{ "@id": "urn:uuid:89d2789e-66fa-4c01-b994-a2eecce6f17c", "role": "Document Creator", "author": "https://tuxcare.com", "version": 51, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:59:19.400953+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 7.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 7.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 7.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 7.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 7.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 7.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 7.28.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-14T00:05:57.678679+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.28.0 of undici. not_affected \u2014 Target (undici 7.28.0-tuxcare.10) already strips Cookie (and Authorization / Proxy-Authorization) on cross-origin redirects, in both the fetch implementation and the core RedirectHandler. The upstream fix commit e041de35 is an ancestor of HEAD and was already in the upstream release before the first TuxCare commit, so this is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Target (undici 7.28.0-tuxcare.10) already strips Cookie (and Authorization / Proxy-Authorization) on cross-origin redirects, in both the fetch implementation and the core RedirectHandler. The upstream fix commit e041de35 is an ancestor of HEAD and was already in the upstream release before the first TuxCare commit, so this is an upstream fix." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 7.28.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-13T22:21:34.173747+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.28.0 of undici. not_affected \u2014 Undici 7.28.0 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The fix shipped in the upstream release, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Undici 7.28.0 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The fix shipped in the upstream release, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-14T00:32:11.807119+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.28.0 of undici. not_affected \u2014 Target undici 7.28.0 already contains the upstream fix for CVE-2024-30260. The shared redirect handler (lib/handler/redirect-handler.js) strips authorization, cookie and proxy-authorization headers whenever the redirect target origin differs. This applies to undici.request() as well as fetch(). The fix is part of the upstream release that TuxCare onboarded, so it is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 Target undici 7.28.0 already contains the upstream fix for CVE-2024-30260. The shared redirect handler (lib/handler/redirect-handler.js) strips authorization, cookie and proxy-authorization headers whenever the redirect target origin differs. This applies to undici.request() as well as fetch(). The fix is part of the upstream release that TuxCare onboarded, so it is an upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-13T23:37:49.904954+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.28.0 of undici. not_affected \u2014 undici 7.28.0 is not affected by CVE-2024-30261. The upstream fix commit d542b8cd (Matteo Collina, GHSA-9qxr-qj54-h672) is an ancestor of HEAD and shipped in the upstream release before the first TuxCare commit. The refactored SRI code in lib/web/subresource-integrity/subresource-integrity.js is spec-compliant. It selects the strongest valid algorithm, compares only entries using that algorithm...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 undici 7.28.0 is not affected by CVE-2024-30261. The upstream fix commit d542b8cd (Matteo Collina, GHSA-9qxr-qj54-h672) is an ancestor of HEAD and shipped in the upstream release before the first TuxCare commit. The refactored SRI code in lib/web/subresource-integrity/subresource-integrity.js is spec-compliant. It selects the strongest valid algorithm, compares only entries using that algorithm..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 7.28.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-06T10:55:02.115769+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.28.0 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2025-22150 (nodejs/undici c2d78cd1) is already in the shipped 7.28.0 release. lib/web/fetch/body.js builds the multipart boundary with node:crypto randomInt, not Math.random. The Math.random fallback is used only when the crypto runtime feature is unavailable, and that matches the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2025-22150 (nodejs/undici c2d78cd1) is already in the shipped 7.28.0 release. lib/web/fetch/body.js builds the multipart boundary with node:crypto randomInt, not Math.random. The Math.random fallback is used only when the crypto runtime feature is unavailable, and that matches the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-06T11:02:00.046252+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.28.0 of undici. not_affected \u2014 The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e) is already in the target. Pool removes clients from its client list on 'connectionError'. The fix shipped in the upstream release before the first TuxCare commit, so the verdict is not_affected (upstream fix).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e) is already in the target. Pool removes clients from its client list on 'connectionError'. The fix shipped in the upstream release before the first TuxCare commit, so the verdict is not_affected (upstream fix)." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-09T19:58:00.060131+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.10.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.10." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-09T19:58:00.060131+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.10.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.10." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-04T17:22:42.496499+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.9.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.9." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-14T02:59:19.400953+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.28.0 of undici. not_affected \u2014 Target is undici 7.28.0-tuxcare.10. The CVE regression was introduced in 8.11.0 and is not present here. In this tree, a failed WebSocket handshake over HTTP/2 correctly aborts the request and closes the stream. The H2 websocket stream also always has an 'error' listener, so a later server-side destroy cannot raise an unhandled 'error' event.", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 7.28.0-tuxcare.10. The CVE regression was introduced in 8.11.0 and is not present here. In this tree, a failed WebSocket handshake over HTTP/2 correctly aborts the request and closes the stream. The H2 websocket stream also always has an 'error' listener, so a later server-side destroy cannot raise an unhandled 'error' event." