{
  "@id": "urn:uuid:a3d67e9d-4215-4fac-80a8-ea27b1788b81",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 47,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T04:58:33.279022+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 7.30.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T00:34:00.106671+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.30.0 of undici. not_affected \u2014 undici 7.30.0 already contains the upstream fix for CVE-2023-45143. httpRedirectFetch deletes the cookie, host, authorization and proxy-authorization headers whenever a redirect crosses origins. The fix is upstream commit e041de35, authored by an upstream contributor and already in the history of HEAD.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 undici 7.30.0 already contains the upstream fix for CVE-2023-45143. httpRedirectFetch deletes the cookie, host, authorization and proxy-authorization headers whenever a redirect crosses origins. The fix is upstream commit e041de35, authored by an upstream contributor and already in the history of HEAD."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "action_statement": "Vulnerability CVE-2024-24750 affects version 7.30.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T22:35:00.150846+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.30.0 of undici. not_affected \u2014 Target (undici 7.30.0) already strips Proxy-Authorization on cross-origin redirects in both the fetch path and the dispatcher RedirectHandler. The upstream fix (b9da3e40, Matteo Collina) is an ancestor of HEAD and part of the upstream release before the first TuxCare commit, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 Target (undici 7.30.0) already strips Proxy-Authorization on cross-origin redirects in both the fetch path and the dispatcher RedirectHandler. The upstream fix (b9da3e40, Matteo Collina) is an ancestor of HEAD and part of the upstream release before the first TuxCare commit, so the verdict is not_affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T00:50:07.852371+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.30.0 of undici. not_affected \u2014 The target (undici 7.30.0) already strips Authorization, Proxy-Authorization and Cookie headers on cross-origin redirects in the shared redirect handler. The upstream fix commit 6805746 is an ancestor of HEAD and shipped in the upstream release. HEAD has no TuxCare-domain commit, so this is an upstream fix and the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.30.0) already strips Authorization, Proxy-Authorization and Cookie headers on cross-origin redirects in the shared redirect handler. The upstream fix commit 6805746 is an ancestor of HEAD and shipped in the upstream release. HEAD has no TuxCare-domain commit, so this is an upstream fix and the verdict is not_affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T23:54:59.806830+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.30.0 of undici. not_affected \u2014 Undici 7.30.0 is not affected by CVE-2024-30261. The SRI check was rewritten in lib/web/subresource-integrity/subresource-integrity.js. It computes the digest with the strongest declared algorithm and compares it strictly, so a tampered body is rejected. The upstream releases that carry the fix (5.28.4 and 6.11.1) predate this 7.x line.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 Undici 7.30.0 is not affected by CVE-2024-30261. The SRI check was rewritten in lib/web/subresource-integrity/subresource-integrity.js. It computes the digest with the strongest declared algorithm and compares it strictly, so a tampered body is rejected. The upstream releases that carry the fix (5.28.4 and 6.11.1) predate this 7.x line."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 7.30.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:43:00.063150+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.30.0 of undici. not_affected \u2014 Not affected. The multipart/form-data boundary in lib/web/fetch/body.js is generated with node:crypto randomInt (a CSPRNG), which is the upstream fix for CVE-2025-22150. Math.random is used only as a fallback when the crypto runtime feature is unavailable. The fix was authored upstream by Matteo Collina (c2d78cd1) and is part of the upstream undici 7.30.0 release that was onboarded. HEAD contai...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "impact_statement": "not_affected \u2014 Not affected. The multipart/form-data boundary in lib/web/fetch/body.js is generated with node:crypto randomInt (a CSPRNG), which is the upstream fix for CVE-2025-22150. Math.random is used only as a fallback when the crypto runtime feature is unavailable. The fix was authored upstream by Matteo Collina (c2d78cd1) and is part of the upstream undici 7.30.0 release that was onboarded. HEAD contai..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:48:00.142130+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.30.0 of undici. not_affected \u2014 undici 7.30.