{
  "@id": "urn:uuid:44f5a065-e366-4571-b779-0736ffba56f0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 29,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T00:02:51.490136+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-14T00:02:51.490136+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.27.2 of undici. not_affected \u2014 undici 7.27.2 already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, lib/web/fetch/index.js deletes authorization, proxy-authorization, cookie and host from the request headers before the redirected request is issued. The fix commit e041de35 is upstream-authored and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 undici 7.27.2 already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, lib/web/fetch/index.js deletes authorization, proxy-authorization, cookie and host from the request headers before the redirected request is issued. The fix commit e041de35 is upstream-authored and shipped in the upstream release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "action_statement": "Vulnerability CVE-2024-24750 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:21:34.173747+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.27.2 of undici. not_affected \u2014 Target undici 7.27.2 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The upstream fix (GHSA-3787-6prv-h9w3, commits b9da3e40 / d3aa574b) is an ancestor of HEAD and shipped in the upstream release. TuxCare did not author it.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.27.2 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The upstream fix (GHSA-3787-6prv-h9w3, commits b9da3e40 / d3aa574b) is an ancestor of HEAD and shipped in the upstream release. TuxCare did not author it."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "action_statement": "Vulnerability CVE-2024-30260 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T23:33:57.977509+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.27.2 of undici. not_affected \u2014 undici 7.27.2 is not affected by CVE-2024-30261. The vendor fix d542b8cd (GHSA-9qxr-qj54-h672) is an ancestor of HEAD. The SRI code was later rewritten to follow the current spec, and it drops unsupported algorithms, picks the strongest hash, and only accepts a body whose digest matches. HEAD has no TuxCare commits, so this is an upstream fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 undici 7.27.2 is not affected by CVE-2024-30261. The vendor fix d542b8cd (GHSA-9qxr-qj54-h672) is an ancestor of HEAD. The SRI code was later rewritten to follow the current spec, and it drops unsupported algorithms, picks the strongest hash, and only accepts a body whose digest matches. HEAD has no TuxCare commits, so this is an upstream fix."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:30:44.648777+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.27.2 of undici. not_affected \u2014 Target undici 7.27.2 already contains the upstream fix. The multipart/form-data boundary is generated with node:crypto randomInt (CSPRNG) at lib/web/fetch/body.js:22-24 and 110. Math.random is only a fallback when crypto is unavailable, as in the upstream 35f5d45e follow-up. The fix is upstream-authored and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.27.2 already contains the upstream fix. The multipart/form-data boundary is generated with node:crypto randomInt (CSPRNG) at lib/web/fetch/body.js:22-24 and 110. Math.random is only a fallback when crypto is unavailable, as in the upstream 35f5d45e follow-up. The fix is upstream-authored and shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:37:00.197268+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.27.2 of undici. not_affected \u2014 The target (undici 7.27.2) already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool's constructor has a 'connectionError' listener that removes failed clients from the pool's client list. The fix shipped in the upstream release, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.27.2) already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool's constructor has a 'connectionError' listener that removes failed clients from the pool's client list. The fix shipped in the upstream release, so the verdict is not_affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:44:00.132301+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:46:33.687871+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:46:33.687871+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "action_statement": "Vulnerability CVE-2026-109841 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:06:00.064776+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "action_statement": "Vulnerability CVE-2026-109855 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:28:00.152357+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:34:00.250279+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "action_statement": "Vulnerability CVE-2026-109924 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "action_statement": "Vulnerability CVE-2026-11525 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:20:26.750713+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "action_statement": "Vulnerability CVE-2026-116630 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "action_statement": "Vulnerability CVE-2026-120222 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "action_statement": "Vulnerability CVE-2026-120415 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "action_statement": "Vulnerability CVE-2026-120423 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:06:35.912230+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "action_statement": "Vulnerability CVE-2026-120474 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "action_statement": "Vulnerability CVE-2026-12151 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "action_statement": "Vulnerability CVE-2026-13697 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "action_statement": "Vulnerability CVE-2026-14643 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "action_statement": "Vulnerability CVE-2026-15157 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:52:00.070588+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 