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-04T17:22:42.496499+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.9.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-04T17:22:42.496499+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.9.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-09T19:58:00.060131+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.10.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.10." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-06T11:48:00.024884+00:00", "status_notes": "Vulnerability CVE-2026-11525 does not affect version 7.28.0 of undici. not_affected \u2014 The target (undici 7.28.0) already contains the upstream fix. lib/web/cookies/parse.js compares the SameSite value with exact, case-insensitive equality to none/strict/lax and ignores anything else. The fix is upstream commit d0574cc4 by Matteo Collina. It is an ancestor of HEAD and of the first TuxCare commit, so it shipped in the upstream 7.28.0 release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-11525" }, "impact_statement": "not_affected \u2014 The target (undici 7.28.0) already contains the upstream fix. lib/web/cookies/parse.js compares the SameSite value with exact, case-insensitive equality to none/strict/lax and ignores anything else. The fix is upstream commit d0574cc4 by Matteo Collina. It is an ancestor of HEAD and of the first TuxCare commit, so it shipped in the upstream 7.28.0 release." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 7.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-06T10:20:26.750713+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 7.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 7.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 7.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 7.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 7.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-04T03:43:37.320617+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 7.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-09-27T20:56:00.090800+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-10-08T13:38:00.185606+00:00", "status_notes": "Vulnerability CVE-2026-14643 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.8.", "vulnerability": { "name": "CVE-2026-14643" }, "action_statement": "Vulnerability CVE-2026-14643 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-10-03T11:51:00.393562+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.7.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-06T11:11:31.072033+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 7.28.0 of undici. not_affected \u2014 The target (undici 7.28.0) already contains the upstream fix 74495c63 (\"reject duplicate content-length and host headers\"). That commit shipped in the upstream release, before the first TuxCare commit. processHeader() lowercases the header name and throws 'duplicate content-length header' on a second occurrence, so case-variant duplicates in a flat header array are rejected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 The target (undici 7.28.0) already contains the upstream fix 74495c63 (\"reject duplicate content-length and host headers\"). That commit shipped in the upstream release, before the first TuxCare commit. processHeader() lowercases the header name and throws 'duplicate content-length header' on a second occurrence, so case-variant duplicates in a flat header array are rejected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 7.28.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-06T11:21:00.046457+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 7.28.0 of undici. not_affected \u2014 undici 7.28.0 already contains the upstream fix for CVE-2026-1527. Request's constructor (lib/core/request.js:84-90) rejects any non-string `upgrade` value and any value containing characters outside the valid header-value set, which includes CR and LF. The fix is upstream commit 77594f92 by Matteo Collina, and it was already in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 undici 7.28.0 already contains the upstream fix for CVE-2026-1527. Request's constructor (lib/core/request.js:84-90) rejects any non-string `upgrade` value and any value containing characters outside the valid header-value set, which includes CR and LF. The fix is upstream commit 77594f92 by Matteo Collina, and it was already in the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-13T22:00:03.479197+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 7.28.0 of undici. not_affected \u2014 undici 7.28.0 already contains the upstream fix for CVE-2026-1528. The 64-bit length branch in the WebSocket receiver rejects any length with a non-zero upper 32 bits, or a lower half above 2^31-1, and fails the connection with code 1009. The fix commit 84235c62 is by Matteo Collina (upstream) and is in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 undici 7.28.0 already contains the upstream fix for CVE-2026-1528. The 64-bit length branch in the WebSocket receiver rejects any length with a non-zero upper 32 bits, or a lower half above 2^31-1, and fails the connection with code 1009. The fix commit 84235c62 is by Matteo Collina (upstream) and is in the upstream release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-10-03T11:51:00.393562+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.7.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-10-03T11:51:00.393562+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.7.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-09-30T07:58:52.662995+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-10-01T11:25:42.944453+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.5.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-09-30T07:58:52.662995+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.3." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-06T11:08:00.056700+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.28.0 of undici. not_affected \u2014 undici 7.28.0 already contains the upstream fix (nodejs/undici b04e3cbb, authored by Matteo Collina) capping the Content-Encoding chain at 5 in both fetch() and the decompress interceptor. The fix shipped in the upstream release, before the first TuxCare commit, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 undici 7.28.0 already contains the upstream fix (nodejs/undici b04e3cbb, authored by Matteo Collina) capping the Content-Encoding chain at 5 in both fetch() and the decompress interceptor. The fix shipped in the upstream release, before the first TuxCare commit, so the target is not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 7.28.