{
  "@id": "urn:uuid:2c8096e6-d88f-4aea-946c-37a2650d8b39",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T02:59:19.400953+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 7.24.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-13T23:59:37.286671+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.24.1 of undici. not_affected \u2014 The target (undici 7.24.1) is not affected by CVE-2023-45143. The cross-origin redirect handler in lib/web/fetch/index.js already deletes authorization, proxy-authorization, cookie and host headers. This is the upstream fix, commit e041de35 (GHSA-wqq4-5wpv-mx2g). It is an ancestor of HEAD and of the first TuxCare commit, so it shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.24.1) is not affected by CVE-2023-45143. The cross-origin redirect handler in lib/web/fetch/index.js already deletes authorization, proxy-authorization, cookie and host headers. This is the upstream fix, commit e041de35 (GHSA-wqq4-5wpv-mx2g). It is an ancestor of HEAD and of the first TuxCare commit, so it shipped in the upstream release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "action_statement": "Vulnerability CVE-2024-24750 affects version 7.24.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-13T22:22:00.050269+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.24.1 of undici. not_affected \u2014 undici 7.24.1 already strips proxy-authorization on cross-origin redirects, in both the fetch implementation and the RedirectHandler used by request/dispatch. The fix is upstream-authored (GHSA-m4v8-wqvr-p9f7, Matteo Collina) and shipped in the upstream release before the first TuxCare commit, so the target is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 undici 7.24.1 already strips proxy-authorization on cross-origin redirects, in both the fetch implementation and the RedirectHandler used by request/dispatch. The fix is upstream-authored (GHSA-m4v8-wqvr-p9f7, Matteo Collina) and shipped in the upstream release before the first TuxCare commit, so the target is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-14T00:30:00.611450+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.24.1 of undici. not_affected \u2014 undici 7.24.1 is not affected by CVE-2024-30260. The upstream fix (6805746) is an ancestor of HEAD and was already in the upstream release before the first TuxCare commit. RedirectHandler strips authorization and proxy-authorization headers on cross-origin redirects.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "impact_statement": "not_affected \u2014 undici 7.24.1 is not affected by CVE-2024-30260. The upstream fix (6805746) is an ancestor of HEAD and was already in the upstream release before the first TuxCare commit. RedirectHandler strips authorization and proxy-authorization headers on cross-origin redirects."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-13T23:33:57.977509+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.24.1 of undici. not_affected \u2014 undici 7.24.1 is not affected by CVE-2024-30261. The upstream fix, d542b8cd (GHSA-9qxr-qj54-h672), is an ancestor of HEAD and is part of the upstream release that TuxCare onboarded. The integrity check was later refactored into lib/web/subresource-integrity/subresource-integrity.js. It picks the strongest algorithm by ordered index (sha256 < sha384 < sha512) and compares digests exactly (paddin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 undici 7.24.1 is not affected by CVE-2024-30261. The upstream fix, d542b8cd (GHSA-9qxr-qj54-h672), is an ancestor of HEAD and is part of the upstream release that TuxCare onboarded. The integrity check was later refactored into lib/web/subresource-integrity/subresource-integrity.js. It picks the strongest algorithm by ordered index (sha256 < sha384 < sha512) and compares digests exactly (paddin..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 7.24.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:59:00.033331+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.24.1 of undici. not_affected \u2014 Target undici 7.24.1 already contains the upstream fix for CVE-2025-22150. The FormData multipart boundary in lib/web/fetch/body.js is generated with node:crypto randomInt, not Math.random. Math.random is used only as a fallback on runtimes without node:crypto, which is also how the upstream fix is structured. The fix commit c2d78cd1 is by an upstream author and is in the upstream release, befo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.24.1 already contains the upstream fix for CVE-2025-22150. The FormData multipart boundary in lib/web/fetch/body.js is generated with node:crypto randomInt, not Math.random. Math.random is used only as a fallback on runtimes without node:crypto, which is also how the upstream fix is structured. The fix commit c2d78cd1 is by an upstream author and is in the upstream release, befo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:06:00.041554+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.24.1 of undici. not_affected \u2014 undici 7.24.1 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool removes clients from its client list on 'connectionError', so repeated TLS-invalid connection attempts no longer accumulate clients. The fix was in the upstream release that TuxCare onboarded, so the verdict is not_affected and not already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "impact_statement": "not_affected \u2014 undici 7.24.1 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool removes clients from its client list on 'connectionError', so repeated TLS-invalid connection attempts no longer accumulate clients. The fix was in the upstream release that TuxCare onboarded, so the verdict is not_affected and not already_fixed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:44:00.132301+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:46:33.687871+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:46:33.687871+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "action_statement": "Vulnerability CVE-2026-109841 affects version 7.24.