{
  "@id": "urn:uuid:1a3e08c4-83d8-4c38-9640-430b1f2e4d5a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 34,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T02:58:00.113753+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 7.24.7 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-14T00:03:05.339999+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.24.7 of undici. not_affected \u2014 Undici 7.24.7 already contains the upstream CVE-2023-45143 fix. On a cross-origin redirect, lib/web/fetch/index.js deletes authorization, proxy-authorization, cookie and host from the request header list. The fix commit e041de35 is upstream-authored and shipped in the release TuxCare onboarded, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 Undici 7.24.7 already contains the upstream CVE-2023-45143 fix. On a cross-origin redirect, lib/web/fetch/index.js deletes authorization, proxy-authorization, cookie and host from the request header list. The fix commit e041de35 is upstream-authored and shipped in the release TuxCare onboarded, so the verdict is not_affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "action_statement": "Vulnerability CVE-2024-24750 affects version 7.24.7 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-13T22:22:00.050269+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.24.7 of undici. not_affected \u2014 Target undici 7.24.7 already strips Proxy-Authorization on cross-origin redirects in both the fetch path and the dispatcher RedirectHandler. The upstream fix is an ancestor of HEAD and shipped in the upstream release. The first non-upstream commit is a bot-authored build-config commit, not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.24.7 already strips Proxy-Authorization on cross-origin redirects in both the fetch path and the dispatcher RedirectHandler. The upstream fix is an ancestor of HEAD and shipped in the upstream release. The first non-upstream commit is a bot-authored build-config commit, not a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-14T00:30:26.670415+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.24.7 of undici. not_affected \u2014 Not affected. undici 7.24.7 already includes the upstream fix for CVE-2024-30260. The redirect handler strips authorization, proxy-authorization and cookie headers when a redirect crosses origin. The fix commit 6805746 is an ancestor of HEAD and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "impact_statement": "not_affected \u2014 Not affected. undici 7.24.7 already includes the upstream fix for CVE-2024-30260. The redirect handler strips authorization, proxy-authorization and cookie headers when a redirect crosses origin. The fix commit 6805746 is an ancestor of HEAD and shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-13T23:33:57.977509+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.24.7 of undici. not_affected \u2014 Target undici 7.24.7 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd). Subresource-integrity handling was later rewritten to the spec-compliant form: parseMetadata, getStrongestMetadata and a bytesMatch that compares the body digest against every strongest-algorithm entry. The fix commit is an ancestor of HEAD and was authored upstream by Matteo Collin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.24.7 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd). Subresource-integrity handling was later rewritten to the spec-compliant form: parseMetadata, getStrongestMetadata and a bytesMatch that compares the body digest against every strongest-algorithm entry. The fix commit is an ancestor of HEAD and was authored upstream by Matteo Collin..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 7.24.7 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-06T10:54:10.593628+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.24.7 of undici. not_affected \u2014 Not affected. Multipart boundary generation in lib/web/fetch/body.js uses crypto.randomInt, which is the upstream fix (commit c2d78cd1) for CVE-2025-22150. The fix shipped inside upstream release 7.24.7, so the Math.random() boundary pattern is no longer present in the normal runtime path.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "impact_statement": "not_affected \u2014 Not affected. Multipart boundary generation in lib/web/fetch/body.js uses crypto.randomInt, which is the upstream fix (commit c2d78cd1) for CVE-2025-22150. The fix shipped inside upstream release 7.24.7, so the Math.random() boundary pattern is no longer present in the normal runtime path."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-06T11:02:55.739585+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.24.7 of undici. not_affected \u2014 undici 7.24.7 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool removes clients from its client list whenever a 'connectionError' is emitted, so repeated failed TLS connections no longer accumulate retained clients. The fix shipped in the upstream release and was not authored by TuxCare, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "impact_statement": "not_affected \u2014 undici 7.24.7 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool removes clients from its client list whenever a 'connectionError' is emitted, so repeated failed TLS connections no longer accumulate retained clients. The fix shipped in the upstream release and was not authored by TuxCare, so the verdict is not_affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-10-15T18:44:00.132301+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-10-15T18:46:33.687871+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-10-15T18:46:33.687871+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "action_statement": "Vulnerability CVE-2026-109841 affects version 7.24.7 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-14T02:58:00.113753+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.24.7 of undici. not_affected \u2014 Target undici 7.24.7 does not have the 8.11.0 regression. The H2 WebSocket path exists, but the abort after a failed handshake is not a no-op and the upgrade stream always has a persistent 'error' listener. A malicious server therefore cannot cause an unhandled stream 'error' that exits the process.