does not affect version 7.27.2 of undici. not_affected \u2014 Target undici 7.27.2 already contains the upstream fix for CVE-2026-1525 (upstream commit 74495c63, \"reject duplicate content-length and host headers\"). Header names are lowercased in processHeader and a second content-length is rejected whichever way it is capitalised. The fix shipped in the upstream release TuxCare onboarded, so this is an upstream fix and not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.27.2 already contains the upstream fix for CVE-2026-1525 (upstream commit 74495c63, \"reject duplicate content-length and host headers\"). Header names are lowercased in processHeader and a second content-length is rejected whichever way it is capitalised. The fix shipped in the upstream release TuxCare onboarded, so this is an upstream fix and not a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:11:00.043442+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 does not affect version 7.27.2 of undici. not_affected \u2014 Target undici 7.27.2 already contains the upstream fix (77594f92, \"validate upgrade header to prevent CRLF injection\"). Request construction rejects non-string `upgrade` values and any value containing CR/LF or other invalid header characters, so CRLF cannot reach the serialized request head. The fix shipped in the upstream release and is not a TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.27.2 already contains the upstream fix (77594f92, \"validate upgrade header to prevent CRLF injection\"). Request construction rejects non-string `upgrade` values and any value containing CR/LF or other invalid header characters, so CRLF cannot reach the serialized request head. The fix shipped in the upstream release and is not a TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:01:22.274965+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 does not affect version 7.27.2 of undici. not_affected \u2014 undici 7.27.2 already contains the upstream fix for CVE-2026-1528 (commit 84235c62, Matteo Collina). In lib/web/websocket/receiver.js the 64-bit payload-length state rejects any frame with a non-zero upper 32 bits or a lower value above 2^31-1, and it fails the connection with code 1009. The vulnerable `(upper << 8) + lower` arithmetic is gone. The fix shipped in the upstream release before any...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "impact_statement": "not_affected \u2014 undici 7.27.2 already contains the upstream fix for CVE-2026-1528 (commit 84235c62, Matteo Collina). In lib/web/websocket/receiver.js the 64-bit payload-length state rejects any frame with a non-zero upper 32 bits or a lower value above 2^31-1, and it fails the connection with code 1009. The vulnerable `(upper << 8) + lower` arithmetic is gone. The fix shipped in the upstream release before any..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "action_statement": "Vulnerability CVE-2026-16728 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "action_statement": "Vulnerability CVE-2026-16729 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "action_statement": "Vulnerability CVE-2026-18149 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "action_statement": "Vulnerability CVE-2026-18540 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "action_statement": "Vulnerability CVE-2026-19534 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:44:00.039648+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.27.2 of undici. not_affected \u2014 Target undici 7.27.2 already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses with more than 5 content-codings. The fix commit b04e3cbb (author hello@matteocollina.com, committed via GitHub noreply) is an ancestor of HEAD and shipped in the upstream release. HEAD has no TuxCare-domain commits.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.27.2 already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses with more than 5 content-codings. The fix commit b04e3cbb (author hello@matteocollina.com, committed via GitHub noreply) is an ancestor of HEAD and shipped in the upstream release. HEAD has no TuxCare-domain commits."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "action_statement": "Vulnerability CVE-2026-2581 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "action_statement": "Vulnerability CVE-2026-6733 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "action_statement": "Vulnerability CVE-2026-6734 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "action_statement": "Vulnerability CVE-2026-84890 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "action_statement": "Vulnerability CVE-2026-84933 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "action_statement": "Vulnerability CVE-2026-84947 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "action_statement": "Vulnerability CVE-2026-84961 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "action_statement": "Vulnerability CVE-2026-85008 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:27:17.765346+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "action_statement": "Vulnerability CVE-2026-85014 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:03.785272+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "action_statement": "Vulnerability CVE-2026-85024 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:03.785272+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "action_statement": "Vulnerability CVE-2026-85152 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:48:04.069265+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T21:34:00.093587+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "action_statement": "Vulnerability CVE-2026-87029 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "action_statement": "Vulnerability CVE-2026-9675 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "action_statement": "Vulnerability CVE-2026-9678 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "action_statement": "Vulnerability CVE-2026-9679 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "action_statement": "Vulnerability CVE-2026-9697 affects version 7.27.2 of undici."
    }
  ]
}