{
  "@id": "urn:uuid:5c750344-fd37-40cf-8d1a-90feb6174c13",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 49,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T03:07:50.992062+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 7.29.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 7.29.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 7.29.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 7.29.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 7.29.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 7.29.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 7.29.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-14T00:14:45.578273+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.29.1 of undici. not_affected \u2014 Target is undici 7.29.1. The upstream fix for CVE-2023-45143 (commit e041de35, shipped in 5.26.2) is already in HEAD. On a cross-origin redirect, httpRedirectFetch deletes the cookie and host headers along with authorization and proxy-authorization. The fix commit is an ancestor of the first TuxCare commit, so it shipped with the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.29.1. The upstream fix for CVE-2023-45143 (commit e041de35, shipped in 5.26.2) is already in HEAD. On a cross-origin redirect, httpRedirectFetch deletes the cookie and host headers along with authorization and proxy-authorization. The fix commit is an ancestor of the first TuxCare commit, so it shipped with the upstream release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "action_statement": "Vulnerability CVE-2024-24750 affects version 7.29.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-13T22:29:00.053986+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.29.1 of undici. not_affected \u2014 undici 7.29.1 already strips Proxy-Authorization on cross-origin redirects, in both the dispatcher redirect handler and the fetch redirect path. The fix is the upstream one (GHSA-3787-6prv-h9w3, commit b9da3e40, an ancestor of HEAD). It shipped in the upstream release before TuxCare's first commit, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 undici 7.29.1 already strips Proxy-Authorization on cross-origin redirects, in both the dispatcher redirect handler and the fetch redirect path. The fix is the upstream one (GHSA-3787-6prv-h9w3, commit b9da3e40, an ancestor of HEAD). It shipped in the upstream release before TuxCare's first commit, so the verdict is not_affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-14T00:40:00.127307+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.29.1 of undici. not_affected \u2014 Target undici 7.29.1 already contains the upstream CVE-2024-30260 fix. The redirect handler strips authorization, cookie and proxy-authorization headers whenever the redirect target origin differs from the original. The fix came from the upstream release, not from a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.29.1 already contains the upstream CVE-2024-30260 fix. The redirect handler strips authorization, cookie and proxy-authorization headers whenever the redirect target origin differs from the original. The fix came from the upstream release, not from a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-13T23:47:00.075135+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.29.1 of undici. not_affected \u2014 Target undici 7.29.1-tuxcare.4 is not affected by CVE-2024-30261. The upstream fix commits (d542b8cd, 2b39440b, authored by Matteo Collina) are ancestors of HEAD and of the first TuxCare commit. The SRI code was later rewritten to the spec (#4307) and is strict about algorithm validity and strongest-hash selection.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.29.1-tuxcare.4 is not affected by CVE-2024-30261. The upstream fix commits (d542b8cd, 2b39440b, authored by Matteo Collina) are ancestors of HEAD and of the first TuxCare commit. The SRI code was later rewritten to the spec (#4307) and is strict about algorithm validity and strongest-hash selection."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 7.29.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:58:00.048321+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.29.1 of undici. not_affected \u2014 The upstream fix for CVE-2025-22150 is already in this tree. The multipart boundary in lib/web/fetch/body.js is generated with node:crypto randomInt. Math.random is used only when the crypto runtime feature is unavailable. The fix is upstream commit c2d78cd1 (Matteo Collina). It is an ancestor of HEAD and of the first TuxCare commit, so it shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for CVE-2025-22150 is already in this tree. The multipart boundary in lib/web/fetch/body.js is generated with node:crypto randomInt. Math.random is used only when the crypto runtime feature is unavailable. The fix is upstream commit c2d78cd1 (Matteo Collina). It is an ancestor of HEAD and of the first TuxCare commit, so it shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:01:00.051030+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.29.1 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e) is already in the 7.29.1 tree. Pool removes clients from its list on connectionError, so failed-connection clients do not accumulate. The fix was authored by upstream (Matteo Collina) and shipped in the upstream release, before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e) is already in the 7.29.1 tree. Pool removes clients from its list on connectionError, so failed-connection clients do not accumulate. The fix was authored by upstream (Matteo Collina) and shipped in the upstream release, before the first TuxCare commit."