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool registers a 'connectionError' handler that removes failed clients from its client list, so clients no longer accumulate on repeated TLS failures. The fix shipped in the upstream release; it is not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "impact_statement": "not_affected \u2014 undici 7.30.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool registers a 'connectionError' handler that removes failed clients from its client list, so clients no longer accumulate on repeated TLS failures. The fix shipped in the upstream release; it is not a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-10-16T20:23:00.084126+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-10-16T20:23:00.084126+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-10-16T20:23:00.084126+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "action_statement": "Vulnerability CVE-2026-109841 affects version 7.30.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T03:10:00.496456+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.30.0 of undici. not_affected \u2014 The target (undici 7.30.0) already contains the equivalent upstream fix. lib/web/websocket/connection.js defines failHandshake(), which destroys the HTTP/2 stream before failing the WebSocket connection. Every handshake-validation failure path calls it. The fix shipped in the upstream v7.30.0 release and was authored by Matteo Collina, an upstream author. The only later commit is a TuxCare buil...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.30.0) already contains the equivalent upstream fix. lib/web/websocket/connection.js defines failHandshake(), which destroys the HTTP/2 stream before failing the WebSocket connection. Every handshake-validation failure path calls it. The fix shipped in the upstream v7.30.0 release and was authored by Matteo Collina, an upstream author. The only later commit is a TuxCare buil..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-10-16T20:23:00.084126+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-10-16T20:23:00.084126+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "action_statement": "Vulnerability CVE-2026-109924 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-10-16T20:08:00.152629+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 7.30.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T03:39:00.063410+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 does not affect version 7.30.0 of undici. not_affected \u2014 The target is undici 7.30.0. The SameSite parser in lib/web/cookies/parse.js already uses exact, case-insensitive equality against 'none', 'strict' and 'lax', so substring values like 'NoneOfYourBusiness' are rejected. The upstream fix, d0574cc4 by Matteo Collina, is an ancestor of HEAD and ships in the upstream v7.30.0 release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "impact_statement": "not_affected \u2014 The target is undici 7.30.0. The SameSite parser in lib/web/cookies/parse.js already uses exact, case-insensitive equality against 'none', 'strict' and 'lax', so substring values like 'NoneOfYourBusiness' are rejected. The upstream fix, d0574cc4 by Matteo Collina, is an ancestor of HEAD and ships in the upstream v7.30.0 release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-06T10:20:57.098620+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "action_statement": "Vulnerability CVE-2026-116630 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "action_statement": "Vulnerability CVE-2026-120222 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "action_statement": "Vulnerability CVE-2026-120415 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "action_statement": "Vulnerability CVE-2026-120423 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-06T10:06:35.912230+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "action_statement": "Vulnerability CVE-2026-120474 affects version 7.30.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T03:39:00.063410+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 does not affect version 7.30.0 of undici. not_affected \u2014 Target undici 7.30.0 already contains the upstream fix for CVE-2026-12151: the WebSocket receiver enforces a maxFragments limit (default 131072) on message fragments and fails the connection with 1008 when it is exceeded. The fix commit 8cb10f98 is upstream-authored and was part of the upstream release (7.28.0 or earlier) that the branch is based on.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.30.0 already contains the upstream fix for CVE-2026-12151: the WebSocket receiver enforces a maxFragments limit (default 131072) on message fragments and fails the connection with 1008 when it is exceeded. The fix commit 8cb10f98 is upstream-authored and was part of the upstream release (7.28.0 or earlier) that the branch is based on."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T04:10:01.075579+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 does not affect version 7.30.0 of undici. not_affected \u2014 undici 7.30.0 already contains the upstream fix for CVE-2026-13697. In lib/util/cache.js, a qualified private/no-cache field list that is empty or malformed is normalized to true. An existing true value is never concatenated onto, which closes the crash. The shared-cache guard therefore rejects such responses. The fix is upstream commit 98011a86 (Matteo Collina), shipped in the upstream release...