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-14T02:59:19.400953+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.24.1 of undici. not_affected \u2014 Target is undici 7.24.1. CVE-2026-109855 is a regression introduced in 8.11.0 and affects only 8.11.0 and 8.11.1. In the target's HTTP/2 websocket path, abort() is not neutralised on upgrade (request.completed is never set by onUpgrade), and the ClientHttp2Stream has a permanent 'error' listener, so a failed handshake cannot leave an orphaned stream that crashes the process. Limitation: the pat...",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.24.1. CVE-2026-109855 is a regression introduced in 8.11.0 and affects only 8.11.0 and 8.11.1. In the target's HTTP/2 websocket path, abort() is not neutralised on upgrade (request.completed is never set by onUpgrade), and the ClientHttp2Stream has a permanent 'error' listener, so a failed handshake cannot leave an orphaned stream that crashes the process. Limitation: the pat..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:28:00.152357+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:33:00.174668+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "action_statement": "Vulnerability CVE-2026-109924 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "action_statement": "Vulnerability CVE-2026-11525 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:20:26.750713+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "action_statement": "Vulnerability CVE-2026-116630 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "action_statement": "Vulnerability CVE-2026-120222 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "action_statement": "Vulnerability CVE-2026-120415 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "action_statement": "Vulnerability CVE-2026-120423 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:06:35.912230+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "action_statement": "Vulnerability CVE-2026-120474 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "action_statement": "Vulnerability CVE-2026-12151 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "action_statement": "Vulnerability CVE-2026-13697 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "action_statement": "Vulnerability CVE-2026-14643 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "action_statement": "Vulnerability CVE-2026-15157 affects version 7.24.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:14:41.071379+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 does not affect version 7.24.1 of undici. not_affected \u2014 Target undici 7.24.1 already contains the upstream fix 74495c63 (\"fix: reject duplicate content-length and host headers\"). processHeader() lowercases every header key before the content-length/host duplicate checks, so case-variant duplicates in a flat header array throw InvalidArgumentError and never reach the wire. The fix is part of the upstream release that TuxCare onboarded (author Matteo ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.24.1 already contains the upstream fix 74495c63 (\"fix: reject duplicate content-length and host headers\"). processHeader() lowercases every header key before the content-length/host duplicate checks, so case-variant duplicates in a flat header array throw InvalidArgumentError and never reach the wire. The fix is part of the upstream release that TuxCare onboarded (author Matteo ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 7.24.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:17:54.818653+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 does not affect version 7.24.1 of undici. not_affected \u2014 undici 7.24.1 already contains the upstream fix for CVE-2026-1527. The Request constructor rejects any `upgrade` string containing CR/LF or other invalid header characters before it can reach the socket write in client-h1.js. The fix commit 77594f92 (Matteo Collina) is upstream work and was already in the release TuxCare onboarded, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "impact_statement": "not_affected \u2014 undici 7.24.1 already contains the upstream fix for CVE-2026-1527. The Request constructor rejects any `upgrade` string containing CR/LF or other invalid header characters before it can reach the socket write in client-h1.js. The fix commit 77594f92 (Matteo Collina) is upstream work and was already in the release TuxCare onboarded, so the verdict is not_affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-13T22:00:03.479197+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 does not affect version 7.24.1 of undici. not_affected \u2014 The target (undici 7.24.1) already contains the upstream fix for CVE-2026-1528 in lib/web/websocket/receiver.js. The fix is Matteo Collina's commit 84235c62. It shipped in the upstream release that TuxCare onboarded, so this is an upstream fix and not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.24.1) already contains the upstream fix for CVE-2026-1528 in lib/web/websocket/receiver.js. The fix is Matteo Collina's commit 84235c62. It shipped in the upstream release that TuxCare onboarded, so this is an upstream fix and not a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "action_statement": "Vulnerability CVE-2026-16728 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "action_statement": "Vulnerability CVE-2026-16729 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "action_statement": "Vulnerability CVE-2026-18149 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "action_statement": "Vulnerability CVE-2026-18540 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "action_statement": "Vulnerability CVE-2026-19534 affects version 7.24.