{
  "@id": "urn:uuid:491a8840-6fa4-4bb1-bed5-46157452d3f5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T02:59:44.828253+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 7.24.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-14T00:05:01.866674+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.24.5 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2023-45143 (e041de3) is already in this undici 7.24.5 tree. On a cross-origin redirect, fetch deletes authorization, proxy-authorization, cookie and host from the request headers before following it. The fix shipped in the upstream release, before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2023-45143 (e041de3) is already in this undici 7.24.5 tree. On a cross-origin redirect, fetch deletes authorization, proxy-authorization, cookie and host from the request headers before following it. The fix shipped in the upstream release, before the first TuxCare commit."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "action_statement": "Vulnerability CVE-2024-24750 affects version 7.24.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-13T22:22:49.594925+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.24.5 of undici. not_affected \u2014 Not affected. The target (undici 7.24.5) already strips proxy-authorization, along with authorization and cookie, on cross-origin redirects. This upstream fix shipped in the release. The first fix-bearing commit, 6805746, is upstream-authored (hello@matteocollina.com). HEAD has no TuxCare-domain author or committer. Its top commits are automation commits that only change tuxcare.yaml and tuxcar...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 Not affected. The target (undici 7.24.5) already strips proxy-authorization, along with authorization and cookie, on cross-origin redirects. This upstream fix shipped in the release. The first fix-bearing commit, 6805746, is upstream-authored (hello@matteocollina.com). HEAD has no TuxCare-domain author or committer. Its top commits are automation commits that only change tuxcare.yaml and tuxcar..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-14T00:31:19.040731+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.24.5 of undici. not_affected \u2014 Target (undici 7.24.5) already contains the upstream CVE-2024-30260 fix. The redirect handler strips authorization, proxy-authorization and cookie headers on cross-origin redirects, and this applies to undici.request() because it is implemented in the shared RedirectHandler. The fix commit 6805746 is an ancestor of HEAD and ships in the upstream release, before any TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "impact_statement": "not_affected \u2014 Target (undici 7.24.5) already contains the upstream CVE-2024-30260 fix. The redirect handler strips authorization, proxy-authorization and cookie headers on cross-origin redirects, and this applies to undici.request() because it is implemented in the shared RedirectHandler. The fix commit 6805746 is an ancestor of HEAD and ships in the upstream release, before any TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-13T23:39:00.076832+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.24.5 of undici. not_affected \u2014 undici 7.24.5 is not affected by CVE-2024-30261. The upstream fix commit d542b8cd (Matteo Collina, GHSA-9qxr-qj54-h672) is an ancestor of HEAD. The subresource-integrity implementation in the target is the spec-aligned rewrite and does not have the flawed algorithm-selection and comparison logic.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 undici 7.24.5 is not affected by CVE-2024-30261. The upstream fix commit d542b8cd (Matteo Collina, GHSA-9qxr-qj54-h672) is an ancestor of HEAD. The subresource-integrity implementation in the target is the spec-aligned rewrite and does not have the flawed algorithm-selection and comparison logic."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 7.24.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-06T10:54:00.031818+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.24.5 of undici. not_affected \u2014 The target is undici 7.24.5. The upstream fix for CVE-2025-22150 is already in HEAD, and it shipped in the upstream release. The multipart boundary is generated with node:crypto randomInt, not Math.random(). Math.random() is used only as a fallback when the crypto feature is unavailable.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "impact_statement": "not_affected \u2014 The target is undici 7.24.5. The upstream fix for CVE-2025-22150 is already in HEAD, and it shipped in the upstream release. The multipart boundary is generated with node:crypto randomInt, not Math.random(). Math.random() is used only as a fallback when the crypto feature is unavailable."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-06T11:06:00.041554+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.24.5 of undici. not_affected \u2014 undici 7.24.5 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool now removes clients from its list when they emit connectionError, so repeated TLS-failure connections do not accumulate. The fix shipped in the upstream release, and HEAD has no commit by a TuxCare or CloudLinux author.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "impact_statement": "not_affected \u2014 undici 7.24.5 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool now removes clients from its list when they emit connectionError, so repeated TLS-failure connections do not accumulate. The fix shipped in the upstream release, and HEAD has no commit by a TuxCare or CloudLinux author."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-10-15T18:44:00.132301+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-10-15T18:46:33.687871+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-10-15T18:47:21.529900+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "action_statement": "Vulnerability CVE-2026-109841 affects version 7.24.