{ "@id": "urn:uuid:fd0aa05f-598f-4784-a3f8-0474cebaa83b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 35, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:57:29.427470+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 7.22.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-14T00:03:46.906673+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.22.0 of undici. not_affected \u2014 Undici 7.22.0 already contains the upstream CVE-2023-45143 fix. On a cross-origin redirect, the fetch redirect logic deletes authorization, proxy-authorization, cookie and host. The fix came from an upstream author and shipped in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Undici 7.22.0 already contains the upstream CVE-2023-45143 fix. On a cross-origin redirect, the fetch redirect logic deletes authorization, proxy-authorization, cookie and host. The fix came from an upstream author and shipped in the upstream release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 7.22.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-13T22:22:00.050269+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.22.0 of undici. not_affected \u2014 CVE-2024-24758 (Proxy-Authorization not cleared on cross-origin redirect) is already fixed in undici 7.22.0. Both redirect paths strip proxy-authorization on cross-origin redirects. The upstream fix commit b9da3e40 (author hello@matteocollina.com) is an ancestor of HEAD, and no TuxCare-domain commits exist in history.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 CVE-2024-24758 (Proxy-Authorization not cleared on cross-origin redirect) is already fixed in undici 7.22.0. Both redirect paths strip proxy-authorization on cross-origin redirects. The upstream fix commit b9da3e40 (author hello@matteocollina.com) is an ancestor of HEAD, and no TuxCare-domain commits exist in history." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-14T00:30:00.611450+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.22.0 of undici. not_affected \u2014 Target undici 7.22.0 already contains the upstream fix for CVE-2024-30260. On a cross-origin redirect, lib/handler/redirect-handler.js strips authorization, proxy-authorization and cookie headers. The fix commit 6805746680d27a5369d7fb67bc05f95a28247d75 is an ancestor of HEAD, and HEAD has no TuxCare commits, so the fix shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 Target undici 7.22.0 already contains the upstream fix for CVE-2024-30260. On a cross-origin redirect, lib/handler/redirect-handler.js strips authorization, proxy-authorization and cookie headers. The fix commit 6805746680d27a5369d7fb67bc05f95a28247d75 is an ancestor of HEAD, and HEAD has no TuxCare commits, so the fix shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-13T23:33:00.074877+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.22.0 of undici. not_affected \u2014 undici 7.22.0 already contains the upstream fix for CVE-2024-30261. Upstream commit d542b8cd (Matteo Collina, GHSA-9qxr-qj54-h672) is an ancestor of HEAD, and the integrity check in lib/web/subresource-integrity/subresource-integrity.js keeps only the strongest-algorithm entries before comparing. HEAD has no TuxCare/CloudLinux commits, so this is an upstream fix shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 undici 7.22.0 already contains the upstream fix for CVE-2024-30261. Upstream commit d542b8cd (Matteo Collina, GHSA-9qxr-qj54-h672) is an ancestor of HEAD, and the integrity check in lib/web/subresource-integrity/subresource-integrity.js keeps only the strongest-algorithm entries before comparing. HEAD has no TuxCare/CloudLinux commits, so this is an upstream fix shipped in the release." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 7.22.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-13T21:31:00.047911+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.22.0 of undici. not_affected \u2014 The multipart boundary in lib/web/fetch/body.js is generated with node:crypto randomInt, not Math.random. This is the upstream fix for CVE-2025-22150 (commit c2d78cd1, authored by Matteo Collina). HEAD is a plain upstream 7.22.0 history with no TuxCare commits, so the fix shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 The multipart boundary in lib/web/fetch/body.js is generated with node:crypto randomInt, not Math.random. This is the upstream fix for CVE-2025-22150 (commit c2d78cd1, authored by Matteo Collina). HEAD is a plain upstream 7.22.0 history with no TuxCare commits, so the fix shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-13T21:36:00.116676+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.22.0 of undici. not_affected \u2014 Undici 7.22.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool and RoundRobinPool register a 'connectionError' listener that splices failed clients out of the pool's client list, so failed-connection clients are not retained. The fix shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 Undici 7.22.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool and RoundRobinPool register a 'connectionError' listener that splices failed clients out of the pool's client list, so failed-connection clients are not retained. The fix shipped in the upstream release." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 7.22.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-14T02:57:29.427470+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.22.0 of undici. not_affected \u2014 Target is undici 7.22.0. CVE-2026-109855 is a regression introduced in 8.11.0 (affects 8.11.0 and 8.11.1). That regression is absent here. WebSocket over HTTP/2 exists, but a failed handshake still aborts the stream and the stream keeps its 'error' listener, so no orphaned stream can raise an unhandled error. Caveat: the patch was supplied only as a URL, so I inferred its intent from the CVE text.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 7.22.0. CVE-2026-109855 is a regression introduced in 8.11.0 (affects 8.11.0 and 8.11.1). That regression is absent here. WebSocket over HTTP/2 exists, but a failed handshake still aborts the stream and the stream keeps its 'error' listener, so no orphaned stream can raise an unhandled error. Caveat: the patch was supplied only as a URL, so I inferred its intent from the CVE text." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-10-15T18:28:00.152357+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-10-15T18:33:00.174668+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-06T10:20:26.750713+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-14643 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-14643" }, "action_statement": "Vulnerability CVE-2026-14643 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1525 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-1525" }, "action_statement": "Vulnerability CVE-2026-1525 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1527 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-1527" }, "action_statement": "Vulnerability CVE-2026-1527 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1528 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-1528" }, "action_statement": "Vulnerability CVE-2026-1528 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 7.22.