{ "@id": "urn:uuid:64445b82-738a-4d5d-a676-18127bd2ff0b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 43, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T03:11:06.476193+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 8.10.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-14T00:07:12.136688+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 8.10.1 of undici. not_affected \u2014 Target (undici 8.10.1) already clears authorization, proxy-authorization, cookie and host on cross-origin redirects in the fetch redirect path (lib/web/fetch/index.js:1350-1360). RedirectHandler also strips cookie/authorization/proxy-authorization for cross-origin redirects (lib/handler/redirect-handler.js:180-182). The cookie-deletion line came from upstream commit e1ab8b99 (author tsctx, GitH...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Target (undici 8.10.1) already clears authorization, proxy-authorization, cookie and host on cross-origin redirects in the fetch redirect path (lib/web/fetch/index.js:1350-1360). RedirectHandler also strips cookie/authorization/proxy-authorization for cross-origin redirects (lib/handler/redirect-handler.js:180-182). The cookie-deletion line came from upstream commit e1ab8b99 (author tsctx, GitH..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 8.10.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T22:22:49.594925+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 8.10.1 of undici. not_affected \u2014 Target undici 8.10.1 already strips Proxy-Authorization on cross-origin redirects in both the fetch implementation and the redirect handler. The upstream fix commit b9da3e40 (GHSA-3787-6prv-h9w3, CVE-2024-24758) is an ancestor of HEAD, and HEAD has no TuxCare commits, so this is the upstream release and not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Target undici 8.10.1 already strips Proxy-Authorization on cross-origin redirects in both the fetch implementation and the redirect handler. The upstream fix commit b9da3e40 (GHSA-3787-6prv-h9w3, CVE-2024-24758) is an ancestor of HEAD, and HEAD has no TuxCare commits, so this is the upstream release and not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-14T00:40:00.127307+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 8.10.1 of undici. not_affected \u2014 undici 8.10.1 already contains the upstream fix for CVE-2024-30260. On a cross-origin redirect, lib/handler/redirect-handler.js strips authorization, proxy-authorization and cookie. This is the same logic as upstream commit 6805746, which is an ancestor of HEAD and predates the first TuxCare commit (there is none in this history). It was therefore shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 undici 8.10.1 already contains the upstream fix for CVE-2024-30260. On a cross-origin redirect, lib/handler/redirect-handler.js strips authorization, proxy-authorization and cookie. This is the same logic as upstream commit 6805746, which is an ancestor of HEAD and predates the first TuxCare commit (there is none in this history). It was therefore shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T23:39:52.749609+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 8.10.1 of undici. not_affected \u2014 undici 8.10.1 is not affected. The SRI integrity check was fixed upstream (d542b8cd, GHSA-9qxr-qj54-h672, ancestor of HEAD) and later rewritten to follow the W3C SRI spec. Invalid algorithms are dropped, only the strongest algorithm group is compared, and a mismatch makes bytesMatch return false, so fetch fails with 'integrity mismatch'.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 undici 8.10.1 is not affected. The SRI integrity check was fixed upstream (d542b8cd, GHSA-9qxr-qj54-h672, ancestor of HEAD) and later rewritten to follow the W3C SRI spec. Invalid algorithms are dropped, only the strongest algorithm group is compared, and a mismatch makes bytesMatch return false, so fetch fails with 'integrity mismatch'." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 8.10.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T21:32:55.414966+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 8.10.1 of undici. not_affected \u2014 Target undici 8.10.1 already contains the upstream fix for CVE-2025-22150. The multipart/form-data boundary is generated with node:crypto randomInt, not Math.random. Math.random is used only as a fallback when the crypto module is unavailable, as in the upstream fix. The fix (c2d78cd1, Matteo Collina) is part of the upstream release, and HEAD has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 Target undici 8.10.1 already contains the upstream fix for CVE-2025-22150. The multipart/form-data boundary is generated with node:crypto randomInt, not Math.random. Math.random is used only as a fallback when the crypto module is unavailable, as in the upstream fix. The fix (c2d78cd1, Matteo Collina) is part of the upstream release, and HEAD has no TuxCare-domain commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T21:38:00.122263+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 8.10.1 of undici. not_affected \u2014 Target undici 8.10.1 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e, authored by Matteo Collina). Pool's constructor registers a 'connectionError' listener that removes the failed client from the pool's client list, so failed-TLS clients no longer accumulate. The fix is an ancestor of HEAD and part of the upstream release; the only TuxCare commit i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 Target undici 8.10.1 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e, authored by Matteo Collina). Pool's constructor registers a 'connectionError' listener that removes the failed client from the pool's client list, so failed-TLS clients no longer accumulate. The fix is an ancestor of HEAD and part of the upstream release; the only TuxCare commit i..