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.24.7 does not have the 8.11.0 regression. The H2 WebSocket path exists, but the abort after a failed handshake is not a no-op and the upgrade stream always has a persistent 'error' listener. A malicious server therefore cannot cause an unhandled stream 'error' that exits the process."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-10-15T18:28:00.152357+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-10-15T18:34:00.250279+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "action_statement": "Vulnerability CVE-2026-109924 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "action_statement": "Vulnerability CVE-2026-11525 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-06T10:20:26.750713+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "action_statement": "Vulnerability CVE-2026-116630 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "action_statement": "Vulnerability CVE-2026-120222 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "action_statement": "Vulnerability CVE-2026-120415 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "action_statement": "Vulnerability CVE-2026-120423 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-06T10:06:35.912230+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "action_statement": "Vulnerability CVE-2026-120474 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "action_statement": "Vulnerability CVE-2026-12151 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "action_statement": "Vulnerability CVE-2026-13697 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "action_statement": "Vulnerability CVE-2026-14643 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "action_statement": "Vulnerability CVE-2026-15157 affects version 7.24.7 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-06T11:14:41.071379+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 does not affect version 7.24.7 of undici. not_affected \u2014 undici 7.24.7 already contains the upstream fix for CVE-2026-1525. processHeader() in lib/core/request.js throws on a repeated content-length (or host) header after lower-casing the name, so case-variant duplicates in a flat array are rejected. The fix commit 74495c63 is by upstream author Matteo Collina and shipped in the upstream release, before any TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "impact_statement": "not_affected \u2014 undici 7.24.7 already contains the upstream fix for CVE-2026-1525. processHeader() in lib/core/request.js throws on a repeated content-length (or host) header after lower-casing the name, so case-variant duplicates in a flat array are rejected. The fix commit 74495c63 is by upstream author Matteo Collina and shipped in the upstream release, before any TuxCare commit."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 7.24.7 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-06T11:23:00.043341+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 does not affect version 7.24.7 of undici. not_affected \u2014 Target undici 7.24.7 already contains the upstream CVE-2026-1527 fix (commit 77594f92, \"validate upgrade header to prevent CRLF injection\"). Request construction rejects any `upgrade` value containing invalid header characters, including CR/LF, before it can reach the socket write in client-h1.js. The fix shipped in the upstream release; it is not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.24.7 already contains the upstream CVE-2026-1527 fix (commit 77594f92, \"validate upgrade header to prevent CRLF injection\"). Request construction rejects any `upgrade` value containing invalid header characters, including CR/LF, before it can reach the socket write in client-h1.js. The fix shipped in the upstream release; it is not a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-13T22:00:03.479197+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 does not affect version 7.24.7 of undici. not_affected \u2014 undici 7.24.7 already contains the upstream fix for CVE-2026-1528. The 64-bit payload-length branch of ByteParser (lib/web/websocket/receiver.js:181-202) rejects any frame whose upper 32 bits are non-zero or whose lower 32 bits exceed 2^31-1, and fails the connection with code 1009. The fix is upstream commit 84235c62 \"Fix websocket 64-bit length overflow\" by hello@matteocollina.com. It is an a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "impact_statement": "not_affected \u2014 undici 7.24.7 already contains the upstream fix for CVE-2026-1528. The 64-bit payload-length branch of ByteParser (lib/web/websocket/receiver.js:181-202) rejects any frame whose upper 32 bits are non-zero or whose lower 32 bits exceed 2^31-1, and fails the connection with code 1009. The fix is upstream commit 84235c62 \"Fix websocket 64-bit length overflow\" by hello@matteocollina.com. It is an a..