnerability CVE-2026-1525 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1527 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-1527" }, "action_statement": "Vulnerability CVE-2026-1527 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1528 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-1528" }, "action_statement": "Vulnerability CVE-2026-1528 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 7.19.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-13T21:43:00.063150+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.19.1 of undici. not_affected \u2014 Target undici 7.19.1 already contains the upstream fix (commit b04e3cbb) limiting the Content-Encoding chain to 5 in both fetch() and the decompress interceptor. The fix shipped in the upstream release onboarded by TuxCare, so it is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 Target undici 7.19.1 already contains the upstream fix (commit b04e3cbb) limiting the Content-Encoding chain to 5 in both fetch() and the decompress interceptor. The fix shipped in the upstream release onboarded by TuxCare, so it is an upstream fix." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2581 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-2581" }, "action_statement": "Vulnerability CVE-2026-2581 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 7.19.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-13T20:09:50.079453+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 7.19.1 of undici. not_affected \u2014 Target is undici 7.19.1. Socks5ProxyAgent was added in 7.23.0 (PR #4385), so the vulnerable component does not exist here. The tree has no SOCKS5 code at all. The only proxy dispatcher is ProxyAgent, which routes through an Agent that keeps a separate pool per origin.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Target is undici 7.19.1. Socks5ProxyAgent was added in 7.23.0 (PR #4385), so the vulnerable component does not exist here. The tree has no SOCKS5 code at all. The only proxy dispatcher is ProxyAgent, which routes through an Agent that keeps a separate pool per origin." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 7.19.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-13T20:37:00.086722+00:00", "status_notes": "Vulnerability CVE-2026-84961 does not affect version 7.19.1 of undici. not_affected \u2014 undici 7.19.1 BalancedPool has no JSON deep clone of its options. It forwards a shallow copy to each Pool, so function-valued connect/tls options (checkServerIdentity, custom connectors) reach the TLS layer intact. The CVE's flaw is absent.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-84961" }, "impact_statement": "not_affected \u2014 undici 7.19.1 BalancedPool has no JSON deep clone of its options. It forwards a shallow copy to each Pool, so function-valued connect/tls options (checkServerIdentity, custom connectors) reach the TLS layer intact. The CVE's flaw is absent." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-29T18:27:17.765346+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 7.19.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-14T02:13:58.919555+00:00", "status_notes": "Vulnerability CVE-2026-85024 does not affect version 7.19.1 of undici. not_affected \u2014 undici 7.19.1 is not affected. The vulnerable decompressed-size-limit cleanup, which calls removeAllListeners() on the InflateRaw stream, does not exist in this version. lib/web/websocket/permessage-deflate.js has no size limit, and its 'error' listener is attached permanently. A malformed DEFLATE block therefore routes through callback(err) into failWebsocketConnection(1007) and does not crash...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-85024" }, "impact_statement": "not_affected \u2014 undici 7.19.1 is not affected. The vulnerable decompressed-size-limit cleanup, which calls removeAllListeners() on the InflateRaw stream, does not exist in this version. lib/web/websocket/permessage-deflate.js has no size limit, and its 'error' listener is attached permanently. A malformed DEFLATE block therefore routes through callback(err) into failWebsocketConnection(1007) and does not crash..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-14T02:32:59.548927+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.19.1 of undici. not_affected \u2014 Target is undici 7.19.1. The CVE says the flaw was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In this tree the cache and deduplication interceptors still read the origin from opts.origin and skip requests that have none, so keys always carry the destination origin.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 7.19.1. The CVE says the flaw was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In this tree the cache and deduplication interceptors still read the origin from opts.origin and skip requests that have none, so keys always carry the destination origin." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-10-15T21:34:00.093587+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 7.19.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-14T01:54:31.473047+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 7.19.1 of undici. not_affected \u2014 Target is undici 7.19.1. CVE-2026-9675 is a regression in the 8.1.0 `maxPayloadSize` feature, where the per-frame limit was enforced but the cumulative size of fragmented messages was not. The 7.x line never had `maxPayloadSize`, and the CVE says 7.x is unaffected. The target has no `maxPayloadSize` option or limit logic anywhere. The flawed incomplete-limit code is therefore absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 Target is undici 7.19.1. CVE-2026-9675 is a regression in the 8.1.0 `maxPayloadSize` feature, where the per-frame limit was enforced but the cumulative size of fragmented messages was not. The 7.x line never had `maxPayloadSize`, and the CVE says 7.x is unaffected. The target has no `maxPayloadSize` option or limit logic anywhere. The flawed incomplete-limit code is therefore absent." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9678 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-9678" }, "action_statement": "Vulnerability CVE-2026-9678 affects version 7.19.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9679 affects version 7.19.1 of undici.", "vulnerability": { "name": "CVE-2026-9679" }, "action_statement": "Vulnerability CVE-2026-9679 affects version 7.19.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.19.1", "identifiers": { "purl": "pkg:npm/undici@7.19.1" } } ], "timestamp": "2026-11-13T20:14:00.045604+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 7.19.1 of undici. not_affected \u2014 Not affected. The target is undici 7.19.1, which predates SOCKS5 support (added in 7.23.0, where the bug was introduced). The repo has no SOCKS5 proxy code. The only proxy path, the HTTP-proxy ProxyAgent, passes requestTls to the destination TLS connector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 Not affected. The target is undici 7.19.1, which predates SOCKS5 support (added in 7.23.0, where the bug was introduced). The repo has no SOCKS5 proxy code. The only proxy path, the HTTP-proxy ProxyAgent, passes requestTls to the destination TLS connector." } ] }