{ "@id": "urn:uuid:4ffdf68b-8318-4701-a345-2a82580e23ac", "role": "Document Creator", "author": "https://tuxcare.com", "version": 51, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:56:10.727886+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 7.29.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 7.29.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 7.29.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 7.29.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 7.29.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 7.29.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 7.29.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-14T00:03:46.906673+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.29.0 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2023-45143 (undici commit e041de3) is already in HEAD, and it shipped in the upstream release that TuxCare onboarded. In lib/web/fetch/index.js, a cross-origin redirect now deletes the cookie and host headers as well as authorization and proxy-authorization. The low-level redirect handler also strips cookie on cross-origin redirects.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2023-45143 (undici commit e041de3) is already in HEAD, and it shipped in the upstream release that TuxCare onboarded. In lib/web/fetch/index.js, a cross-origin redirect now deletes the cookie and host headers as well as authorization and proxy-authorization. The low-level redirect handler also strips cookie on cross-origin redirects." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 7.29.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-13T22:21:00.059541+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.29.0 of undici. not_affected \u2014 Target undici 7.29.0 already strips Proxy-Authorization on cross-origin redirects in both the dispatcher redirect handler and the fetch redirect path. The fix is the upstream commit b9da3e40 (GHSA-3787-6prv-h9w3), which shipped in the upstream release before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Target undici 7.29.0 already strips Proxy-Authorization on cross-origin redirects in both the dispatcher redirect handler and the fetch redirect path. The fix is the upstream commit b9da3e40 (GHSA-3787-6prv-h9w3), which shipped in the upstream release before the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-14T00:28:24.873188+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.29.0 of undici. not_affected \u2014 The fix for CVE-2024-30260 is already in the target (undici 7.29.0). RedirectHandler strips authorization, proxy-authorization and cookie headers when a redirect goes to a different origin. This applies to undici.request() with maxRedirections. The upstream fix commit 6805746 is an ancestor of HEAD. It shipped in the upstream release, before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 The fix for CVE-2024-30260 is already in the target (undici 7.29.0). RedirectHandler strips authorization, proxy-authorization and cookie headers when a redirect goes to a different origin. This applies to undici.request() with maxRedirections. The upstream fix commit 6805746 is an ancestor of HEAD. It shipped in the upstream release, before the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-13T23:36:57.599251+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.29.0 of undici. not_affected \u2014 Target undici 7.29.0-tuxcare.9 is not affected by CVE-2024-30261. The upstream fix, d542b8cd (GHSA-9qxr-qj54-h672, released in 5.28.4/6.11.1), is an ancestor of HEAD and was already in the upstream release TuxCare onboarded. The integrity check now lives in lib/web/subresource-integrity/subresource-integrity.js. It parses metadata strictly, keeps only the strongest valid algorithm, and requires...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Target undici 7.29.0-tuxcare.9 is not affected by CVE-2024-30261. The upstream fix, d542b8cd (GHSA-9qxr-qj54-h672, released in 5.28.4/6.11.1), is an ancestor of HEAD and was already in the upstream release TuxCare onboarded. The integrity check now lives in lib/web/subresource-integrity/subresource-integrity.js. It parses metadata strictly, keeps only the strongest valid algorithm, and requires..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 7.29.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T10:54:00.031818+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.29.0 of undici. not_affected \u2014 The upstream fix for CVE-2025-22150 (nodejs/undici c2d78cd1) is already in the 7.29.0 release. The multipart boundary in lib/web/fetch/body.js is built with node:crypto randomInt. Math.random is used only when the crypto module is unavailable, which is the same fallback upstream has.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2025-22150 (nodejs/undici c2d78cd1) is already in the 7.29.0 release. The multipart boundary in lib/web/fetch/body.js is built with node:crypto randomInt. Math.random is used only when the crypto module is unavailable, which is the same fallback upstream has." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T10:59:22.622527+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.29.0 of undici. not_affected \u2014 The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e) is already in the target. It is in lib/dispatcher/pool.js and shipped with the upstream release that TuxCare onboarded. The Pool removes failed clients on connectionError, so the leak does not occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e) is already in the target. It is in lib/dispatcher/pool.js and shipped with the upstream release that TuxCare onboarded. The Pool removes failed clients on connectionError, so the leak does not occur." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.5.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-02T18:09:00.220868+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.7.