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T14:57:00.032146+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T14:57:00.032146+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T14:57:00.032146+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "action_statement": "Vulnerability CVE-2026-109841 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-14T03:07:50.992062+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.29.1 of undici. not_affected \u2014 Target undici 7.29.1-tuxcare.4 has the H2 WebSocket path, and a failed handshake can leave the ClientHttp2Stream open because abort() is a no-op once the request is completed. The CVE's crash needs that stream to have no 'error' listener. Here the stream gets a permanent 'error' listener at creation (client-h2.js:584), so a later server-side connection destroy cannot raise an unhandled 'error' ...",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.29.1-tuxcare.4 has the H2 WebSocket path, and a failed handshake can leave the ClientHttp2Stream open because abort() is a no-op once the request is completed. The CVE's crash needs that stream to have no 'error' listener. Here the stream gets a permanent 'error' listener at creation (client-h2.js:584), so a later server-side connection destroy cannot raise an unhandled 'error' ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T14:57:00.032146+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T14:57:00.032146+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "action_statement": "Vulnerability CVE-2026-109924 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T14:57:00.032146+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:50:00.196192+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 does not affect version 7.29.1 of undici. not_affected \u2014 Not affected. The SameSite parser in lib/web/cookies/parse.js already uses exact, case-insensitive equality against none, strict and lax, and ignores any other value. That is the upstream fix (nodejs/undici d0574cc4), which is an ancestor of HEAD and part of the upstream v7.29.1 release that TuxCare onboarded. No TuxCare-authored fix is involved.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "impact_statement": "not_affected \u2014 Not affected. The SameSite parser in lib/web/cookies/parse.js already uses exact, case-insensitive equality against none, strict and lax, and ignores any other value. That is the upstream fix (nodejs/undici d0574cc4), which is an ancestor of HEAD and part of the upstream v7.29.1 release that TuxCare onboarded. No TuxCare-authored fix is involved."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 7.29.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-07T11:52:00.076779+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "action_statement": "Vulnerability CVE-2026-116630 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "action_statement": "Vulnerability CVE-2026-120222 affects version 7.29.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T15:15:14.598019+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "action_statement": "Vulnerability CVE-2026-120415 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "action_statement": "Vulnerability CVE-2026-120423 affects version 7.29.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-07T11:52:00.076779+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "action_statement": "Vulnerability CVE-2026-120474 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-04T03:43:37.320617+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "action_statement": "Vulnerability CVE-2026-12151 affects version 7.29.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:03.785272+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "action_statement": "Vulnerability CVE-2026-13697 affects version 7.29.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T12:20:00.289373+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 does not affect version 7.29.1 of undici. not_affected \u2014 The target (undici 7.29.1) already contains the upstream fix for CVE-2026-14643. parseCacheControlHeader trims optional whitespace around '=' for qualified private/no-cache directives, then trims and validates each field name. The fix commit 98011a86 is by Matteo Collina, an upstream author. It is in the upstream release that TuxCare onboarded, so this is an upstream fix and the verdict is not_...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.29.1) already contains the upstream fix for CVE-2026-14643. parseCacheControlHeader trims optional whitespace around '=' for qualified private/no-cache directives, then trims and validates each field name. The fix commit 98011a86 is by Matteo Collina, an upstream author. It is in the upstream release that TuxCare onboarded, so this is an upstream fix and the verdict is not_..