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-14T02:59:44.828253+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.24.5 of undici. not_affected \u2014 undici 7.24.5 is not affected. CVE-2026-109855 is a regression introduced in 8.11.0, and this tree lacks both elements that make it exploitable. Request.onUpgrade() does not set request.completed, so abort() is not a no-op and the stream gets closed. The H2 websocket stream also has an 'error' listener, so a later connection teardown cannot raise an unhandled stream error.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "impact_statement": "not_affected \u2014 undici 7.24.5 is not affected. CVE-2026-109855 is a regression introduced in 8.11.0, and this tree lacks both elements that make it exploitable. Request.onUpgrade() does not set request.completed, so abort() is not a no-op and the stream gets closed. The H2 websocket stream also has an 'error' listener, so a later connection teardown cannot raise an unhandled stream error."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-10-15T18:29:00.261196+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-10-15T18:34:00.250279+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "action_statement": "Vulnerability CVE-2026-109924 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "action_statement": "Vulnerability CVE-2026-11525 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-06T10:20:26.750713+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "action_statement": "Vulnerability CVE-2026-116630 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "action_statement": "Vulnerability CVE-2026-120222 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "action_statement": "Vulnerability CVE-2026-120415 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "action_statement": "Vulnerability CVE-2026-120423 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-06T10:06:35.912230+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "action_statement": "Vulnerability CVE-2026-120474 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "action_statement": "Vulnerability CVE-2026-12151 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "action_statement": "Vulnerability CVE-2026-13697 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "action_statement": "Vulnerability CVE-2026-14643 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "action_statement": "Vulnerability CVE-2026-15157 affects version 7.24.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-06T11:14:00.035776+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 does not affect version 7.24.5 of undici. not_affected \u2014 Target undici 7.24.5 already contains the upstream fix 74495c63 (Matteo Collina, \"reject duplicate content-length and host headers\"). processHeader lowercases the header name and throws 'duplicate content-length header' on a second content-length, including for flat-array headers with case variants. The fix shipped in the upstream release, and HEAD has no TuxCare commits.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.24.5 already contains the upstream fix 74495c63 (Matteo Collina, \"reject duplicate content-length and host headers\"). processHeader lowercases the header name and throws 'duplicate content-length header' on a second content-length, including for flat-array headers with case variants. The fix shipped in the upstream release, and HEAD has no TuxCare commits."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 7.24.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-06T11:19:35.748950+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 does not affect version 7.24.5 of undici. not_affected \u2014 Target undici 7.24.5 already contains the upstream fix (commit 77594f92, \"validate upgrade header to prevent CRLF injection\"). Request construction rejects non-string or CR/LF/NUL-bearing upgrade values before they reach the socket writer. The fix shipped in the upstream release, before any TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.24.5 already contains the upstream fix (commit 77594f92, \"validate upgrade header to prevent CRLF injection\"). Request construction rejects non-string or CR/LF/NUL-bearing upgrade values before they reach the socket writer. The fix shipped in the upstream release, before any TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-13T22:00:48.612672+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 does not affect version 7.24.5 of undici. not_affected \u2014 undici 7.24.5 already contains the upstream fix for CVE-2026-1528 (commit 84235c62, \"Fix websocket 64-bit length overflow\", by Matteo Collina). The 64-bit length branch of the WebSocket frame parser rejects any length with a non-zero upper 32 bits or a lower half above 2^31-1. It then closes the connection with status 1009 instead of continuing into the arithmetic that crashed the process. The ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "impact_statement": "not_affected \u2014 undici 7.24.5 already contains the upstream fix for CVE-2026-1528 (commit 84235c62, \"Fix websocket 64-bit length overflow\", by Matteo Collina). The 64-bit length branch of the WebSocket frame parser rejects any length with a non-zero upper 32 bits or a lower half above 2^31-1. It then closes the connection with status 1009 instead of continuing into the arithmetic that crashed the process. The ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "action_statement": "Vulnerability CVE-2026-16728 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "action_statement": "Vulnerability CVE-2026-16729 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "action_statement": "Vulnerability CVE-2026-18149 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "action_statement": "Vulnerability CVE-2026-18540 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "action_statement": "Vulnerability CVE-2026-19534 affects version 7.24.