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "impact_statement": "not_affected \u2014 undici 7.30.0 already contains the upstream fix for CVE-2026-13697. In lib/util/cache.js, a qualified private/no-cache field list that is empty or malformed is normalized to true. An existing true value is never concatenated onto, which closes the crash. The shared-cache guard therefore rejects such responses. The fix is upstream commit 98011a86 (Matteo Collina), shipped in the upstream release..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T03:49:00.097314+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 does not affect version 7.30.0 of undici. not_affected \u2014 Undici 7.30.0 already contains the upstream fix for CVE-2026-14643. parseCacheControlHeader in lib/util/cache.js trims optional whitespace on both sides of '=' and handles quoted field lists, so qualified no-cache/private directives are recognized and the cache handler honors them. The fix shipped in the upstream release, not through a TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "impact_statement": "not_affected \u2014 Undici 7.30.0 already contains the upstream fix for CVE-2026-14643. parseCacheControlHeader in lib/util/cache.js trims optional whitespace on both sides of '=' and handles quoted field lists, so qualified no-cache/private directives are recognized and the cache handler honors them. The fix shipped in the upstream release, not through a TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T03:59:00.047635+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 does not affect version 7.30.0 of undici. not_affected \u2014 Undici 7.30.0 already contains the upstream fix for CVE-2026-15157. In lib/dispatcher/client-h1.js the blob-like body branch now runs isValidHeaderValue() on body.type before pushing the content-type header, and it errors the request if the value is invalid. The fix is upstream commit 33928bc2 by Matteo Collina. It is an ancestor of the v7.30.0 release commit 6741f66e, so it shipped in the upst...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "impact_statement": "not_affected \u2014 Undici 7.30.0 already contains the upstream fix for CVE-2026-15157. In lib/dispatcher/client-h1.js the blob-like body branch now runs isValidHeaderValue() on body.type before pushing the content-type header, and it errors the request if the value is invalid. The fix is upstream commit 33928bc2 by Matteo Collina. It is an ancestor of the v7.30.0 release commit 6741f66e, so it shipped in the upst..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T22:00:48.612672+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 does not affect version 7.30.0 of undici. not_affected \u2014 undici 7.30.0 already contains the upstream fix for CVE-2026-1525 (upstream commit 74495c63, \"reject duplicate content-length and host headers\"). The check is case-insensitive because it keys off the lowercased header name. The fix shipped in the upstream release that TuxCare onboarded, so the verdict is not_affected, not already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "impact_statement": "not_affected \u2014 undici 7.30.0 already contains the upstream fix for CVE-2026-1525 (upstream commit 74495c63, \"reject duplicate content-length and host headers\"). The check is case-insensitive because it keys off the lowercased header name. The fix shipped in the upstream release that TuxCare onboarded, so the verdict is not_affected, not already_fixed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 7.30.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T22:18:00.036497+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 does not affect version 7.30.0 of undici. not_affected \u2014 undici 7.30.0 already contains the upstream CVE-2026-1527 fix, commit 77594f92 \"fix: validate upgrade header to prevent CRLF injection\". Request construction now rejects any `upgrade` value containing CR, LF or other invalid header characters before it can reach the HTTP/1.1 writer.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "impact_statement": "not_affected \u2014 undici 7.30.0 already contains the upstream CVE-2026-1527 fix, commit 77594f92 \"fix: validate upgrade header to prevent CRLF injection\". Request construction now rejects any `upgrade` value containing CR, LF or other invalid header characters before it can reach the HTTP/1.1 writer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T22:15:08.551507+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 does not affect version 7.30.0 of undici. not_affected \u2014 The target (undici 7.30.0) already contains the upstream fix for CVE-2026-1528. In lib/web/websocket/receiver.js the PAYLOADLENGTH_64 state rejects any 64-bit length with a non-zero upper word or a lower word above 2^31-1, and fails the connection with close code 1009. The fix commit is 84235c62 \"Fix websocket 64-bit length overflow\" by Matteo Collina, an upstream author. It is an ancestor of H...