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T12:03:37.175420+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 does not affect version 7.29.1 of undici. not_affected \u2014 Target undici 7.29.1 already contains the upstream fix. The blob-like body branch in lib/dispatcher/client-h1.js validates body.type with isValidHeaderValue() before pushing the content-type header. The fix is upstream commit 33928bc24f (Matteo Collina), which shipped in the upstream release TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.29.1 already contains the upstream fix. The blob-like body branch in lib/dispatcher/client-h1.js validates body.type with isValidHeaderValue() before pushing the content-type header. The fix is upstream commit 33928bc24f (Matteo Collina), which shipped in the upstream release TuxCare onboarded."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:12:55.533948+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 does not affect version 7.29.1 of undici. not_affected \u2014 Target undici 7.29.1 already contains the upstream fix for CVE-2026-1525 (nodejs/undici 74495c63, \"reject duplicate content-length and host headers\"). The fix was part of the upstream release that TuxCare onboarded, so the vulnerable pattern is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.29.1 already contains the upstream fix for CVE-2026-1525 (nodejs/undici 74495c63, \"reject duplicate content-length and host headers\"). The fix was part of the upstream release that TuxCare onboarded, so the vulnerable pattern is not present."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 7.29.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:22:00.097234+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 does not affect version 7.29.1 of undici. not_affected \u2014 The upstream fix for CVE-2026-1527 (commit 77594f92, \"fix: validate upgrade header to prevent CRLF injection\", by Matteo Collina) is already in this undici 7.29.1 tree. The Request constructor rejects any upgrade value containing CR/LF or other invalid header characters before client-h1.js writes it to the socket. The fix was in the upstream release that TuxCare onboarded, so this is not a TuxC...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-1527 (commit 77594f92, \"fix: validate upgrade header to prevent CRLF injection\", by Matteo Collina) is already in this undici 7.29.1 tree. The Request constructor rejects any upgrade value containing CR/LF or other invalid header characters before client-h1.js writes it to the socket. The fix was in the upstream release that TuxCare onboarded, so this is not a TuxC..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-13T22:06:40.895438+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 does not affect version 7.29.1 of undici. not_affected \u2014 The 64-bit WebSocket payload-length fix (upstream 84235c62, by Matteo Collina) is already in lib/web/websocket/receiver.js. It shipped in the upstream v7.29.1 release that TuxCare onboarded, so the vulnerable pattern is not present in HEAD.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "impact_statement": "not_affected \u2014 The 64-bit WebSocket payload-length fix (upstream 84235c62, by Matteo Collina) is already in lib/web/websocket/receiver.js. It shipped in the upstream v7.29.1 release that TuxCare onboarded, so the vulnerable pattern is not present in HEAD."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:59:00.027578+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 does not affect version 7.29.1 of undici. not_affected \u2014 The target (undici 7.29.1) already contains the upstream fix 1b5a5312 (\"fix(retry): reject partial content length mismatch\", Matteo Collina). It is in the upstream release that TuxCare onboarded. The retry handler now rejects any 206 response whose Content-Length does not equal the Content-Range span, so the CVE scenario (Content-Range 0-99/300 with Content-Length 300) cannot reach the applicat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.29.1) already contains the upstream fix 1b5a5312 (\"fix(retry): reject partial content length mismatch\", Matteo Collina). It is in the upstream release that TuxCare onboarded. The retry handler now rejects any 206 response whose Content-Length does not equal the Content-Range span, so the CVE scenario (Content-Range 0-99/300 with Content-Length 300) cannot reach the applicat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T12:07:56.656702+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 does not affect version 7.29.1 of undici. not_affected \u2014 undici 7.29.1 already contains the upstream fix (commit 3bf91ddb, \"harden cookie domain, path, and unparsed attribute validation\"). validateCookieDomain enforces the RFC 1034 letter-digit-hyphen syntax and so rejects ';'. Each unparsed entry is checked with validateCookieName and validateCookieValue, which both reject ';'. The fix is in the upstream release, before the first TuxCare commit, so ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "impact_statement": "not_affected \u2014 undici 7.29.1 already contains the upstream fix (commit 3bf91ddb, \"harden