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-13T21:43:08.459583+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.22.0 of undici. not_affected \u2014 undici 7.22.0 already caps Content-Encoding chains at 5 in both fetch() and the decompress interceptor. The cap comes from upstream commit b04e3cbb (Matteo Collina, committed via GitHub), which is already in the upstream 7.22.0 release (0a236106). The unbounded-chain pattern is not present in HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 undici 7.22.0 already caps Content-Encoding chains at 5 in both fetch() and the decompress interceptor. The cap comes from upstream commit b04e3cbb (Matteo Collina, committed via GitHub), which is already in the upstream 7.22.0 release (0a236106). The unbounded-chain pattern is not present in HEAD." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2581 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-2581" }, "action_statement": "Vulnerability CVE-2026-2581 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 7.22.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-13T20:09:39.760132+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 7.22.0 of undici. not_affected \u2014 Target is undici 7.22.0. Socks5ProxyAgent, the component with the cross-origin pool-reuse flaw, was introduced in 7.23.0 (PR #4385) and does not exist in this tree. No SOCKS code is present, so the vulnerable pattern is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Target is undici 7.22.0. Socks5ProxyAgent, the component with the cross-origin pool-reuse flaw, was introduced in 7.23.0 (PR #4385) and does not exist in this tree. No SOCKS code is present, so the vulnerable pattern is absent." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 7.22.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-13T20:37:00.086722+00:00", "status_notes": "Vulnerability CVE-2026-84961 does not affect version 7.22.0 of undici. not_affected \u2014 undici 7.22.0 BalancedPool does not JSON-clone its constructor options, so function-valued connect/tls options (such as checkServerIdentity or a custom connector) are never dropped. The vulnerable chain step, a JSON-based deep clone of the options in BalancedPool, is absent. The patch diffs were not provided (URLs only), so the fix intent was inferred from the CVE text.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-84961" }, "impact_statement": "not_affected \u2014 undici 7.22.0 BalancedPool does not JSON-clone its constructor options, so function-valued connect/tls options (such as checkServerIdentity or a custom connector) are never dropped. The vulnerable chain step, a JSON-based deep clone of the options in BalancedPool, is absent. The patch diffs were not provided (URLs only), so the fix intent was inferred from the CVE text." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-29T18:27:17.765346+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 7.22.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-14T02:13:19.192215+00:00", "status_notes": "Vulnerability CVE-2026-85024 does not affect version 7.22.0 of undici. not_affected \u2014 undici 7.22.0 does not have the vulnerable size-limit cleanup. permessage-deflate.js has no decompressed-size limit and never calls removeAllListeners() on the InflateRaw stream, so the permanent 'error' listener is never stripped and the unhandled-error crash cannot occur. Malformed DEFLATE data is handled by the listener, which fails the connection with 1007.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-85024" }, "impact_statement": "not_affected \u2014 undici 7.22.0 does not have the vulnerable size-limit cleanup. permessage-deflate.js has no decompressed-size limit and never calls removeAllListeners() on the InflateRaw stream, so the permanent 'error' listener is never stripped and the unhandled-error crash cannot occur. Malformed DEFLATE data is handled by the listener, which fails the connection with 1007." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-14T02:32:59.548927+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.22.0 of undici. not_affected \u2014 Target is undici 7.22.0. The CVE says the flaw was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In this tree, the cache and deduplicate interceptors take the origin only from the dispatch options. They skip caching and deduplication when no origin is present, and the keys they build always include that origin. So the flaw (keys built without the destination origin) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 7.22.0. The CVE says the flaw was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In this tree, the cache and deduplicate interceptors take the origin only from the dispatch options. They skip caching and deduplication when no origin is present, and the keys they build always include that origin. So the flaw (keys built without the destination origin) is not present." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-10-15T21:34:00.093587+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 7.22.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-14T01:57:00.064318+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 7.22.0 of undici. not_affected \u2014 Target is undici 7.22.0. CVE-2026-9675 is a regression in the maxPayloadSize feature added in undici 8.1.0: the limit was enforced per frame but not cumulatively across fragments. The 7.x line has no maxPayloadSize option, so there is no configured limit to bypass and the regressed code is absent. The advisory itself states 7.x is unaffected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 Target is undici 7.22.0. CVE-2026-9675 is a regression in the maxPayloadSize feature added in undici 8.1.0: the limit was enforced per frame but not cumulatively across fragments. The 7.x line has no maxPayloadSize option, so there is no configured limit to bypass and the regressed code is absent. The advisory itself states 7.x is unaffected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9678 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-9678" }, "action_statement": "Vulnerability CVE-2026-9678 affects version 7.22.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9679 affects version 7.22.0 of undici.", "vulnerability": { "name": "CVE-2026-9679" }, "action_statement": "Vulnerability CVE-2026-9679 affects version 7.22.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.22.0", "identifiers": { "purl": "pkg:npm/undici@7.22.0" } } ], "timestamp": "2026-11-13T20:14:00.045604+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 7.22.0 of undici. not_affected \u2014 undici 7.22.0 predates SOCKS5 proxy support, which was added in 7.23.0. The vulnerable Socks5ProxyAgent path, and the ProxyAgent socks5:// dispatch that drops requestTls, do not exist in this tree. The only ProxyAgent path (HTTP CONNECT tunnel) passes requestTls to the TLS connector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 undici 7.22.0 predates SOCKS5 proxy support, which was added in 7.23.0. The vulnerable Socks5ProxyAgent path, and the ProxyAgent socks5:// dispatch that drops requestTls, do not exist in this tree. The only ProxyAgent path (HTTP CONNECT tunnel) passes requestTls to the TLS connector." } ] }