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-10-16T20:22:00.069315+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-10-16T20:22:00.069315+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-10-16T20:23:00.084126+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 8.10.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-14T03:11:06.476193+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 8.10.1 of undici. not_affected \u2014 Target is undici 8.10.1. The CVE is a regression introduced in 8.11.0, where the upgrade request ends up marked completed, so the abort after a failed WebSocket-over-HTTP/2 handshake is a no-op and the stream is left open with no error listener. In this target, request.completed is never set on the upgrade path, so the abort still runs and destroys the HTTP/2 stream. The orphaned-stream crash i...", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 8.10.1. The CVE is a regression introduced in 8.11.0, where the upgrade request ends up marked completed, so the abort after a failed WebSocket-over-HTTP/2 handshake is a no-op and the stream is left open with no error listener. In this target, request.completed is never set on the upgrade path, so the abort still runs and destroys the HTTP/2 stream. The orphaned-stream crash i..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-10-16T20:22:00.069315+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-10-16T20:22:00.069315+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-10-16T20:08:00.152629+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 8.10.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T20:01:00.036985+00:00", "status_notes": "Vulnerability CVE-2026-11525 does not affect version 8.10.1 of undici. not_affected \u2014 Target undici 8.10.1 already contains the upstream fix (nodejs/undici 5655ea43, \"fix(cookies): preserve values and parse SameSite strictly\"). The SameSite parser in lib/web/cookies/parse.js uses exact, case-insensitive equality, not substring matching. The fix ships in the upstream release and has no TuxCare author or committer, so this is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-11525" }, "impact_statement": "not_affected \u2014 Target undici 8.10.1 already contains the upstream fix (nodejs/undici 5655ea43, \"fix(cookies): preserve values and parse SameSite strictly\"). The SameSite parser in lib/web/cookies/parse.js uses exact, case-insensitive equality, not substring matching. The fix ships in the upstream release and has no TuxCare author or committer, so this is an upstream fix." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-06T10:20:57.098620+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 8.10.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T20:03:00.065439+00:00", "status_notes": "Vulnerability CVE-2026-12151 does not affect version 8.10.1 of undici. not_affected \u2014 Target undici 8.10.1 already contains the upstream fix for CVE-2026-12151: the WebSocket receiver caps the number of buffered fragments per message (default 131072) and fails the connection with 1008 when exceeded. The fix commits 32dbf0b3 and c5ed7875 are upstream-authored (Luigi Pinca) and are part of the upstream 8.10.1 release, before any TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-12151" }, "impact_statement": "not_affected \u2014 Target undici 8.10.1 already contains the upstream fix for CVE-2026-12151: the WebSocket receiver caps the number of buffered fragments per message (default 131072) and fails the connection with 1008 when exceeded. The fix commits 32dbf0b3 and c5ed7875 are upstream-authored (Luigi Pinca) and are part of the upstream 8.10.1 release, before any TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T20:09:00.046186+00:00", "status_notes": "Vulnerability CVE-2026-13697 does not affect version 8.10.1 of undici. not_affected \u2014 Not affected. The target (undici 8.10.1) already contains the upstream fix (commits 4fe5bc5f and c601fff1 by Matteo Collina). Both are ancestors of HEAD and predate the first TuxCare commit, so they shipped in the upstream release. Empty or malformed qualified private values now parse to private=true, and the parser no longer calls concat on a boolean.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-13697" }, "impact_statement": "not_affected \u2014 Not affected. The target (undici 8.10.1) already contains the upstream fix (commits 4fe5bc5f and c601fff1 by Matteo Collina). Both are ancestors of HEAD and predate the first TuxCare commit, so they shipped in the upstream release. Empty or malformed qualified private values now parse to private=true, and the parser no longer calls concat on a boolean." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T20:08:00.042663+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 8.10.1 of undici. not_affected \u2014 undici 8.10.1 already contains the upstream fix. parseCacheControlHeader trims optional whitespace around '=' and strips the quotes from the qualified no-cache/private field list, so padded forms such as no-cache =\"authorization\" and no-cache= \"authorization\" parse into field-name arrays. The fix commits c601fff1 and cb105d7c are ancestors of HEAD and shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 undici 8.10.1 already contains the upstream fix. parseCacheControlHeader trims optional whitespace around '=' and strips the quotes from the qualified no-cache/private field list, so padded forms such as no-cache =\"authorization\" and no-cache= \"authorization\" parse into field-name arrays. The fix commits c601fff1 and cb105d7c are ancestors of HEAD and shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T20:05:06.156764+00:00", "status_notes": "Vulnerability CVE-2026-15157 does not affect version 8.10.1 of undici. not_affected \u2014 Not affected. undici 8.10.1 already contains the upstream fix (commit 7d3cf924, \"fix: validate blob body content type\"). The blob-like body branch in lib/dispatcher/client-h1.js now runs isValidHeaderValue() on body.type before pushing content-type, and rejects the request on failure.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-15157" }, "impact_statement": "not_affected \u2014 Not affected. undici 8.10.1 already contains the upstream fix (commit 7d3cf924, \"fix: validate blob body content type\"). The blob-like body branch in lib/dispatcher/client-h1.js now runs isValidHeaderValue() on body.type before pushing content-type, and rejects the request on failure." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T21:56:00.146677+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 8.10.1 of undici. not_affected \u2014 Target undici 8.10.1 already contains the upstream fix for CVE-2026-1525 (commit 74495c63, \"fix: reject duplicate content-length and host headers\"). processHeader in lib/core/request.js lowercases the header name and throws InvalidArgumentError('duplicate content-length header') if a content-length was already recorded. Case-variant duplicates in a flat header array therefore cannot reach the w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 Target undici 8.10.1 already contains the upstream fix for CVE-2026-1525 (commit 74495c63, \"fix: reject duplicate content-length and host headers\"). processHeader in lib/core/request.js lowercases the header name and throws InvalidArgumentError('duplicate content-length header') if a content-length was already recorded. Case-variant duplicates in a flat header array therefore cannot reach the w..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 8.10.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T22:13:50.517753+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 8.10.1 of undici. not_affected \u2014 undici 8.10.1 already contains the upstream CVE-2026-1527 fix. Request construction in lib/core/request.js rejects any `upgrade` value with characters invalid in a header value (CR/LF included) before it reaches the CRLF-interpolating write in client-h1.js. The fix is upstream commit 77594f92 (\"fix: validate upgrade header to prevent CRLF injection\"), which is an ancestor of HEAD and shipped in...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 undici 8.10.1 already contains the upstream CVE-2026-1527 fix. Request construction in lib/core/request.js rejects any `upgrade` value with characters invalid in a header value (CR/LF included) before it reaches the CRLF-interpolating write in client-h1.js. The fix is upstream commit 77594f92 (\"fix: validate upgrade header to prevent CRLF injection\"), which is an ancestor of HEAD and shipped in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T22:02:00.042261+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 8.10.1 of undici. not_affected \u2014 undici 8.10.1 already contains the upstream fix for CVE-2026-1528 (nodejs/undici commit 84235c62, \"Fix websocket 64-bit length overflow\"). The ByteParser PAYLOADLENGTH_64 state rejects any frame whose upper 32 bits are nonzero or whose lower 32 bits exceed 2^31-1, and fails the connection with close code 1009 instead of doing overflowing arithmetic. The fix shipped in the upstream release, so t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 undici 8.10.1 already contains the upstream fix for CVE-2026-1528 (nodejs/undici commit 84235c62, \"Fix websocket 64-bit length overflow\"). The ByteParser PAYLOADLENGTH_64 state rejects any frame whose upper 32 bits are nonzero or whose lower 32 bits exceed 2^31-1, and fails the connection with close code 1009 instead of doing overflowing arithmetic. The fix shipped in the upstream release, so t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T20:04:00.059662+00:00", "status_notes": "Vulnerability CVE-2026-16728 does not affect version 8.10.1 of undici. not_affected \u2014 Target undici 8.10.1 already contains the upstream fix e11a68ed (fix(retry): reject partial content length mismatch, Matteo Collina). A 