cookie domain, path, and unparsed attribute validation\"). validateCookieDomain enforces the RFC 1034 letter-digit-hyphen syntax and so rejects ';'. Each unparsed entry is checked with validateCookieName and validateCookieValue, which both reject ';'. The fix is in the upstream release, before the first TuxCare commit, so ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T13:12:00.054744+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 does not affect version 7.29.1 of undici. not_affected \u2014 The fix for CVE-2026-18149 is already in the target's RetryHandler. It shipped in the upstream 7.29.1 release, authored by Matteo Collina in commit 3c672659. The first TuxCare commit in HEAD's history comes after that commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "impact_statement": "not_affected \u2014 The fix for CVE-2026-18149 is already in the target's RetryHandler. It shipped in the upstream 7.29.1 release, authored by Matteo Collina in commit 3c672659. The first TuxCare commit in HEAD's history comes after that commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T13:18:00.049274+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 does not affect version 7.29.1 of undici. not_affected \u2014 Target undici 7.29.1 already contains the upstream fix for CVE-2026-18540 (GHSA-r53p-7pc4-xj5r), commit cd8af90b, a cherry-pick of upstream 0160a719. It is authored by Matteo Collina and shipped in the upstream 7.29.1 release, before the first TuxCare commit. lib/handler/retry-handler.js checkpoints the original Content-Length before exposing headers, refuses to resume without a resumable lengt...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.29.1 already contains the upstream fix for CVE-2026-18540 (GHSA-r53p-7pc4-xj5r), commit cd8af90b, a cherry-pick of upstream 0160a719. It is authored by Matteo Collina and shipped in the upstream 7.29.1 release, before the first TuxCare commit. lib/handler/retry-handler.js checkpoints the original Content-Length before exposing headers, refuses to resume without a resumable lengt..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:31.171802+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "action_statement": "Vulnerability CVE-2026-19534 affects version 7.29.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:09:00.027242+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.29.1 of undici. not_affected \u2014 The fix for CVE-2026-22036 is already in the target. Upstream commit b04e3cbb (Matteo Collina) caps the Content-Encoding chain at 5 in both fetch() and the decompress interceptor. It is in the upstream v7.29.1 release, before any TuxCare commit, so the verdict is not_affected (upstream fix).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "impact_statement": "not_affected \u2014 The fix for CVE-2026-22036 is already in the target. Upstream commit b04e3cbb (Matteo Collina) caps the Content-Encoding chain at 5 in both fetch() and the decompress interceptor. It is in the upstream v7.29.1 release, before any TuxCare commit, so the verdict is not_affected (upstream fix)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 7.29.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-14T01:43:11.275870+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 does not affect version 7.29.1 of undici. not_affected \u2014 The target (undici 7.29.1) already contains the upstream fix for CVE-2026-2581, commit 5890c7b7 \"fix(deduplicate): stream response chunks to waiting handlers\" by Matteo Collina. The fix came in with the upstream release, before the first TuxCare commit. DeduplicationHandler forwards chunks to waiting handlers as they arrive and refuses late attachment once body data has started.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.29.1) already contains the upstream fix for CVE-2026-2581, commit 5890c7b7 \"fix(deduplicate): stream response chunks to waiting handlers\" by Matteo Collina. The fix came in with the upstream release, before the first TuxCare commit. DeduplicationHandler forwards chunks to waiting handlers as they arrive and refuses late attachment once body data has started."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:57:00.040315+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 does not affect version 7.29.1 of undici. not_affected \u2014 Target (undici 7.29.1) already contains the upstream fix for response-queue poisoning on idle keep-alive sockets (idle-socket validation, GHSA-35p6-xmwp-9g52 lineage). The fix is in the upstream release TuxCare onboarded: commits ea8930cf and f57411b8, both authored by Matteo Collina, are in HEAD and predate the first TuxCare commit. The CVE's pre-fix pattern is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "impact_statement": "not_affected \u2014 Target (undici 7.29.1) already contains the upstream fix for response-queue poisoning on idle keep-alive sockets (idle-socket validation, GHSA-35p6-xmwp-9g52 lineage). The fix is in the upstream release TuxCare onboarded: commits ea8930cf and f57411b8, both authored by Matteo Collina, are in HEAD and predate the first TuxCare commit. The CVE's pre-fix pattern is not present."