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-04T17:23:39.396004+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.8.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.8." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-14T02:56:10.727886+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.29.0 of undici. not_affected \u2014 undici 7.29.0-tuxcare.9 has WebSocket-over-HTTP/2 but not the 8.11.0 regression. The H2 upgrade path never marks the request completed, so abort() still closes the stream with stream.close(). A permanent 'error' listener is also registered on the stream, so an orphaned stream cannot emit an unhandled error and crash the process.", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 undici 7.29.0-tuxcare.9 has WebSocket-over-HTTP/2 but not the 8.11.0 regression. The H2 upgrade path never marks the request completed, so abort() still closes the stream with stream.close(). A permanent 'error' listener is also registered on the stream, so an orphaned stream cannot emit an unhandled error and crash the process." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-04T17:23:39.396004+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.8.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-04T17:23:39.396004+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.8.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.5.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.5." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T11:52:00.035383+00:00", "status_notes": "Vulnerability CVE-2026-11525 does not affect version 7.29.0 of undici. not_affected \u2014 Target undici 7.29.0 already contains the upstream fix for CVE-2026-11525. The SameSite parser in lib/web/cookies/parse.js does case-insensitive exact matching against none, strict and lax, and ignores any other value. The fix commit d0574cc4 is by upstream author Matteo Collina and shipped in the upstream release, before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-11525" }, "impact_statement": "not_affected \u2014 Target undici 7.29.0 already contains the upstream fix for CVE-2026-11525. The SameSite parser in lib/web/cookies/parse.js does case-insensitive exact matching against none, strict and lax, and ignores any other value. The fix commit d0574cc4 is by upstream author Matteo Collina and shipped in the upstream release, before the first TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 7.29.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T10:20:26.750713+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 7.29.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 7.29.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 7.29.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 7.29.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 7.29.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-04T03:43:37.320617+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 7.29.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 7.29.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T12:17:57.436601+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 7.29.0 of undici. not_affected \u2014 The target already contains the upstream fix. parseCacheControlHeader in lib/util/cache.js trims OWS on both sides of '=' and strips quotes, so `no-cache =\"authorization\"` and `no-cache= \"authorization\"` both parse to ['authorization']. The upstream fix commits are part of the upstream 7.29.0 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 The target already contains the upstream fix. parseCacheControlHeader in lib/util/cache.js trims OWS on both sides of '=' and strips quotes, so `no-cache =\"authorization\"` and `no-cache= \"authorization\"` both parse to ['authorization']. The upstream fix commits are part of the upstream 7.29.0 release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T12:06:00.126124+00:00", "status_notes": "Vulnerability CVE-2026-15157 does not affect version 7.29.0 of undici. not_affected \u2014 The vulnerable branch in lib/dispatcher/client-h1.js no longer pushes body.type unvalidated. It now runs isValidHeaderValue() on the value and rejects the request with InvalidArgumentError if it fails. This is upstream commit 33928bc2 (\"fix: validate blob body content type\", Matteo Collina). It ships in the upstream undici 7.29.0 release, before the first TuxCare commit, so the verdict is not_a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-15157" }, "impact_statement": "not_affected \u2014 The vulnerable branch in lib/dispatcher/client-h1.js no longer pushes body.type unvalidated. It now runs isValidHeaderValue() on the value and rejects the request with InvalidArgumentError if it fails. This is upstream commit 33928bc2 (\"fix: validate blob body content type\", Matteo Collina). It ships in the upstream undici 7.29.0 release, before the first TuxCare commit, so the verdict is not_a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T11:17:00.102202+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 7.29.0 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2026-1525 (nodejs/undici 74495c63, \"fix: reject duplicate content-length and host headers\") is already in the 7.29.0 target. processHeader in lib/core/request.js lowercases every header name and throws 'duplicate content-length header' when request.contentLength is already set. Case-variant duplicates in a flat header array are therefore rejected before an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2026-1525 (nodejs/undici 74495c63, \"fix: reject duplicate content-length and host headers\") is already in the 7.29.0 target. processHeader in lib/core/request.js lowercases every header name and throws 'duplicate content-length header' when request.contentLength is already set. Case-variant duplicates in a flat header array are therefore rejected before an..