{ "@id": "urn:uuid:0a43d64c-7a34-49a0-9c39-55443e6745b1", "role": "Document Creator", "author": "https://tuxcare.com", "version": 46, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:59:44.828253+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 8.10.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-14T00:07:00.231663+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 8.10.0 of undici. not_affected \u2014 Undici 8.10.0 already contains the upstream fix for CVE-2023-45143 (commit e041de35, shipped in 5.26.2). On a cross-origin redirect, fetch removes authorization, proxy-authorization, cookie and host from the request headers. The dispatcher redirect handler also strips cookie on a cross-origin redirect. The fix is an ancestor of HEAD and was authored upstream, not by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Undici 8.10.0 already contains the upstream fix for CVE-2023-45143 (commit e041de35, shipped in 5.26.2). On a cross-origin redirect, fetch removes authorization, proxy-authorization, cookie and host from the request headers. The dispatcher redirect handler also strips cookie on a cross-origin redirect. The fix is an ancestor of HEAD and was authored upstream, not by TuxCare." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 8.10.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T22:22:49.594925+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 8.10.0 of undici. not_affected \u2014 Target undici 8.10.0 already strips Proxy-Authorization on cross-origin redirects in both the fetch path and the dispatcher redirect handler. The fix (upstream commit b9da3e40, authored by Matteo Collina) is an ancestor of HEAD and shipped in the upstream release. No TuxCare-domain commits exist in history apart from an automation tuxcare.yaml build-config commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Target undici 8.10.0 already strips Proxy-Authorization on cross-origin redirects in both the fetch path and the dispatcher redirect handler. The fix (upstream commit b9da3e40, authored by Matteo Collina) is an ancestor of HEAD and shipped in the upstream release. No TuxCare-domain commits exist in history apart from an automation tuxcare.yaml build-config commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-14T00:33:45.023269+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 8.10.0 of undici. not_affected \u2014 Undici 8.10.0 is not affected by CVE-2024-30260. The redirect handler strips Authorization, Cookie and Proxy-Authorization whenever a redirect changes origin, which is the upstream fix. The fix commit 6805746 is an ancestor of HEAD, and HEAD's history has no TuxCare-domain commits, so the fix came from the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 Undici 8.10.0 is not affected by CVE-2024-30260. The redirect handler strips Authorization, Cookie and Proxy-Authorization whenever a redirect changes origin, which is the upstream fix. The fix commit 6805746 is an ancestor of HEAD, and HEAD's history has no TuxCare-domain commits, so the fix came from the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T23:44:39.209195+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 8.10.0 of undici. not_affected \u2014 Not affected. Target undici 8.10.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commits d542b8cd / 2b39440b). Both commits are ancestors of HEAD. Their author is Matteo Collina; the only TuxCare commit in HEAD's history is the final 'Add tuxcare.yaml build configuration' commit, which postdates the fix. The SRI integrity code was rewritten to follow the spec: it se...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Not affected. Target undici 8.10.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commits d542b8cd / 2b39440b). Both commits are ancestors of HEAD. Their author is Matteo Collina; the only TuxCare commit in HEAD's history is the final 'Add tuxcare.yaml build configuration' commit, which postdates the fix. The SRI integrity code was rewritten to follow the spec: it se..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 8.10.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T21:32:55.414966+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 8.10.0 of undici. not_affected \u2014 undici 8.10.0 already contains the upstream CVE-2025-22150 fix. The multipart boundary is built from node:crypto randomInt when the crypto runtime feature is available. Math.random is used only as a fallback when node:crypto is unavailable. The fix commit c2d78cd1 (Matteo Collina, upstream) is an ancestor of HEAD, and HEAD has no TuxCare-authored commit, so this is an upstream fix shipped in th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 undici 8.10.0 already contains the upstream CVE-2025-22150 fix. The multipart boundary is built from node:crypto randomInt when the crypto runtime feature is available. Math.random is used only as a fallback when node:crypto is unavailable. The fix commit c2d78cd1 (Matteo Collina, upstream) is an ancestor of HEAD, and HEAD has