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.30.0) already contains the upstream fix for CVE-2026-1528. In lib/web/websocket/receiver.js the PAYLOADLENGTH_64 state rejects any 64-bit length with a non-zero upper word or a lower word above 2^31-1, and fails the connection with close code 1009. The fix commit is 84235c62 \"Fix websocket 64-bit length overflow\" by Matteo Collina, an upstream author. It is an ancestor of H..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T03:41:00.032525+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 does not affect version 7.30.0 of undici. not_affected \u2014 undici 7.30.0 already contains the upstream fix for CVE-2026-16728. lib/handler/retry-handler.js has validatePartialResponseContentLength, which rejects any 206 or resumed response whose Content-Length differs from the Content-Range span. The fix was authored by upstream maintainer Matteo Collina and is part of the upstream release, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "impact_statement": "not_affected \u2014 undici 7.30.0 already contains the upstream fix for CVE-2026-16728. lib/handler/retry-handler.js has validatePartialResponseContentLength, which rejects any 206 or resumed response whose Content-Length differs from the Content-Range span. The fix was authored by upstream maintainer Matteo Collina and is part of the upstream release, so the verdict is not_affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T04:03:00.047241+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 does not affect version 7.30.0 of undici. not_affected \u2014 Target (undici 7.30.0) already contains the upstream fix 3bf91ddb (\"harden cookie domain, path, and unparsed attribute validation\"). validateCookieDomain enforces the RFC 1034 letter-digit-hyphen set, which rejects ';', and the unparsed loop validates each entry's key and value, which rejects ';'. The fix shipped in the upstream release, and HEAD has no TuxCare-domain commit in its history.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "impact_statement": "not_affected \u2014 Target (undici 7.30.0) already contains the upstream fix 3bf91ddb (\"harden cookie domain, path, and unparsed attribute validation\"). validateCookieDomain enforces the RFC 1034 letter-digit-hyphen set, which rejects ';', and the unparsed loop validates each entry's key and value, which rejects ';'. The fix shipped in the upstream release, and HEAD has no TuxCare-domain commit in its history."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:04:00.118761+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 does not affect version 7.30.0 of undici. not_affected \u2014 undici 7.30.0 already contains the upstream fix for CVE-2026-18149 (GHSA-pmjh-fq2x-6v4x). Upstream commit 3c672659 \"fix(retry): settle exposed body on terminal failure\", authored by Matteo Collina, is an ancestor of HEAD. RetryHandler now sends a terminal error to the already-exposed downstream handler instead of forwarding a replacement response. HEAD has no commit by a TuxCare-domain author, ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "impact_statement": "not_affected \u2014 undici 7.30.0 already contains the upstream fix for CVE-2026-18149 (GHSA-pmjh-fq2x-6v4x). Upstream commit 3c672659 \"fix(retry): settle exposed body on terminal failure\", authored by Matteo Collina, is an ancestor of HEAD. RetryHandler now sends a terminal error to the already-exposed downstream handler instead of forwarding a replacement response. HEAD has no commit by a TuxCare-domain author, ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:12:00.068117+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 does not affect version 7.30.0 of undici. not_affected \u2014 The target (undici 7.30.0) already contains the upstream fix for CVE-2026-18540 (GHSA-r53p-7pc4-xj5r). It is commit cd8af90b \"fix(retry): validate resumed response framing\", authored by Matteo Collina. That commit is in the upstream 7.29.1 release and sits before the Bumped v7.30.0 commit. HEAD has no TuxCare-authored commits, so this is an upstream fix, not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.30.0) already contains the upstream fix for CVE-2026-18540 (GHSA-r53p-7pc4-xj5r). It is commit cd8af90b \"fix(retry): validate resumed response framing\", authored by Matteo Collina. That commit is in the upstream 7.29.1 release and sits before the Bumped v7.30.0 commit. HEAD has no TuxCare-authored commits, so this is an upstream fix, not a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:17:46.042770+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 does not affect version 7.30.0 of undici. not_affected \u2014 Target undici 7.30.0 already contains the upstream fix for CVE-2026-19534. The subprotocol check in lib/web/websocket/connection.js guards `requestProtocols === null` before calling `.includes()`, so an unrequested Sec-WebSocket-Protocol fails the handshake with 1002 instead of throwing. The fix commit 6615e017 is upstream-authored and shipped in the v7.x release that HEAD is built on.