{ "@id": "urn:uuid:64f28ab9-558a-4ca1-93cd-cbadcc6753fc", "role": "Document Creator", "author": "https://tuxcare.com", "version": 34, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:57:29.427470+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 7.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-14T00:04:00.566721+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.25.0 of undici. not_affected \u2014 Target is undici 7.25.0. Cross-origin redirect handling strips cookie, proxy-authorization and authorization in both fetch and the core RedirectHandler. This is the behavior added by upstream fix e041de35 (GHSA-wqq4-5wpv-mx2g, 5.26.2). The fix is an upstream commit that is an ancestor of HEAD, and HEAD has no TuxCare-domain commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Target is undici 7.25.0. Cross-origin redirect handling strips cookie, proxy-authorization and authorization in both fetch and the core RedirectHandler. This is the behavior added by upstream fix e041de35 (GHSA-wqq4-5wpv-mx2g, 5.26.2). The fix is an upstream commit that is an ancestor of HEAD, and HEAD has no TuxCare-domain commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 7.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-13T22:22:49.594925+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.25.0 of undici. not_affected \u2014 undici 7.25.0 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher redirect handler. The fix is upstream-authored and shipped in the upstream release. The advisory's patched versions are 5.28.3 and 6.6.1, and 7.25.0 is later than both.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 undici 7.25.0 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher redirect handler. The fix is upstream-authored and shipped in the upstream release. The advisory's patched versions are 5.28.3 and 6.6.1, and 7.25.0 is later than both." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-14T00:30:00.611450+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.25.0 of undici. not_affected \u2014 undici 7.25.0 already strips Authorization, Proxy-Authorization and Cookie on cross-origin redirects in the dispatcher-level redirect handler, which is the path undici.request() uses. The fix is upstream commit 6805746 (Matteo Collina). It is an ancestor of the first TuxCare commit, so it shipped in the upstream release. The target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 undici 7.25.0 already strips Authorization, Proxy-Authorization and Cookie on cross-origin redirects in the dispatcher-level redirect handler, which is the path undici.request() uses. The fix is upstream commit 6805746 (Matteo Collina). It is an ancestor of the first TuxCare commit, so it shipped in the upstream release. The target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-13T23:33:57.977509+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.25.0 of undici. not_affected \u2014 The target (undici 7.25.0) already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). Integrity checking is done by bytesMatch, which uses getStrongestMetadata to select only the strongest-algorithm entries and compares the body hash against those. The upstream fix commit d542b8cd is an ancestor of HEAD and was authored by upstream (hello@matteocollina.com). HEAD has no TuxCare...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 The target (undici 7.25.0) already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). Integrity checking is done by bytesMatch, which uses getStrongestMetadata to select only the strongest-algorithm entries and compares the body hash against those. The upstream fix commit d542b8cd is an ancestor of HEAD and was authored by upstream (hello@matteocollina.com). HEAD has no TuxCare..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 7.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-13T21:30:44.648777+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.25.0 of undici. not_affected \u2014 Undici 7.25.0 already contains the upstream fix for CVE-2025-22150. The multipart/form-data boundary in lib/web/fetch/body.js is generated with node:crypto randomInt, not Math.random(). The Math.random fallback is used only when the node:crypto runtime feature is unavailable. The fix is upstream commit c2d78cd1 (Matteo Collina), which shipped in the upstream release before the first TuxCare com...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 Undici 7.25.0 already contains the upstream fix for CVE-2025-22150. The multipart/form-data boundary in lib/web/fetch/body.js is generated with node:crypto randomInt, not Math.random(). The Math.random fallback is used only when the node:crypto runtime feature is unavailable. The fix is upstream commit c2d78cd1 (Matteo Collina), which shipped in the upstream release before the first TuxCare com..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-13T21:37:00.197268+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.25.0 of undici. not_affected \u2014 The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e) is already in undici 7.25.0. Pool removes clients that emit connectionError from its client list. Agent also drops unused per-origin pools on connectionError. Both commits are ancestors of HEAD and were in the upstream release before any TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e) is already in undici 7.25.0. Pool removes clients that emit connectionError from its client list. Agent also drops unused per-origin pools on connectionError. Both commits are ancestors of HEAD and were in the upstream release before any TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 7.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-14T02:57:29.427470+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.25.0 of undici. not_affected \u2014 Target is undici 7.25.0; CVE-2026-109855 affects only 8.11.0/8.11.1 (regression introduced in 8.11.0). The crash needs an HTTP/2 WebSocket stream with no 'error' listener. In the target, the extended-CONNECT WebSocket stream always has an 'error' listener, so a later server-side connection destroy cannot raise an unhandled 'error'. HTTP/2 is also off by default (allowH2 defaults to false in bui...", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 7.25.0; CVE-2026-109855 affects only 8.11.0/8.11.1 (regression introduced in 8.11.0). The crash needs an HTTP/2 WebSocket stream with no 'error' listener. In the target, the extended-CONNECT WebSocket stream always has an 'error' listener, so a later server-side connection destroy cannot raise an unhandled 'error'. HTTP/2 is also off by default (allowH2 defaults to false in bui..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-10-15T18:28:00.152357+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-10-15T18:34:00.250279+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-06T10:20:26.750713+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-14643 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-14643" }, "action_statement": "Vulnerability CVE-2026-14643 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 7.