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:03.785272+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "action_statement": "Vulnerability CVE-2026-6734 affects version 7.29.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T13:09:42.530346+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 does not affect version 7.29.1 of undici. not_affected \u2014 The target (undici 7.29.1) already contains the upstream fix for CVE-2026-84890. lib/interceptor/decompress.js has a maxSize option (default 64 MiB) and rejects over-limit output with ResponseExceededMaxSizeError. The fix commit 2c7d7e12 is by the upstream author and was already in the upstream 7.29.1 release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.29.1) already contains the upstream fix for CVE-2026-84890. lib/interceptor/decompress.js has a maxSize option (default 64 MiB) and rejects over-limit output with ResponseExceededMaxSizeError. The fix commit 2c7d7e12 is by the upstream author and was already in the upstream 7.29.1 release that TuxCare onboarded."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T13:06:13.988465+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 does not affect version 7.29.1 of undici. not_affected \u2014 The upstream fix for CVE-2026-84933 (commit b6c5a002, \"fix(cache): do not cache Set-Cookie in shared caches\", by Matteo Collina) is already in HEAD. It shipped inside the upstream 7.29.1 release, before the first TuxCare commit (71273b03). In shared mode the code now refuses to store, serve, or revalidate-reuse responses carrying Set-Cookie. Verdict is not_affected under the upstream-fix rule.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-84933 (commit b6c5a002, \"fix(cache): do not cache Set-Cookie in shared caches\", by Matteo Collina) is already in HEAD. It shipped inside the upstream 7.29.1 release, before the first TuxCare commit (71273b03). In shared mode the code now refuses to store, serve, or revalidate-reuse responses carrying Set-Cookie. Verdict is not_affected under the upstream-fix rule."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T12:52:41.784230+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 does not affect version 7.29.1 of undici. not_affected \u2014 The target is undici 7.29.1, which is the upstream release carrying the CVE-2026-84947 fix. lib/interceptor/dump.js already contains the fix commit 21693f40 (Matteo Collina). That commit is an ancestor of HEAD and of the first TuxCare commit, so it shipped in the upstream release. The pre-fix early-end behaviour is gone: onResponseData throws RequestAbortedError once the received size exceeds m...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "impact_statement": "not_affected \u2014 The target is undici 7.29.1, which is the upstream release carrying the CVE-2026-84947 fix. lib/interceptor/dump.js already contains the fix commit 21693f40 (Matteo Collina). That commit is an ancestor of HEAD and of the first TuxCare commit, so it shipped in the upstream release. The pre-fix early-end behaviour is gone: onResponseData throws RequestAbortedError once the received size exceeds m..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:05:03.785272+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "action_statement": "Vulnerability CVE-2026-84961 affects version 7.29.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T12:58:00.042642+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 does not affect version 7.29.1 of undici. not_affected \u2014 The target (undici 7.29.1) already contains the upstream fix. The interceptor skips store.get() for unsafe methods, and canCacheResponse() rejects non-safe methods. The fix commit b61d9432 is by Matteo Collina and shipped in the upstream v7.29.1 release, so this is an upstream fix rather than a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.29.1) already contains the upstream fix. The interceptor skips store.get() for unsafe methods, and canCacheResponse() rejects non-safe methods. The fix commit b61d9432 is by Matteo Collina and shipped in the upstream v7.29.1 release, so this is an upstream fix rather than a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T12:47:46.840277+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 does not affect version 7.29.1 of undici. not_affected \u2014 Target undici 7.29.1 already contains the upstream fix for CVE-2026-85014. The upstream commit 1858656e (Matteo Collina) came with the 7.29.1 release, before the first TuxCare commit. WebSocketStream#onSocketClose now errors the writable stream through a retained WritableStreamDefaultController. It no longer calls abort() on a possibly locked stream, so no rejected promise is produced and the p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.29.1 already contains the upstream fix for CVE-2026-85014. The upstream commit 1858656e (Matteo Collina) came with the 7.29.1 release, before the first TuxCare commit. WebSocketStream#onSocketClose now errors the writable stream through a retained WritableStreamDefaultController. It no longer calls abort() on a possibly locked stream, so no rejected promise is produced and the p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-14T02:17:22.627467+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 does