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.30.0 already contains the upstream fix for CVE-2026-19534. The subprotocol check in lib/web/websocket/connection.js guards `requestProtocols === null` before calling `.includes()`, so an unrequested Sec-WebSocket-Protocol fails the handshake with 1002 instead of throwing. The fix commit 6615e017 is upstream-authored and shipped in the v7.x release that HEAD is built on."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:58:00.053272+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.30.0 of undici. not_affected \u2014 The upstream fix for CVE-2026-22036 (cap of 5 content-encodings) is already present in undici 7.30.0 in both fetch() and the decompress interceptor. The fix was authored upstream by Matteo Collina (b04e3cbb) and shipped in the upstream release. No TuxCare-domain commit exists in HEAD's history.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-22036 (cap of 5 content-encodings) is already present in undici 7.30.0 in both fetch() and the decompress interceptor. The fix was authored upstream by Matteo Collina (b04e3cbb) and shipped in the upstream release. No TuxCare-domain commit exists in HEAD's history."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 7.30.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T02:11:45.358015+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 does not affect version 7.30.0 of undici. not_affected \u2014 The upstream fix (nodejs/undici 5890c7b7, \"fix(deduplicate): stream response chunks to waiting handlers\", by Matteo Collina) is already in this undici 7.30.0 tree. The dedupe handler streams chunks and refuses late attach, so the full-body accumulation is gone. The fix shipped in the upstream release, so the verdict is not_affected, not already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "impact_statement": "not_affected \u2014 The upstream fix (nodejs/undici 5890c7b7, \"fix(deduplicate): stream response chunks to waiting handlers\", by Matteo Collina) is already in this undici 7.30.0 tree. The dedupe handler streams chunks and refuses late attach, so the full-body accumulation is gone. The fix shipped in the upstream release, so the verdict is not_affected, not already_fixed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T04:22:00.058111+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 does not affect version 7.30.0 of undici. not_affected \u2014 undici 7.30.0 already contains the upstream fix for CVE-2026-6733 (GHSA-35p6-xmwp-9g52). The fix is upstream commit ea8930cf by Matteo Collina, which is in the upstream release and is not a TuxCare backport. It makes a reused idle keep-alive socket drain and validate pending unsolicited bytes before the next request is written. Bytes that arrive while no request is outstanding destroy the socket.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "impact_statement": "not_affected \u2014 undici 7.30.0 already contains the upstream fix for CVE-2026-6733 (GHSA-35p6-xmwp-9g52). The fix is upstream commit ea8930cf by Matteo Collina, which is in the upstream release and is not a TuxCare backport. It makes a reused idle keep-alive socket drain and validate pending unsolicited bytes before the next request is written. Bytes that arrive while no request is outstanding destroy the socket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T04:12:00.064800+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 does not affect version 7.30.0 of undici. not_affected \u2014 Socks5ProxyAgent in undici 7.30.0 already keys pools by origin. The upstream fix (commit 3805b8f, fix for #5041, same change as the a516f87 patch commit) is in HEAD and shipped in the upstream release. No TuxCare-authored commit exists in HEAD's history, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "impact_statement": "not_affected \u2014 Socks5ProxyAgent in undici 7.30.0 already keys pools by origin. The upstream fix (commit 3805b8f, fix for #5041, same change as the a516f87 patch commit) is in HEAD and shipped in the upstream release. No TuxCare-authored commit exists in HEAD's history, so the verdict is not_affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:02:52.497487+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 does not affect version 7.30.0 of undici. not_affected \u2014 The target (undici 7.30.0) already contains the upstream fix for CVE-2026-84890. lib/interceptor/decompress.js has a `maxSize` option that counts decompressed bytes and fails with ResponseExceededMaxSizeError, including a per-stage limiter in multi-encoding chains. The fix is upstream commit 2c7d7e12, authored by Matteo Collina and shipped in the upstream 7.x release. HEAD has no TuxCare commit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.30.0) already contains the upstream fix for CVE-2026-84890. lib/interceptor/decompress.js has a `maxSize` option that counts decompressed bytes and fails with ResponseExceededMaxSizeError, including a per-stage limiter in multi-encoding chains. The fix is upstream commit 2c7d7e12, authored by Matteo Collina and shipped in the upstream 7.x release. HEAD has no TuxCare commit..