206 whose Content-Length disagrees with its Content-Range is rejected with RequestRetryError before headers are forwarded. The fix shipped in the upstream release, and HEAD has no TuxCare-domain commits, so this is an upstream fix and the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16728" }, "impact_statement": "not_affected \u2014 Target undici 8.10.1 already contains the upstream fix e11a68ed (fix(retry): reject partial content length mismatch, Matteo Collina). A 206 whose Content-Length disagrees with its Content-Range is rejected with RequestRetryError before headers are forwarded. The fix shipped in the upstream release, and HEAD has no TuxCare-domain commits, so this is an upstream fix and the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T20:07:00.106745+00:00", "status_notes": "Vulnerability CVE-2026-16729 does not affect version 8.10.1 of undici. not_affected \u2014 undici 8.10.1 already contains the upstream fix for CVE-2026-16729. The upstream commit 10d93fc3 (\"fix: harden cookie domain, path, and unparsed attribute validation\") is an ancestor of HEAD and was part of the upstream 8.10.1 release. Its author is maitken033380023@gmail.com and its committer is hello@matteocollina.com, neither a TuxCare identity. validateCookieDomain now whitelists RFC 1034 l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16729" }, "impact_statement": "not_affected \u2014 undici 8.10.1 already contains the upstream fix for CVE-2026-16729. The upstream commit 10d93fc3 (\"fix: harden cookie domain, path, and unparsed attribute validation\") is an ancestor of HEAD and was part of the upstream 8.10.1 release. Its author is maitken033380023@gmail.com and its committer is hello@matteocollina.com, neither a TuxCare identity. validateCookieDomain now whitelists RFC 1034 l..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 8.10.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T21:44:51.271214+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 8.10.1 of undici. not_affected \u2014 undici 8.10.1 already contains the upstream fix for CVE-2026-22036. Both the fetch() response decoder and the decompress interceptor reject Content-Encoding lists longer than 5 entries before any decompression stage is built. The fix is upstream commit b04e3cbb by Matteo Collina. It ships in the upstream release, and the only commit on top of that release is a TuxCare build-config commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 undici 8.10.1 already contains the upstream fix for CVE-2026-22036. Both the fetch() response decoder and the decompress interceptor reject Content-Encoding lists longer than 5 entries before any decompression stage is built. The fix is upstream commit b04e3cbb by Matteo Collina. It ships in the upstream release, and the only commit on top of that release is a TuxCare build-config commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 8.10.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-14T01:38:12.022050+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 8.10.1 of undici. not_affected \u2014 The target (undici 8.10.1) already contains the upstream fix commit 5890c7b7 (\"stream response chunks to waiting handlers\") by Matteo Collina, so the full-body accumulation pattern from CVE-2026-2581 is gone. The fix is part of the upstream release, and HEAD has no TuxCare-domain commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 The target (undici 8.10.1) already contains the upstream fix commit 5890c7b7 (\"stream response chunks to waiting handlers\") by Matteo Collina, so the full-body accumulation pattern from CVE-2026-2581 is gone. The fix is part of the upstream release, and HEAD has no TuxCare-domain commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T19:59:36.292466+00:00", "status_notes": "Vulnerability CVE-2026-6733 does not affect version 8.10.1 of undici. not_affected \u2014 Target undici 8.10.1 already contains the upstream fix for this response-queue-poisoning issue (GHSA-35p6-xmwp-9g52, upstream commits 6ea54ef8 / f4c31d60 plus follow-ups c9fbe9d2, ac5394b8, 8c9182eb). The fix shipped in the upstream release, so the vulnerable pattern is absent. The commits are upstream-authored (Matteo Collina) and are ancestors of HEAD. HEAD's only TuxCare commit is a tuxcare....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6733" }, "impact_statement": "not_affected \u2014 Target undici 8.10.1 already contains the upstream fix for this response-queue-poisoning issue (GHSA-35p6-xmwp-9g52, upstream commits 6ea54ef8 / f4c31d60 plus follow-ups c9fbe9d2, ac5394b8, 8c9182eb). The fix shipped in the upstream release, so the vulnerable pattern is absent. The commits are upstream-authored (Matteo Collina) and are ancestors of HEAD. HEAD's only TuxCare commit is a tuxcare...." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T20:10:07.561437+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 8.10.1 of undici. not_affected \u2014 Target undici 8.10.1 already contains the upstream fix for CVE-2026-6734. Socks5ProxyAgent keeps a Map of Pools keyed by origin and builds each Pool's SOCKS5 connect function from that origin. The fix commit a516f870 (author deepview-autofix, not TuxCare) shipped in the upstream release onboarded by TuxCare. The vendor patch diffs were not available (URLs only), so this was assessed from the CV...