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "action_statement": "Vulnerability CVE-2026-16728 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "action_statement": "Vulnerability CVE-2026-16729 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "action_statement": "Vulnerability CVE-2026-18149 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "action_statement": "Vulnerability CVE-2026-18540 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "action_statement": "Vulnerability CVE-2026-19534 affects version 7.24.7 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-06T11:11:00.038105+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.24.7 of undici. not_affected \u2014 undici 7.24.7 already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses with more than 5 chained content-encodings before any decoder is created. The fix shipped in the upstream release as commit b04e3cbb (author Matteo Collina), so it is an upstream fix and not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "impact_statement": "not_affected \u2014 undici 7.24.7 already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses with more than 5 chained content-encodings before any decoder is created. The fix shipped in the upstream release as commit b04e3cbb (author Matteo Collina), so it is an upstream fix and not a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 7.24.7 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-14T01:34:28.431620+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 does not affect version 7.24.7 of undici. not_affected \u2014 Undici 7.24.7 already contains the upstream fix for CVE-2026-2581. Upstream commit 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\", by Matteo Collina) is an ancestor of HEAD. The deduplication handler forwards chunks as they arrive. It buffers only per paused waiter, capped at maxBufferSize, and refuses to attach new waiters once body data has started. The fix shipped i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "impact_statement": "not_affected \u2014 Undici 7.24.7 already contains the upstream fix for CVE-2026-2581. Upstream commit 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\", by Matteo Collina) is an ancestor of HEAD. The deduplication handler forwards chunks as they arrive. It buffers only per paused waiter, capped at maxBufferSize, and refuses to attach new waiters once body data has started. The fix shipped i..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "action_statement": "Vulnerability CVE-2026-6733 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "action_statement": "Vulnerability CVE-2026-6734 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "action_statement": "Vulnerability CVE-2026-84890 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "action_statement": "Vulnerability CVE-2026-84933 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "action_statement": "Vulnerability CVE-2026-84947 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "action_statement": "Vulnerability CVE-2026-84961 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "action_statement": "Vulnerability CVE-2026-85008 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-29T18:27:17.765346+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "action_statement": "Vulnerability CVE-2026-85014 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:03.785272+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "action_statement": "Vulnerability CVE-2026-85024 affects version 7.24.7 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-14T02:33:45.545808+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.24.7 of undici. not_affected \u2014 Target is undici 7.24.7. CVE-2026-85152 was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In the target, the cache and deduplication keys always include opts.origin, and requests with no origin bypass both interceptors. The \"key built without the destination origin\" flaw is absent. The target's key logic is not the 8.10.x logic.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.24.7. CVE-2026-85152 was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In the target, the cache and deduplication keys always include opts.origin, and requests with no origin bypass both interceptors. The \"key built without the destination origin\" flaw is absent. The target's key logic is not the 8.10.x logic."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-10-15T18:48:04.069265+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-10-15T21:34:00.093587+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "action_statement": "Vulnerability CVE-2026-87029 affects version 7.24.7 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-11-14T01:58:03.198614+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 does not affect version 7.24.7 of undici. not_affected \u2014 Target is undici 7.24.7. CVE-2026-9675 is a regression in the `maxPayloadSize` feature, which exists only in the 8.x line. The cumulative-size check for fragmented uncompressed messages was missing from that feature. The 7.x line never had `maxPayloadSize`, and a repo-wide search finds no occurrence of it. The code the patch fixes is not present, and the CVE explicitly lists 7.x as unaffected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.24.7. CVE-2026-9675 is a regression in the `maxPayloadSize` feature, which exists only in the 8.x line. The cumulative-size check for fragmented uncompressed messages was missing from that feature. The 7.x line never had `maxPayloadSize`, and a repo-wide search finds no occurrence of it. The code the patch fixes is not present, and the CVE explicitly lists 7.x as unaffected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "action_statement": "Vulnerability CVE-2026-9678 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "action_statement": "Vulnerability CVE-2026-9679 affects version 7.24.7 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.24.7",
          "identifiers": {
            "purl": "pkg:npm/undici@7.24.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 affects version 7.24.7 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "action_statement": "Vulnerability CVE-2026-9697 affects version 7.24.7 of undici."
    }
  ]
}