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T20:55:07.047319+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 does not affect version 7.30.0 of undici. not_affected \u2014 The target (undici 7.30.0) already contains the upstream fix for CVE-2026-84933. In shared-cache mode, responses with Set-Cookie are not stored, and existing shared entries with Set-Cookie are not re-served. Revalidation responses with Set-Cookie also cannot be reused. The fix is upstream commit b6c5a002 by Matteo Collina. It is part of the v7.30.0 release (6741f66e), which is before the only c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.30.0) already contains the upstream fix for CVE-2026-84933. In shared-cache mode, responses with Set-Cookie are not stored, and existing shared entries with Set-Cookie are not re-served. Revalidation responses with Set-Cookie also cannot be reused. The fix is upstream commit b6c5a002 by Matteo Collina. It is part of the v7.30.0 release (6741f66e), which is before the only c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T20:32:00.085118+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 does not affect version 7.30.0 of undici. not_affected \u2014 Target undici 7.30.0 already contains the upstream fix for the dump interceptor. lib/interceptor/dump.js counts received bytes and throws RequestAbortedError once the total exceeds maxSize, so chunked responses are no longer silently truncated. The fix commit 21693f40 is by Matteo Collina (upstream), is an ancestor of HEAD, and HEAD has no commit with a TuxCare/CloudLinux author email.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.30.0 already contains the upstream fix for the dump interceptor. lib/interceptor/dump.js counts received bytes and throws RequestAbortedError once the total exceeds maxSize, so chunked responses are no longer silently truncated. The fix commit 21693f40 is by Matteo Collina (upstream), is an ancestor of HEAD, and HEAD has no commit with a TuxCare/CloudLinux author email."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T20:48:28.278269+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 does not affect version 7.30.0 of undici. not_affected \u2014 BalancedPool in this target (undici 7.30.0) already preserves connect/tls outside the JSON deep clone. The fix is upstream commit f690157d by Matteo Collina (fix: preserve BalancedPool connection options), shipped in the upstream release the target is based on. There is no TuxCare-authored fix, so the verdict is not_affected, not already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "impact_statement": "not_affected \u2014 BalancedPool in this target (undici 7.30.0) already preserves connect/tls outside the JSON deep clone. The fix is upstream commit f690157d by Matteo Collina (fix: preserve BalancedPool connection options), shipped in the upstream release the target is based on. There is no TuxCare-authored fix, so the verdict is not_affected, not already_fixed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T20:45:00.194543+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 does not affect version 7.30.0 of undici. not_affected \u2014 Target (undici 7.30.0) already contains the upstream fix for CVE-2026-85008 (commit b61d9432, authored by Matteo Collina, upstream). Unsafe methods no longer read from the cache store, and canCacheResponse rejects non-safe methods. Invalidation on successful unsafe requests is preserved. The fix shipped in the upstream release; HEAD has no TuxCare-domain commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "impact_statement": "not_affected \u2014 Target (undici 7.30.0) already contains the upstream fix for CVE-2026-85008 (commit b61d9432, authored by Matteo Collina, upstream). Unsafe methods no longer read from the cache store, and canCacheResponse rejects non-safe methods. Invalidation on successful unsafe requests is preserved. The fix shipped in the upstream release; HEAD has no TuxCare-domain commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T20:28:00.031536+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 does not affect version 7.30.0 of undici. not_affected \u2014 Target undici 7.30.0 already contains the upstream fix for CVE-2026-85014. #onSocketClose no longer calls abort() on the writable stream. It errors the stream through a retained WritableStreamDefaultController, which works while a writer holds the lock and creates no rejected promise. The fix shipped in the upstream v7.30.0 release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.30.0 already contains the upstream fix for CVE-2026-85014. #onSocketClose no longer calls abort() on the writable stream. It errors the stream through a retained WritableStreamDefaultController, which works while a writer holds the lock and creates no rejected promise. The fix shipped in the upstream v7.30.0 release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T02:28:22.936723+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 does not affect version 7.30.0 of undici. not_affected \u2014 undici 7.30.0 already contains the upstream fix. In lib/web/websocket/permessage-deflate.js, once the decompressed-size limit is hit, the code calls removeAllListeners() and then destroy() on the InflateRaw and sets it to null. The destroyed stream cannot emit a later Z_DATA_ERROR with no listener, so the process cannot be terminated. The fix is upstream commit 63cf698b by Matteo Collina. It si...