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Target undici 8.10.1 already contains the upstream fix for CVE-2026-6734. Socks5ProxyAgent keeps a Map of Pools keyed by origin and builds each Pool's SOCKS5 connect function from that origin. The fix commit a516f870 (author deepview-autofix, not TuxCare) shipped in the upstream release onboarded by TuxCare. The vendor patch diffs were not available (URLs only), so this was assessed from the CV..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-09-29T18:27:17.765346+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-10-15T12:23:19.034848+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-09-29T18:27:17.765346+00:00", "status_notes": "Vulnerability CVE-2026-85152 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-85152" }, "action_statement": "Vulnerability CVE-2026-85152 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-10-16T20:08:00.152629+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 8.10.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-10-16T20:08:00.152629+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 8.10.1 of undici.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 8.10.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-14T02:00:10.066773+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 8.10.1 of undici. not_affected \u2014 undici 8.10.1 already contains the upstream fix for CVE-2026-9675. Commit b4c287b3 (\"fix(websocket): enforce max payload size across fragments\") is an ancestor of HEAD. Receiver.#validatePayloadLength now adds the bytes of already-buffered fragments (#fragmentsBytes) to each new frame's payload length and fails the connection with close code 1009 when the sum exceeds maxPayloadSize. The fix was...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 undici 8.10.1 already contains the upstream fix for CVE-2026-9675. Commit b4c287b3 (\"fix(websocket): enforce max payload size across fragments\") is an ancestor of HEAD. Receiver.#validatePayloadLength now adds the bytes of already-buffered fragments (#fragmentsBytes) to each new frame's payload length and fails the connection with close code 1009 when the sum exceeds maxPayloadSize. The fix was..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T20:11:32.988243+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 8.10.1 of undici. not_affected \u2014 Undici 8.10.1 already contains the upstream fix for CVE-2026-9678. Upstream commit cb105d7c (\"fix(cache): trim qualified field names\", Matteo Collina) is an ancestor of HEAD. The Cache-Control parser trims optional whitespace from each qualified private/no-cache field name, so padded names like `private=\" authorization\"` and `no-cache=\"\\tauthorization\"` now become `authorization` and match the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Undici 8.10.1 already contains the upstream fix for CVE-2026-9678. Upstream commit cb105d7c (\"fix(cache): trim qualified field names\", Matteo Collina) is an ancestor of HEAD. The Cache-Control parser trims optional whitespace from each qualified private/no-cache field name, so padded names like `private=\" authorization\"` and `no-cache=\"\\tauthorization\"` now become `authorization` and match the ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T20:02:00.043521+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 8.10.1 of undici. not_affected \u2014 undici 8.10.1 is not affected by CVE-2026-9679. parseSetCookie in lib/web/cookies/parse.js returns the cookie value verbatim, with no percent-decoding. The querystring unescape import is gone. The upstream fix, 5655ea43 (\"fix(cookies): preserve values and parse SameSite strictly\", author hello@matteocollina.com), is an ancestor of HEAD. HEAD's history has no TuxCare-domain commits, so the fix c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 undici 8.10.1 is not affected by CVE-2026-9679. parseSetCookie in lib/web/cookies/parse.js returns the cookie value verbatim, with no percent-decoding. The querystring unescape import is gone. The upstream fix, 5655ea43 (\"fix(cookies): preserve values and parse SameSite strictly\", author hello@matteocollina.com), is an ancestor of HEAD. HEAD's history has no TuxCare-domain commits, so the fix c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.10.1", "identifiers": { "purl": "pkg:npm/undici@8.10.1" } } ], "timestamp": "2026-11-13T20:14:00.045604+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 8.10.1 of undici. not_affected \u2014 Target is undici 8.10.1, which already contains the upstream fix 42d4955 (\"fix: honor requestTls when proxy is SOCKS5\"). ProxyAgent forwards requestTls to Socks5ProxyAgent, and Socks5ProxyAgent applies it in the TLS upgrade over the SOCKS5 tunnel. The fix shipped in the upstream release, so this is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 Target is undici 8.10.1, which already contains the upstream fix 42d4955 (\"fix: honor requestTls when proxy is SOCKS5\"). ProxyAgent forwards requestTls to Socks5ProxyAgent, and Socks5ProxyAgent applies it in the TLS upgrade over the SOCKS5 tunnel. The fix shipped in the upstream release, so this is not a TuxCare backport." } ] }