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-14T01:35:41.455653+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 7.28.0 of undici. not_affected \u2014 The upstream fix for CVE-2026-2581 (undici commit 5890c7b7, \"stream response chunks to waiting handlers\") is already in the target. It was in the upstream 7.28.0 release that TuxCare onboarded. The deduplication handler forwards chunks to waiting handlers as they arrive. It refuses to attach a late waiter once body data has started. It buffers only for a waiter that is explicitly paused, and th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-2581 (undici commit 5890c7b7, \"stream response chunks to waiting handlers\") is already in the target. It was in the upstream 7.28.0 release that TuxCare onboarded. The deduplication handler forwards chunks to waiting handlers as they arrive. It refuses to attach a late waiter once body data has started. It buffers only for a waiter that is explicitly paused, and th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-06T11:55:00.123511+00:00", "status_notes": "Vulnerability CVE-2026-6733 does not affect version 7.28.0 of undici. not_affected \u2014 Target is undici 7.28.0, the upstream release that fixes CVE-2026-6733. The idle-socket validation fix (upstream commit ea8930c, author hello@matteocollina.com) is already in the shipped release, before the first TuxCare commit. Unsolicited data on a reused socket is read and rejected before the next request is written.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6733" }, "impact_statement": "not_affected \u2014 Target is undici 7.28.0, the upstream release that fixes CVE-2026-6733. The idle-socket validation fix (upstream commit ea8930c, author hello@matteocollina.com) is already in the shipped release, before the first TuxCare commit. Unsolicited data on a reused socket is read and rejected before the next request is written." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-6734 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2026-6734" }, "action_statement": "Vulnerability CVE-2026-6734 affects version 7.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-09-30T07:58:52.662995+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-10-01T13:26:37.692920+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.6.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-09-30T07:58:52.662995+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-09-30T07:58:52.662995+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-09-30T20:51:00.117310+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-09-30T07:58:52.662995+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-09-29T10:10:02.238328+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-14T02:36:29.324890+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.28.0 of undici. not_affected \u2014 Target is undici 7.28.0-tuxcare.10. CVE-2026-85152 was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In this tree the cache and deduplicate interceptors always include the request origin in their keys, and they skip requests that have no origin. The origin-less keying regression is not present. One caveat: I could not read the vendor patch (only a URL was given), so the fix's exact s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 7.28.0-tuxcare.10. CVE-2026-85152 was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In this tree the cache and deduplicate interceptors always include the request origin in their keys, and they skip requests that have no origin. The origin-less keying regression is not present. One caveat: I could not read the vendor patch (only a URL was given), so the fix's exact s..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-09T19:58:00.060131+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.10.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.10." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-09T19:58:00.060131+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.10.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 7.28.0 of undici, and is fixed in 7.28.0-tuxcare.10." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-14T01:58:59.147149+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 7.28.0 of undici. not_affected \u2014 Target is undici 7.28.0-tuxcare.10. It already enforces a cumulative size limit across fragments of uncompressed messages, so it is not affected by CVE-2026-9675. The check was shipped by upstream in 7.28.0 (commit a027a4a0, \"Backport WebSocket maxPayloadSize fixes to v7.x\") and predates the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 Target is undici 7.28.0-tuxcare.10. It already enforces a cumulative size limit across fragments of uncompressed messages, so it is not affected by CVE-2026-9675. The check was shipped by upstream in 7.28.0 (commit a027a4a0, \"Backport WebSocket maxPayloadSize fixes to v7.x\") and predates the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-06T12:34:31.490814+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 7.28.0 of undici. not_affected \u2014 The target (undici 7.28.0) already contains the upstream fix for CVE-2026-9678. Qualified private/no-cache field names are trimmed when the Cache-Control header is parsed. The fix commit 85a24055 is a cherry-pick of cb105d7c, authored by upstream maintainer Matteo Collina. It is in the upstream 7.28.0 release, before the first TuxCare commit, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 The target (undici 7.28.0) already contains the upstream fix for CVE-2026-9678. Qualified private/no-cache field names are trimmed when the Cache-Control header is parsed. The fix commit 85a24055 is a cherry-pick of cb105d7c, authored by upstream maintainer Matteo Collina. It is in the upstream 7.28.0 release, before the first TuxCare commit, so the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-06T11:50:00.196192+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 7.28.0 of undici. not_affected \u2014 Target undici 7.28.0 already contains the upstream fix for CVE-2026-9679 (commit d0574cc4, cherry-pick of 5655ea43, by Matteo Collina). Cookie values are no longer percent-decoded. The fix shipped in the upstream 7.28.0 release, before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 Target undici 7.28.0 already contains the upstream fix for CVE-2026-9679 (commit d0574cc4, cherry-pick of 5655ea43, by Matteo Collina). Cookie values are no longer percent-decoded. The fix shipped in the upstream 7.28.0 release, before the first TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.28.0", "identifiers": { "purl": "pkg:npm/undici@7.28.0" } } ], "timestamp": "2026-11-05T09:04:00.091712+00:00", "status_notes": "Vulnerability CVE-2026-9697 affects version 7.28.0 of undici.", "vulnerability": { "name": "CVE-2026-9697" }, "action_statement": "Vulnerability CVE-2026-9697 affects version 7.28.0 of undici." } ] }