no TuxCare-authored commit, so this is an upstream fix shipped in th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T21:39:00.116210+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 8.10.0 of undici. not_affected \u2014 The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e) is already in the target (undici 8.10.0). It is an ancestor of HEAD and was authored by upstream maintainer Matteo Collina. lib/dispatcher/pool.js:84-95 matches the upstream hunk: on 'connectionError' the failed clients are removed from the pool's client list. The target history has no commit from a TuxCare/CloudLinux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e) is already in the target (undici 8.10.0). It is an ancestor of HEAD and was authored by upstream maintainer Matteo Collina. lib/dispatcher/pool.js:84-95 matches the upstream hunk: on 'connectionError' the failed clients are removed from the pool's client list. The target history has no commit from a TuxCare/CloudLinux..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 8.10.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-14T02:59:44.828253+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 8.10.0 of undici. not_affected \u2014 Target is undici 8.10.0. The CVE says the regression was introduced in 8.11.0. In this target, when a WebSocket handshake over HTTP/2 fails validation, the abort still works. The request is not yet marked completed at that point, so abort() destroys the ClientHttp2Stream and the orphaned-stream crash cannot occur. Judged from the CVE text alone, because the patch was provided only as a URL.", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 8.10.0. The CVE says the regression was introduced in 8.11.0. In this target, when a WebSocket handshake over HTTP/2 fails validation, the abort still works. The request is not yet marked completed at that point, so abort() destroys the ClientHttp2Stream and the orphaned-stream crash cannot occur. Judged from the CVE text alone, because the patch was provided only as a URL." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-10-15T18:32:21.377572+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-10-15T18:34:00.250279+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 8.10.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T20:01:00.036985+00:00", "status_notes": "Vulnerability CVE-2026-11525 does not affect version 8.10.0 of undici. not_affected \u2014 Target undici 8.10.0 already parses SameSite with exact, case-insensitive equality against none/strict/lax. The substring-match pattern from CVE-2026-11525 is absent. The fix is upstream commit 5655ea43 by Matteo Collina, which is an ancestor of HEAD and shipped in the upstream release. HEAD's history has no TuxCare-authored commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-11525" }, "impact_statement": "not_affected \u2014 Target undici 8.10.0 already parses SameSite with exact, case-insensitive equality against none/strict/lax. The substring-match pattern from CVE-2026-11525 is absent. The fix is upstream commit 5655ea43 by Matteo Collina, which is an ancestor of HEAD and shipped in the upstream release. HEAD's history has no TuxCare-authored commits." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-06T10:20:57.098620+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 8.10.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T20:03:00.065439+00:00", "status_notes": "Vulnerability CVE-2026-12151 does not affect version 8.10.0 of undici. not_affected \u2014 Target undici 8.10.0 already contains the upstream fix for CVE-2026-12151: the WebSocket receiver caps fragments per message (maxFragments, default 131072) and fails the connection with 1008 'Too many message fragments'. The fix is upstream commit 32dbf0b3 and shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-12151" }, "impact_statement": "not_affected \u2014 Target undici 8.10.0 already contains the upstream fix for CVE-2026-12151: the WebSocket receiver caps fragments per message (maxFragments, default 131072) and fails the connection with 1008 'Too many message fragments'. The fix is upstream commit 32dbf0b3 and shipped in the release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T20:09:00.046186+00:00", "status_notes": "Vulnerability CVE-2026-13697 does not affect version 8.10.0 of undici. not_affected \u2014 Target undici 8.10.0 already contains the upstream fix. The Cache-Control parser turns empty or malformed qualified private/no-cache lists into `true` and never concatenates onto a `true` value. Both the shared-cache disclosure and the TypeError crash are closed. The fix shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-13697" }, "impact_statement": "not_affected \u2014 Target undici 8.10.0 already contains the upstream fix. The Cache-Control parser turns empty or malformed qualified private/no-cache lists into `true` and never concatenates onto a `true` value. Both the shared-cache disclosure and the TypeError crash are closed. The fix shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T20:08:00.042663+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 8.10.0 of undici. not_affected \u2014 undici 8.10.0 already contains the upstream fix (the target is past the fixed release v8.9.0). parseCacheControlHeader in lib/util/cache.js trims optional whitespace (OWS) around the '=' and handles quoted field lists, so `no-cache =\"authorization\"` and `no-cache= \"authorization\"` are parsed as qualified directives. The cache handler then refuses to store the response when the field list includ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 undici 8.10.0 already contains the upstream fix (the target is past the fixed release v8.9.0). parseCacheControlHeader in lib/util/cache.js trims optional whitespace (OWS) around the '=' and handles quoted field lists, so `no-cache =\"authorization\"` and `no-cache= \"authorization\"` are parsed as qualified directives. The cache handler then refuses to store the response when the field list includ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T20:05:06.156764+00:00", "status_notes": "Vulnerability CVE-2026-15157 does not affect version 8.10.0 of undici. not_affected \u2014 undici 8.10.0 already contains the upstream fix (nodejs/undici commit 7d3cf924, \"fix: validate blob body content type\"). In lib/dispatcher/client-h1.js, the blob-like body's .type is checked with isValidHeaderValue() before it is pushed as content-type. The fix shipped in the upstream release, so this is not a TuxCare fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-15157" }, "impact_statement": "not_affected \u2014 undici 8.10.0 already contains the upstream fix (nodejs/undici commit 7d3cf924, \"fix: validate blob body content type\"). In lib/dispatcher/client-h1.js, the blob-like body's .type is checked with isValidHeaderValue() before it is pushed as content-type. The fix shipped in the upstream release, so this is not a TuxCare fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T21:55:34.449898+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 8.10.0 of undici. not_affected \u2014 The upstream fix for CVE-2026-1525 (nodejs/undici 74495c63, \"reject duplicate content-length and host headers\") is already in this tree. It shipped in the upstream v8.10.0 release that TuxCare onboarded, so the vulnerable pattern is not present. lib/core/request.js processHeader lowercases every header name. It then treats content-length as a special header and throws on a repeat, so case-varia...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-1525 (nodejs/undici 74495c63, \"reject duplicate content-length and host headers\") is already in this tree. It shipped in the upstream v8.10.0 release that TuxCare onboarded, so the vulnerable pattern is not present. lib/core/request.js processHeader lowercases every header name. It then treats content-length as a special header and throws on a repeat, so case-varia..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 8.10.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T22:11:00.043442+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 8.10.0 of undici. not_affected \u2014 undici 8.10.0 already contains the upstream fix for CVE-2026-1527. Request construction rejects an `upgrade` value containing CR/LF or other invalid header characters, so the unvalidated string never reaches the `upgrade: ${upgrade}` write in client-h1.js. The fix is upstream commit 77594f92, which is an ancestor of HEAD and shipped in the upstream release. HEAD has no TuxCare commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 undici 8.10.0 already contains the upstream fix for CVE-2026-1527. Request construction rejects an `upgrade` value containing CR/LF or other invalid header characters, so the unvalidated string never reaches the `upgrade: ${upgrade}` write in client-h1.js. The fix is upstream commit 77594f92, which is an ancestor of HEAD and shipped in the upstream release. HEAD has no TuxCare commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T22:06:56.306734+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 8.10.0 of undici. not_affected \u2014 Not affected. The target (undici 8.10.0) already contains the upstream fix for CVE-2026-1528. The WebSocket receiver rejects any 64-bit payload length whose upper 32 bits are non-zero or whose lower 32 bits exceed 2^31-1, and it fails the connection with close code 1009 instead of doing overflowing arithmetic. The fix is upstream commit 84235c62 (\"Fix websocket 64-bit length overflow\", Matteo C...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 Not affected. The target (undici 8.10.0) already contains the upstream fix for CVE-2026-1528. The WebSocket receiver rejects any 64-bit payload length whose upper 32 bits are non-zero or whose lower 32 bits exceed 2^31-1, and it fails the connection with close code 1009 instead of doing overflowing arithmetic. The fix is upstream commit 84235c62 (\"Fix websocket 64-bit length overflow\", Matteo C..