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "impact_statement": "not_affected \u2014 undici 7.30.0 already contains the upstream fix. In lib/web/websocket/permessage-deflate.js, once the decompressed-size limit is hit, the code calls removeAllListeners() and then destroy() on the InflateRaw and sets it to null. The destroyed stream cannot emit a later Z_DATA_ERROR with no listener, so the process cannot be terminated. The fix is upstream commit 63cf698b by Matteo Collina. It si..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T02:45:36.676709+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.30.0 of undici. not_affected \u2014 Target is undici 7.30.0. The CVE says the flaw was introduced in 8.10.0 and affects 8.10.0 and 8.10.1. In 7.30.0 the cache and deduplication keys always include opts.origin. Requests without an origin bypass both interceptors, so the origin-less key flaw is absent.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.30.0. The CVE says the flaw was introduced in 8.10.0 and affects 8.10.0 and 8.10.1. In 7.30.0 the cache and deduplication keys always include opts.origin. Requests without an origin bypass both interceptors, so the origin-less key flaw is absent."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-10-16T20:08:00.152629+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 7.30.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-10-16T20:08:00.152629+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "action_statement": "Vulnerability CVE-2026-87029 affects version 7.30.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T02:11:45.358015+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 does not affect version 7.30.0 of undici. not_affected \u2014 Target is undici 7.30.0. The CVE says the cumulative-fragment bug is a regression specific to 8.1.0 and that 7.x is unaffected. The code confirms this: the 7.x receiver already checks the cumulative size of fragmented uncompressed messages. That check was added upstream in a027a4a0 (the 7.x maxPayloadSize backport), which is part of the 7.30.0 release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.30.0. The CVE says the cumulative-fragment bug is a regression specific to 8.1.0 and that 7.x is unaffected. The code confirms this: the 7.x receiver already checks the cumulative size of fragmented uncompressed messages. That check was added upstream in a027a4a0 (the 7.x maxPayloadSize backport), which is part of the 7.30.0 release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:04:00.091712+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 affects version 7.30.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "action_statement": "Vulnerability CVE-2026-9678 affects version 7.30.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-14T04:58:33.279022+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 does not affect version 7.30.0 of undici. not_affected \u2014 Target (undici 7.30.0) already contains the upstream fix for CVE-2026-9679. parseSetCookie no longer percent-decodes cookie values, so %0D%0A, %00, %3B and %3D stay encoded. The fix commit d0574cc4 (a cherry-pick of 5655ea43) is an ancestor of HEAD. It is authored by Matteo Collina and shipped in the upstream v7.30.0 release, before the only TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "impact_statement": "not_affected \u2014 Target (undici 7.30.0) already contains the upstream fix for CVE-2026-9679. parseSetCookie no longer percent-decodes cookie values, so %0D%0A, %00, %3B and %3D stay encoded. The fix commit d0574cc4 (a cherry-pick of 5655ea43) is an ancestor of HEAD. It is authored by Matteo Collina and shipped in the upstream v7.30.0 release, before the only TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.30.0",
          "identifiers": {
            "purl": "pkg:npm/undici@7.30.0"
          }
        }
      ],
      "timestamp": "2026-11-13T20:22:00.050465+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 does not affect version 7.30.0 of undici. not_affected \u2014 Target (undici 7.30.0) already contains the upstream fix 04201f89 \"fix: honor requestTls when proxy is SOCKS5\". ProxyAgent forwards requestTls to Socks5ProxyAgent, which passes it to tls.connect for the destination upgrade. The fix shipped in the upstream release (authored by tonghuaroot@gmail.com, committed by matteo.collina@gmail.com), so it is not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "impact_statement": "not_affected \u2014 Target (undici 7.30.0) already contains the upstream fix 04201f89 \"fix: honor requestTls when proxy is SOCKS5\". ProxyAgent forwards requestTls to Socks5ProxyAgent, which passes it to tls.connect for the destination upgrade. The fix shipped in the upstream release (authored by tonghuaroot@gmail.com, committed by matteo.collina@gmail.com), so it is not a TuxCare backport."
    }
  ]
}