not affect version 7.29.1 of undici. not_affected \u2014 Not affected. lib/web/websocket/permessage-deflate.js already contains the upstream fix. After the size limit is hit, the code calls removeAllListeners() and then destroy() on the InflateRaw, so a later malformed DEFLATE block cannot emit an unhandled 'error'. The fix is upstream commit 63cf698b by hello@matteocollina.com. It shipped in the upstream 7.29.x release, before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "impact_statement": "not_affected \u2014 Not affected. lib/web/websocket/permessage-deflate.js already contains the upstream fix. After the size limit is hit, the code calls removeAllListeners() and then destroy() on the InflateRaw, so a later malformed DEFLATE block cannot emit an unhandled 'error'. The fix is upstream commit 63cf698b by hello@matteocollina.com. It shipped in the upstream 7.29.x release, before the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-14T02:40:32.556691+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.29.1 of undici. not_affected \u2014 Target is undici 7.29.1-tuxcare.4. The CVE says the flaw was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In this target, both interceptors refuse to cache or deduplicate any request without opts.origin and always put opts.origin into the key. The pre-fix pattern (keys built without the actual origin) is absent.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.29.1-tuxcare.4. The CVE says the flaw was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In this target, both interceptors refuse to cache or deduplicate any request without opts.origin and always put opts.origin into the key. The pre-fix pattern (keys built without the actual origin) is absent."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-10T14:50:54.029117+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T14:57:00.032146+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "action_statement": "Vulnerability CVE-2026-87029 affects version 7.29.1 of undici, and is fixed in 7.29.1-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-14T02:06:45.296491+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 does not affect version 7.29.1 of undici. not_affected \u2014 The target (undici 7.29.1-tuxcare.4) already has a cumulative fragment-size check for uncompressed WebSocket messages. It came from the upstream 7.x release (commit a027a4a0, \"Backport WebSocket maxPayloadSize fixes to v7.x\"), not from TuxCare. The 8.1.0 regression described in the CVE is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.29.1-tuxcare.4) already has a cumulative fragment-size check for uncompressed WebSocket messages. It came from the upstream 7.x release (commit a027a4a0, \"Backport WebSocket maxPayloadSize fixes to v7.x\"), not from TuxCare. The 8.1.0 regression described in the CVE is not present."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T12:33:00.051731+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 does not affect version 7.29.1 of undici. not_affected \u2014 Not affected. undici 7.29.1 already trims whitespace around qualified private/no-cache field names in parseCacheControlHeader, so padded names such as private=\" authorization\" or no-cache=\"\\tauthorization\" normalize to \"authorization\" and match the later comparison. The hardening came from the upstream commit 98011a86 (Matteo Collina), which is in the upstream release before the first TuxCare c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "impact_statement": "not_affected \u2014 Not affected. undici 7.29.1 already trims whitespace around qualified private/no-cache field names in parseCacheControlHeader, so padded names such as private=\" authorization\" or no-cache=\"\\tauthorization\" normalize to \"authorization\" and match the later comparison. The hardening came from the upstream commit 98011a86 (Matteo Collina), which is in the upstream release before the first TuxCare c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:52:33.556155+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 does not affect version 7.29.1 of undici. not_affected \u2014 Target undici 7.29.1 already contains the upstream fix. parseSetCookie in lib/web/cookies/parse.js returns the trimmed raw cookie value, with no percent-decoding. The fix is upstream commit d0574cc4, which is also one of the two supplied patch commits. It was already part of the upstream release before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.29.1 already contains the upstream fix. parseSetCookie in lib/web/cookies/parse.js returns the trimmed raw cookie value, with no percent-decoding. The fix is upstream commit d0574cc4, which is also one of the two supplied patch commits. It was already part of the upstream release before the first TuxCare commit."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.29.1",
          "identifiers": {
            "purl": "pkg:npm/undici@7.29.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:04:00.091712+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 affects version 7.29.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "action_statement": "Vulnerability CVE-2026-9697 affects version 7.29.1 of undici."
    }
  ]
}