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-13T21:51:06.382338+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 7.25.0 of undici. not_affected \u2014 Target (undici 7.25.0) already contains the upstream fix that rejects duplicate content-length (and host) headers case-insensitively. The fix commit 74495c63 is by Matteo Collina (upstream) and is part of the upstream release the TuxCare branch started from, so the vulnerable pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 Target (undici 7.25.0) already contains the upstream fix that rejects duplicate content-length (and host) headers case-insensitively. The fix commit 74495c63 is by Matteo Collina (upstream) and is part of the upstream release the TuxCare branch started from, so the vulnerable pattern is not present." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 7.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-13T22:11:00.043442+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 7.25.0 of undici. not_affected \u2014 Target undici 7.25.0 already contains the upstream fix for CVE-2026-1527. The Request constructor rejects non-string `upgrade` values and any value containing CR, LF or NUL, so CRLF cannot reach the header serialization in client-h1.js. The fix commit 77594f92 (Matteo Collina) is an ancestor of HEAD. HEAD has no TuxCare commits in its history, so it is an upstream release and the fix is upstream.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 Target undici 7.25.0 already contains the upstream fix for CVE-2026-1527. The Request constructor rejects non-string `upgrade` values and any value containing CR, LF or NUL, so CRLF cannot reach the header serialization in client-h1.js. The fix commit 77594f92 (Matteo Collina) is an ancestor of HEAD. HEAD has no TuxCare commits in its history, so it is an upstream release and the fix is upstream." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-13T22:00:03.479197+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 7.25.0 of undici. not_affected \u2014 undici 7.25.0 already contains the upstream fix for CVE-2026-1528 (commit 84235c62, \"Fix websocket 64-bit length overflow\", by Matteo Collina). The ByteParser rejects 64-bit payload lengths with a non-zero upper word or a lower word above 2^31-1 and fails the connection with code 1009. This fix shipped in the upstream release that TuxCare onboarded, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 undici 7.25.0 already contains the upstream fix for CVE-2026-1528 (commit 84235c62, \"Fix websocket 64-bit length overflow\", by Matteo Collina). The ByteParser rejects 64-bit payload lengths with a non-zero upper word or a lower word above 2^31-1 and fails the connection with code 1009. This fix shipped in the upstream release that TuxCare onboarded, so the verdict is not_affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 7.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-13T21:44:00.039648+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.25.0 of undici. not_affected \u2014 Not affected. The upstream fix (cap of 5 Content-Encoding tokens) is already present in both fetch and the decompress interceptor. It shipped in the upstream undici 7.25.0 release before any TuxCare commit, and its authors are upstream.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix (cap of 5 Content-Encoding tokens) is already present in both fetch and the decompress interceptor. It shipped in the upstream undici 7.25.0 release before any TuxCare commit, and its authors are upstream." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 7.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-14T01:34:00.116965+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 7.25.0 of undici. not_affected \u2014 Undici 7.25.0 already contains the upstream fix 5890c7b7 (author hello@matteocollina.com). DeduplicationHandler forwards each response chunk to waiting handlers as it arrives. It refuses late attachment once body data has started. Any buffering is capped per paused waiter by maxBufferSize (5 MiB by default).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 Undici 7.25.0 already contains the upstream fix 5890c7b7 (author hello@matteocollina.com). DeduplicationHandler forwards each response chunk to waiting handlers as it arrives. It refuses late attachment once body data has started. Any buffering is capped per paused waiter by maxBufferSize (5 MiB by default)." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6734 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-6734" }, "action_statement": "Vulnerability CVE-2026-6734 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-29T18:27:17.765346+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 7.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-14T02:33:45.545808+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.25.0 of undici. not_affected \u2014 Target is undici 7.25.0. The CVE affects only 8.10.0 and 8.10.1, where the cache and dedup keys were changed to omit the destination origin. In this tree the keys always include the origin, and requests without an origin skip the cache and dedup interceptors, so cross-origin key collisions cannot occur.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 7.25.0. The CVE affects only 8.10.0 and 8.10.1, where the cache and dedup keys were changed to omit the destination origin. In this tree the keys always include the origin, and requests without an origin skip the cache and dedup interceptors, so cross-origin key collisions cannot occur." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-10-15T21:34:00.093587+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 7.25.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-11-14T01:57:00.064318+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 7.25.0 of undici. not_affected \u2014 CVE-2026-9675 is a regression in undici 8.1.0: the new maxPayloadSize option was enforced per frame but not cumulatively across fragments. Target 7.25.0 has no maxPayloadSize feature, so the flawed check is absent. The CVE states 7.x is unaffected. Caveat: the 7.x receiver still buffers fragments with no size cap, which is long-standing behavior and not the 8.1.0 regression.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 CVE-2026-9675 is a regression in undici 8.1.0: the new maxPayloadSize option was enforced per frame but not cumulatively across fragments. Target 7.25.0 has no maxPayloadSize feature, so the flawed check is absent. The CVE states 7.x is unaffected. Caveat: the 7.x receiver still buffers fragments with no size cap, which is long-standing behavior and not the 8.1.0 regression." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9678 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-9678" }, "action_statement": "Vulnerability CVE-2026-9678 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9679 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-9679" }, "action_statement": "Vulnerability CVE-2026-9679 affects version 7.25.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.25.0", "identifiers": { "purl": "pkg:npm/undici@7.25.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9697 affects version 7.25.0 of undici.", "vulnerability": { "name": "CVE-2026-9697" }, "action_statement": "Vulnerability CVE-2026-9697 affects version 7.25.0 of undici." } ] }