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:11:00.038105+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.24.1 of undici. not_affected \u2014 Not affected. The upstream fix b04e3cbb (Matteo Collina) is already in this undici 7.24.1 tree. It caps the Content-Encoding chain at 5 in both fetch() and the decompress interceptor. The commit is in the upstream release, before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "impact_statement": "not_affected \u2014 Not affected. The upstream fix b04e3cbb (Matteo Collina) is already in this undici 7.24.1 tree. It caps the Content-Encoding chain at 5 in both fetch() and the decompress interceptor. The commit is in the upstream release, before the first TuxCare commit."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 7.24.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-14T01:34:00.116965+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 does not affect version 7.24.1 of undici. not_affected \u2014 The target is undici 7.24.1. It already contains the upstream fix commit 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\") by Matteo Collina. The commit is in the upstream release, so this is an upstream fix and the target is not affected. Response chunks are forwarded to waiting handlers as they arrive instead of being accumulated. Late joining is refused once body data...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "impact_statement": "not_affected \u2014 The target is undici 7.24.1. It already contains the upstream fix commit 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\") by Matteo Collina. The commit is in the upstream release, so this is an upstream fix and the target is not affected. Response chunks are forwarded to waiting handlers as they arrive instead of being accumulated. Late joining is refused once body data..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "action_statement": "Vulnerability CVE-2026-6733 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "action_statement": "Vulnerability CVE-2026-6734 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "action_statement": "Vulnerability CVE-2026-84890 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "action_statement": "Vulnerability CVE-2026-84933 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "action_statement": "Vulnerability CVE-2026-84947 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "action_statement": "Vulnerability CVE-2026-84961 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "action_statement": "Vulnerability CVE-2026-85008 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:27:17.765346+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "action_statement": "Vulnerability CVE-2026-85014 affects version 7.24.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-14T02:45:53.329042+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 does not affect version 7.24.1 of undici. not_affected \u2014 The size-limit cleanup in lib/web/websocket/permessage-deflate.js does call removeAllListeners() on the InflateRaw, which removes its error listener. It then calls destroy() on the stream. I could not reproduce the crash on Node 20.20.2 with that destroy() in place. The same harness did crash (unhandled Z_DATA_ERROR) when I removed the destroy() line from a copy of the file.",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "impact_statement": "not_affected \u2014 The size-limit cleanup in lib/web/websocket/permessage-deflate.js does call removeAllListeners() on the InflateRaw, which removes its error listener. It then calls destroy() on the stream. I could not reproduce the crash on Node 20.20.2 with that destroy() in place. The same harness did crash (unhandled Z_DATA_ERROR) when I removed the destroy() line from a copy of the file."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-14T02:33:14.008550+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.24.1 of undici. not_affected \u2014 Target is undici 7.24.1. The CVE says the flaw was introduced in 8.10.0, and the target's cache and deduplication key builders always include the request origin. Requests with no origin bypass caching and deduplication, so cross-origin key collision cannot occur.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.24.1. The CVE says the flaw was introduced in 8.10.0, and the target's cache and deduplication key builders always include the request origin. Requests with no origin bypass caching and deduplication, so cross-origin key collision cannot occur."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:48:04.069265+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-10-15T21:34:00.093587+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "action_statement": "Vulnerability CVE-2026-87029 affects version 7.24.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-11-14T01:58:18.621399+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 does not affect version 7.24.1 of undici. not_affected \u2014 CVE-2026-9675 is a regression in undici 8.1.0. The maxPayloadSize feature enforced a limit per frame but not cumulatively across fragments. The target is undici 7.24.1, which has no maxPayloadSize option anywhere in lib/, so the limit-bypass flaw cannot occur. The CVE states the 7.x line never had maxPayloadSize and is unaffected. I checked this against the receiver code. The vendor-specified a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-9675 is a regression in undici 8.1.0. The maxPayloadSize feature enforced a limit per frame but not cumulatively across fragments. The target is undici 7.24.1, which has no maxPayloadSize option anywhere in lib/, so the limit-bypass flaw cannot occur. The CVE states the 7.x line never had maxPayloadSize and is unaffected. I checked this against the receiver code. The vendor-specified a..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "action_statement": "Vulnerability CVE-2026-9678 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "action_statement": "Vulnerability CVE-2026-9679 affects version 7.24.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 affects version 7.24.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "action_statement": "Vulnerability CVE-2026-9697 affects version 7.24.1 of undici."
    }
  ]
}