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T20:04:00.059662+00:00", "status_notes": "Vulnerability CVE-2026-16728 does not affect version 8.10.0 of undici. not_affected \u2014 Target is undici 8.10.0, a plain upstream release (HEAD only adds a tuxcare.yaml build config). It already contains upstream fix e11a68ed 'fix(retry): reject partial content length mismatch' (author Matteo Collina). lib/handler/retry-handler.js now rejects a 206 response whose Content-Length differs from its Content-Range span, on both the first response and resumed responses. It also rejects a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16728" }, "impact_statement": "not_affected \u2014 Target is undici 8.10.0, a plain upstream release (HEAD only adds a tuxcare.yaml build config). It already contains upstream fix e11a68ed 'fix(retry): reject partial content length mismatch' (author Matteo Collina). lib/handler/retry-handler.js now rejects a 206 response whose Content-Length differs from its Content-Range span, on both the first response and resumed responses. It also rejects a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T20:07:00.106745+00:00", "status_notes": "Vulnerability CVE-2026-16729 does not affect version 8.10.0 of undici. not_affected \u2014 undici 8.10.0 already contains the upstream fix (commit 10d93fc3, \"harden cookie domain, path, and unparsed attribute validation\"), so the semicolon-injection paths are closed. The fix shipped in the upstream v8.10.0 release (c8d80e6b), before the only TuxCare commit, a build config.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16729" }, "impact_statement": "not_affected \u2014 undici 8.10.0 already contains the upstream fix (commit 10d93fc3, \"harden cookie domain, path, and unparsed attribute validation\"), so the semicolon-injection paths are closed. The fix shipped in the upstream v8.10.0 release (c8d80e6b), before the only TuxCare commit, a build config." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 8.10.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T21:44:27.229058+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 8.10.0 of undici. not_affected \u2014 Target undici 8.10.0 already contains the upstream fix for CVE-2026-22036. Both the fetch() path and the decompress interceptor cap the Content-Encoding chain at 5 entries before building any decompression stages. The fix is upstream commit b04e3cbb (author hello@matteocollina.com), which is an ancestor of HEAD. HEAD has no TuxCare-authored commits, only an automation-authored 'Add tuxcare.yaml...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 Target undici 8.10.0 already contains the upstream fix for CVE-2026-22036. Both the fetch() path and the decompress interceptor cap the Content-Encoding chain at 5 entries before building any decompression stages. The fix is upstream commit b04e3cbb (author hello@matteocollina.com), which is an ancestor of HEAD. HEAD has no TuxCare-authored commits, only an automation-authored 'Add tuxcare.yaml..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 8.10.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-14T01:40:03.504280+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 8.10.0 of undici. not_affected \u2014 The target (undici 8.10.0) already contains the upstream fix commit 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\"). The fix shipped in the upstream release, so the vulnerable pattern is not present. The deduplication handler streams chunks to waiting handlers, refuses to attach new waiters once body data has started, and caps any paused-handler buffer at maxBufferSize.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 The target (undici 8.10.0) already contains the upstream fix commit 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\"). The fix shipped in the upstream release, so the vulnerable pattern is not present. The deduplication handler streams chunks to waiting handlers, refuses to attach new waiters once body data has started, and caps any paused-handler buffer at maxBufferSize." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T19:59:36.292466+00:00", "status_notes": "Vulnerability CVE-2026-6733 does not affect version 8.10.0 of undici. not_affected \u2014 undici 8.10.0 already contains the upstream fix for CVE-2026-6733 (response queue poisoning on idle keep-alive sockets). The fix (6ea54ef8 plus follow-ups c9fbe9d2, c76fe46e) shipped in the upstream release. The only commit above upstream v8.10.0 is a build-config commit by an automation account, so there is no TuxCare attribution and the verdict is not_affected, not already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6733" }, "impact_statement": "not_affected \u2014 undici 8.10.0 already contains the upstream fix for CVE-2026-6733 (response queue poisoning on idle keep-alive sockets). The fix (6ea54ef8 plus follow-ups c9fbe9d2, c76fe46e) shipped in the upstream release. The only commit above upstream v8.10.0 is a build-config commit by an automation account, so there is no TuxCare attribution