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 7.29.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T11:19:00.067933+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 7.29.0 of undici. not_affected \u2014 undici 7.29.0 already contains the upstream fix for CVE-2026-1527. The Request constructor rejects any `upgrade` value containing characters that are invalid in a header value, including CR and LF. This happens before the value is written in client-h1.js. The fix is upstream commit 77594f92 by Matteo Collina. It is already in the upstream release that TuxCare onboarded, so it is not a TuxCare b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 undici 7.29.0 already contains the upstream fix for CVE-2026-1527. The Request constructor rejects any `upgrade` value containing characters that are invalid in a header value, including CR and LF. This happens before the value is written in client-h1.js. The fix is upstream commit 77594f92 by Matteo Collina. It is already in the upstream release that TuxCare onboarded, so it is not a TuxCare b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-13T21:58:00.053272+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 7.29.0 of undici. not_affected \u2014 The target (undici 7.29.0) already contains the upstream fix for CVE-2026-1528. The 64-bit payload length path in lib/web/websocket/receiver.js fails the connection with close code 1009 when the upper 32 bits are nonzero or the lower 32 bits exceed 2^31-1. The fix shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 The target (undici 7.29.0) already contains the upstream fix for CVE-2026-1528. The 64-bit payload length path in lib/web/websocket/receiver.js fails the connection with close code 1009 when the upper 32 bits are nonzero or the lower 32 bits exceed 2^31-1. The fix shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T12:00:41.179927+00:00", "status_notes": "Vulnerability CVE-2026-16728 does not affect version 7.29.0 of undici. not_affected \u2014 Target undici 7.29.0-tuxcare.8 already contains the upstream fix (nodejs/undici 1b5a5312, \"reject partial content length mismatch\"). The fix ships in the upstream 7.29.0 release, before the first TuxCare commit, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16728" }, "impact_statement": "not_affected \u2014 Target undici 7.29.0-tuxcare.8 already contains the upstream fix (nodejs/undici 1b5a5312, \"reject partial content length mismatch\"). The fix ships in the upstream 7.29.0 release, before the first TuxCare commit, so the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T12:10:00.060224+00:00", "status_notes": "Vulnerability CVE-2026-16729 does not affect version 7.29.0 of undici. not_affected \u2014 Target undici 7.29.0 already contains the upstream fix (commit 3bf91ddb, \"harden cookie domain, path, and unparsed attribute validation\"). The domain is strictly validated against the RFC 1034 LDH syntax, and each unparsed entry's name and value are validated, so a ';' cannot be injected. The fix shipped in the upstream 7.29.0 release, before the first TuxCare commit, so the verdict is not_affe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16729" }, "impact_statement": "not_affected \u2014 Target undici 7.29.0 already contains the upstream fix (commit 3bf91ddb, \"harden cookie domain, path, and unparsed attribute validation\"). The domain is strictly validated against the RFC 1034 LDH syntax, and each unparsed entry's name and value are validated, so a ';' cannot be injected. The fix shipped in the upstream 7.29.0 release, before the first TuxCare commit, so the verdict is not_affe..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-09-29T22:01:12.799548+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-09-30T07:58:52.662995+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-09-29T22:01:12.799548+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T11:06:55.167235+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.29.0 of undici. not_affected \u2014 Undici 7.29.0 already contains the upstream fix for CVE-2026-22036. Both the fetch() response path and the decompress interceptor cap the Content-Encoding chain at 5 codings. The fix is upstream commit b04e3cbb (author hello@matteocollina.com). It is an ancestor of HEAD and of the first TuxCare commit, so it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 Undici 7.29.0 already contains the upstream fix for CVE-2026-22036. Both the fetch() response path and the decompress interceptor cap the Content-Encoding chain at 5 codings. The fix is upstream commit b04e3cbb (author hello@matteocollina.com). It is an ancestor of HEAD and of the first TuxCare commit, so it shipped in the upstream release." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 7.29.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-14T01:30:00.085497+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 7.29.0 of undici. not_affected \u2014 The target (undici 7.29.0-tuxcare.9) already contains the upstream fix 5890c7b (Matteo Collina). DeduplicationHandler streams each chunk to waiting handlers as it arrives and refuses late joins once body data has started. Waiting handlers only buffer while they are paused, and that buffer is capped by maxBufferSize (default 5 MiB). The fix shipped in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 The target (undici 7.29.0-tuxcare.9) already contains the upstream fix 5890c7b (Matteo Collina). DeduplicationHandler streams each chunk to waiting handlers as it arrives and refuses late joins once body data has started. Waiting handlers only buffer while they are paused, and that buffer is capped by maxBufferSize (default 5 MiB). The fix shipped in the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T11:54:00.044922+00:00", "status_notes": "Vulnerability CVE-2026-6733 