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-06T11:06:00.041554+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.24.5 of undici. not_affected \u2014 Not affected: undici 7.24.5 already contains the upstream fix. Both the fetch() response path and the decompress interceptor reject Content-Encoding chains longer than 5. The fix commit b04e3cbb was authored upstream by Matteo Collina and is an ancestor of HEAD. HEAD has no TuxCare-domain commits, so the fix shipped with the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "impact_statement": "not_affected \u2014 Not affected: undici 7.24.5 already contains the upstream fix. Both the fetch() response path and the decompress interceptor reject Content-Encoding chains longer than 5. The fix commit b04e3cbb was authored upstream by Matteo Collina and is an ancestor of HEAD. HEAD has no TuxCare-domain commits, so the fix shipped with the upstream release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 7.24.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-14T01:38:00.597373+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 does not affect version 7.24.5 of undici. not_affected \u2014 The target (undici 7.24.5) already contains the upstream fix for CVE-2026-2581 (commit 5890c7b7, \"fix(deduplicate): stream response chunks to waiting handlers\"). The commit is an ancestor of HEAD, was shipped in the upstream release, and was authored and committed by the upstream maintainer. The deduplication handler streams chunks to waiting handlers and refuses late attachment once body data ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.24.5) already contains the upstream fix for CVE-2026-2581 (commit 5890c7b7, \"fix(deduplicate): stream response chunks to waiting handlers\"). The commit is an ancestor of HEAD, was shipped in the upstream release, and was authored and committed by the upstream maintainer. The deduplication handler streams chunks to waiting handlers and refuses late attachment once body data ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "action_statement": "Vulnerability CVE-2026-6733 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "action_statement": "Vulnerability CVE-2026-6734 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "action_statement": "Vulnerability CVE-2026-84890 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "action_statement": "Vulnerability CVE-2026-84933 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "action_statement": "Vulnerability CVE-2026-84947 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "action_statement": "Vulnerability CVE-2026-84961 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "action_statement": "Vulnerability CVE-2026-85008 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-29T18:27:17.765346+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "action_statement": "Vulnerability CVE-2026-85014 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:03.785272+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "action_statement": "Vulnerability CVE-2026-85024 affects version 7.24.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-14T02:36:29.324890+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.24.5 of undici. not_affected \u2014 Target is undici 7.24.5. The CVE says the flaw was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In this tree the cache and deduplicate interceptors never build a key without an origin. Requests with no origin skip both interceptors, and every other key includes the origin. I could not read the patch diff (only a URL was given, and remote access is not allowed), so this rests on the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.24.5. The CVE says the flaw was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In this tree the cache and deduplicate interceptors never build a key without an origin. Requests with no origin skip both interceptors, and every other key includes the origin. I could not read the patch diff (only a URL was given, and remote access is not allowed), so this rests on the ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-10-15T18:48:04.069265+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "action_statement": "Vulnerability CVE-2026-87029 affects version 7.24.5 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-11-14T01:59:22.635915+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 does not affect version 7.24.5 of undici. not_affected \u2014 Target is undici 7.24.5. CVE-2026-9675 is a regression in the maxPayloadSize feature introduced in undici 8.1.0, where the per-frame limit was not backed by a cumulative limit across fragments. The 7.x line never had maxPayloadSize, and the CVE states 7.x is unaffected. No maxPayloadSize option exists anywhere in lib/, types/ or index.js. The vulnerable limit-enforcement code is absent. Caveat:...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.24.5. CVE-2026-9675 is a regression in the maxPayloadSize feature introduced in undici 8.1.0, where the per-frame limit was not backed by a cumulative limit across fragments. The 7.x line never had maxPayloadSize, and the CVE states 7.x is unaffected. No maxPayloadSize option exists anywhere in lib/, types/ or index.js. The vulnerable limit-enforcement code is absent. Caveat:..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "action_statement": "Vulnerability CVE-2026-9678 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "action_statement": "Vulnerability CVE-2026-9679 affects version 7.24.5 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.5",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 affects version 7.24.5 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "action_statement": "Vulnerability CVE-2026-9697 affects version 7.24.5 of undici."
    }
  ]
}