and the verdict is not_affected, not already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T20:10:07.561437+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 8.10.0 of undici. not_affected \u2014 Socks5ProxyAgent in undici 8.10.0 keeps one Pool per origin (kPools Map keyed by String(origin)). The upstream fix a516f870 (\"use per-origin pools to prevent cross-origin routing\") shipped in the upstream release that TuxCare onboarded, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Socks5ProxyAgent in undici 8.10.0 keeps one Pool per origin (kPools Map keyed by String(origin)). The upstream fix a516f870 (\"use per-origin pools to prevent cross-origin routing\") shipped in the upstream release that TuxCare onboarded, so the target is not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-09-29T18:27:17.765346+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-10-15T12:23:19.034848+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-09-29T18:27:17.765346+00:00", "status_notes": "Vulnerability CVE-2026-85152 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-85152" }, "action_statement": "Vulnerability CVE-2026-85152 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 8.10.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 8.10.0 of undici.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 8.10.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-14T01:59:22.635915+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 8.10.0 of undici. not_affected \u2014 undici 8.10.0 already contains the upstream fix for CVE-2026-9675. The WebSocket receiver counts bytes from earlier fragments when it checks maxPayloadSize, so a stream of small fragments cannot grow memory without bound. The fix commit is by upstream author Matteo Collina and was already in the upstream v8.10.0 release before any TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 undici 8.10.0 already contains the upstream fix for CVE-2026-9675. The WebSocket receiver counts bytes from earlier fragments when it checks maxPayloadSize, so a stream of small fragments cannot grow memory without bound. The fix commit is by upstream author Matteo Collina and was already in the upstream v8.10.0 release before any TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T20:11:57.953874+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 8.10.0 of undici. not_affected \u2014 undici 8.10.0 already contains the upstream fix. The Cache-Control parser trims optional whitespace (spaces and tabs) from qualified private/no-cache field names, and rejects names that are not valid tokens, before they reach the 'authorization' comparison. The fix commit cb105d7c (Matteo Collina, upstream) is an ancestor of HEAD and ships in the upstream release. HEAD has no TuxCare-authored c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 undici 8.10.0 already contains the upstream fix. The Cache-Control parser trims optional whitespace (spaces and tabs) from qualified private/no-cache field names, and rejects names that are not valid tokens, before they reach the 'authorization' comparison. The fix commit cb105d7c (Matteo Collina, upstream) is an ancestor of HEAD and ships in the upstream release. HEAD has no TuxCare-authored c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T20:02:00.043521+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 8.10.0 of undici. not_affected \u2014 undici 8.10.0 is not affected by CVE-2026-9679. parseSetCookie in lib/web/cookies/parse.js no longer percent-decodes cookie values. The upstream fix, 5655ea43 (Matteo Collina), is an ancestor of HEAD and shipped in the upstream release. HEAD contains no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 undici 8.10.0 is not affected by CVE-2026-9679. parseSetCookie in lib/web/cookies/parse.js no longer percent-decodes cookie values. The upstream fix, 5655ea43 (Matteo Collina), is an ancestor of HEAD and shipped in the upstream release. HEAD contains no TuxCare-domain commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.0", "identifiers": { "purl": "pkg:npm/undici@8.10.0" } } ], "timestamp": "2026-11-13T20:14:00.045604+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 8.10.0 of undici. not_affected \u2014 Target undici 8.10.0 already contains the upstream fix for CVE-2026-9697. ProxyAgent forwards requestTls to Socks5ProxyAgent, which applies it (ca/cert/key/rejectUnauthorized/servername) in tls.connect on the SOCKS5 tunnel. The fix is upstream commit 42d49559 (\"fix: honor requestTls when proxy is SOCKS5\"), shipped in the upstream release the target is built on.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 Target undici 8.10.0 already contains the upstream fix for CVE-2026-9697. ProxyAgent forwards requestTls to Socks5ProxyAgent, which applies it (ca/cert/key/rejectUnauthorized/servername) in tls.connect on the SOCKS5 tunnel. The fix is upstream commit 42d49559 (\"fix: honor requestTls when proxy is SOCKS5\"), shipped in the upstream release the target is built on." } ] }