does not affect version 7.29.0 of undici. not_affected \u2014 The fix for CVE-2026-6733 (idle-socket validation for HTTP/1.1 keep-alive reuse) is already in the target. It arrived through the upstream release, as upstream commit ea8930cf by Matteo Collina. That commit is an ancestor of HEAD and of the first TuxCare commit, so it shipped inside the 7.29.0 base release. The target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6733" }, "impact_statement": "not_affected \u2014 The fix for CVE-2026-6733 (idle-socket validation for HTTP/1.1 keep-alive reuse) is already in the target. It arrived through the upstream release, as upstream commit ea8930cf by Matteo Collina. That commit is an ancestor of HEAD and of the first TuxCare commit, so it shipped inside the 7.29.0 base release. The target is not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-6734 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2026-6734" }, "action_statement": "Vulnerability CVE-2026-6734 affects version 7.29.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-09-29T22:01:12.799548+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-09-30T08:14:17.776706+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-09-29T22:01:12.799548+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-09-29T22:01:12.799548+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-09-29T22:01:12.799548+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-09-29T22:01:12.799548+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-09-29T09:19:00.466723+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-14T02:28:01.780998+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.29.0 of undici. not_affected \u2014 undici 7.29.0-tuxcare.9 predates the 8.10.0 change that introduced this bug. In this tree the cache and dedup interceptors only act on requests whose opts.origin is set. They always put that origin into the cache key, the dedup key and the store's top-level key. Requests without an origin bypass caching and deduplication, so keys without the destination origin are never built. Not affected.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 undici 7.29.0-tuxcare.9 predates the 8.10.0 change that introduced this bug. In this tree the cache and dedup interceptors only act on requests whose opts.origin is set. They always put that origin into the cache key, the dedup key and the store's top-level key. Requests without an origin bypass caching and deduplication, so keys without the destination origin are never built. Not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-10T09:29:00.087983+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.9.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.6.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 7.29.0 of undici, and is fixed in 7.29.0-tuxcare.6." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-14T01:53:00.058951+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 7.29.0 of undici. not_affected \u2014 Not affected. The target (undici 7.29.0-tuxcare.9) already enforces maxPayloadSize cumulatively across fragmented uncompressed messages. The check shipped in the upstream 7.29.0 release (upstream commit a027a4a0, \"Backport WebSocket maxPayloadSize fixes to v7.x (#5423)\"). The 8.1.0-only regression described in the CVE is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 Not affected. The target (undici 7.29.0-tuxcare.9) already enforces maxPayloadSize cumulatively across fragmented uncompressed messages. The check shipped in the upstream 7.29.0 release (upstream commit a027a4a0, \"Backport WebSocket maxPayloadSize fixes to v7.x (#5423)\"). The 8.1.0-only regression described in the CVE is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T12:30:00.048219+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 7.29.0 of undici. not_affected \u2014 Not affected. The target (undici 7.29.0-tuxcare.8) already trims optional whitespace (spaces and tabs) from every field name in qualified private/no-cache directives before storing them. The upstream parser hardening commit 98011a86 (Matteo Collina) is in the upstream 7.29.0 release, before any TuxCare commit. `private=\" authorization\"` and `no-cache=\"\\tauthorization\"` therefore parse to ['auth...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Not affected. The target (undici 7.29.0-tuxcare.8) already trims optional whitespace (spaces and tabs) from every field name in qualified private/no-cache directives before storing them. The upstream parser hardening commit 98011a86 (Matteo Collina) is in the upstream 7.29.0 release, before any TuxCare commit. `private=\" authorization\"` and `no-cache=\"\\tauthorization\"` therefore parse to ['auth..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-06T11:48:42.692522+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 7.29.0 of undici. not_affected \u2014 Not affected. The target (undici 7.29.0 line) already includes the upstream fix: lib/web/cookies/parse.js keeps cookie values verbatim and has no qsUnescape or percent-decoding. The fix commit d0574cc4 is by Matteo Collina (upstream) and was in the upstream release before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 Not affected. The target (undici 7.29.0 line) already includes the upstream fix: lib/web/cookies/parse.js keeps cookie values verbatim and has no qsUnescape or percent-decoding. The fix commit d0574cc4 is by Matteo Collina (upstream) and was in the upstream release before the first TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.29.0", "identifiers": { "purl": "pkg:npm/undici@7.29.0" } } ], "timestamp": "2026-11-05T09:04:00.091712+00:00", "status_notes": "Vulnerability CVE-2026-9697 affects version 7.29.0 of undici.", "vulnerability": { "name": "CVE-2026-9697" }, "action_statement": "Vulnerability CVE-2026-9697 affects version 7.29.0 of undici." } ] }