{
  "@id": "urn:uuid:b4a6c301-8ca4-4212-84ec-1b5f7a552264",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 51,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T04:51:00.084155+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 8.11.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T00:08:46.068181+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 8.11.2 of undici. not_affected \u2014 Not affected. The target (undici 8.11.2) already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, fetch's redirect handling deletes the cookie and host headers along with authorization and proxy-authorization. The fix commit e041de35 is an ancestor of HEAD and was authored by an upstream contributor.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 Not affected. The target (undici 8.11.2) already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, fetch's redirect handling deletes the cookie and host headers along with authorization and proxy-authorization. The fix commit e041de35 is an ancestor of HEAD and was authored by an upstream contributor."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "action_statement": "Vulnerability CVE-2024-24750 affects version 8.11.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:24:00.043562+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 8.11.2 of undici. not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2024-24758. Both cross-origin redirect paths (fetch and the dispatcher RedirectHandler) strip proxy-authorization. The fix commit b9da3e40 is by an upstream author, is an ancestor of HEAD, and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2024-24758. Both cross-origin redirect paths (fetch and the dispatcher RedirectHandler) strip proxy-authorization. The fix commit b9da3e40 is by an upstream author, is an ancestor of HEAD, and shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T00:37:00.098335+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 does not affect version 8.11.2 of undici. not_affected \u2014 Not affected. The redirect handler (lib/handler/redirect-handler.js) already drops authorization, cookie and proxy-authorization headers whenever a redirect crosses origins, for the request()/dispatch path as well as fetch(). The upstream fix commit 6805746 is an ancestor of HEAD and shipped in the upstream release this branch is based on.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "impact_statement": "not_affected \u2014 Not affected. The redirect handler (lib/handler/redirect-handler.js) already drops authorization, cookie and proxy-authorization headers whenever a redirect crosses origins, for the request()/dispatch path as well as fetch(). The upstream fix commit 6805746 is an ancestor of HEAD and shipped in the upstream release this branch is based on."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T23:43:31.449960+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 8.11.2 of undici. not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd by Matteo Collina). The SRI check is implemented in lib/web/subresource-integrity/subresource-integrity.js. It follows the current spec: invalid algorithm tokens are dropped, the strongest algorithm is chosen by index, and the body hash is compared against every entry of that algorithm. The ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd by Matteo Collina). The SRI check is implemented in lib/web/subresource-integrity/subresource-integrity.js. It follows the current spec: invalid algorithm tokens are dropped, the strongest algorithm is chosen by index, and the body hash is compared against every entry of that algorithm. The ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 8.11.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:32:55.414966+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 does not affect version 8.11.2 of undici. not_affected \u2014 Target (undici 8.11.2) already contains the upstream fix for CVE-2025-22150. The multipart/form-data boundary is built from node:crypto randomInt when the crypto runtime feature is available, not from Math.random. The Math.random fallback is used only when crypto is unavailable, and that fallback is the same one the upstream fix keeps. The fix, upstream commit c2d78cd1 by Matteo Collina, is in ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "impact_statement": "not_affected \u2014 Target (undici 8.11.2) already contains the upstream fix for CVE-2025-22150. The multipart/form-data boundary is built from node:crypto randomInt when the crypto runtime feature is available, not from Math.random. The Math.random fallback is used only when crypto is unavailable, and that fallback is the same one the upstream fix keeps. The fix, upstream commit c2d78cd1 by Matteo Collina, is in ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:39:00.116210+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 does not affect version 8.11.2 of undici. not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e, \"Removed clients with unrecoverable errors from the Pool\"). lib/dispatcher/pool.js registers a 'connectionError' listener that removes the failed Client from this[kClients], so failed clients no longer accumulate on repeated TLS/connect failures. The fix shipped in the upstream release a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e, \"Removed clients with unrecoverable errors from the Pool\"). lib/dispatcher/pool.js registers a 'connectionError' listener that removes the failed Client from this[kClients], so failed clients no longer accumulate on repeated TLS/connect failures. The fix shipped in the upstream release a..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:22:00.069315+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:22:00.069315+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:23:00.084126+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "action_statement": "Vulnerability CVE-2026-109841 affects version 8.11.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T03:02:00.070879+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 does not affect version 8.11.2 of undici. not_affected \u2014 Target is undici 8.11.2, which already includes the upstream fix dd28c5c5 (\"close rejected HTTP/2 WebSocket handshake streams\"). Every handshake-validation failure in connection.js now goes through failHandshake(), which destroys the leaked ClientHttp2Stream before failing the connection. The fix shipped in the upstream release, so this is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.11.2, which already includes the upstream fix dd28c5c5 (\"close rejected HTTP/2 WebSocket handshake streams\"). Every handshake-validation failure in connection.js now goes through failHandshake(), which destroys the leaked ClientHttp2Stream before failing the connection. The fix shipped in the upstream release, so this is not_affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:22:00.069315+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:22:00.069315+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "action_statement": "Vulnerability CVE-2026-109924 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:08:00.152629+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 8.11.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T03:25:41.019819+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 does not affect version 8.11.2 of undici. not_affected \u2014 Target (undici 8.11.2) already contains the upstream fix 5655ea43 (\"fix(cookies): preserve values and parse SameSite strictly\"). parseUnparsedAttributes in lib/web/cookies/parse.js compares the lowercased SameSite value for exact equality with 'none'/'strict'/'lax', so substring values such as NoneOfYourBusiness or StrictLax are ignored instead of being mapped to a weaker token.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "impact_statement": "not_affected \u2014 Target (undici 8.11.2) already contains the upstream fix 5655ea43 (\"fix(cookies): preserve values and parse SameSite strictly\"). parseUnparsedAttributes in lib/web/cookies/parse.js compares the lowercased SameSite value for exact equality with 'none'/'strict'/'lax', so substring values such as NoneOfYourBusiness or StrictLax are ignored instead of being mapped to a weaker token."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:20:57.098620+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "action_statement": "Vulnerability CVE-2026-116630 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "action_statement": "Vulnerability CVE-2026-120222 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "action_statement": "Vulnerability CVE-2026-120415 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "action_statement": "Vulnerability CVE-2026-120423 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:06:35.912230+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "action_statement": "Vulnerability CVE-2026-120474 affects version 8.11.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T04:51:00.084155+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 does not affect version 8.11.2 of undici. not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2026-12151. Upstream commits 32dbf0b3 and c5ed7875 (Luigi Pinca) cap the number of fragments per WebSocket message. The cap defaults to 131072 and is enforced on both the plain and permessage-deflate receive paths. Both WebSocket and WebSocketStream pass the option to the Receiver. The fix shipped in the upstream release; HEAD has no TuxCa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2026-12151. Upstream commits 32dbf0b3 and c5ed7875 (Luigi Pinca) cap the number of fragments per WebSocket message. The cap defaults to 131072 and is enforced on both the plain and permessage-deflate receive paths. Both WebSocket and WebSocketStream pass the option to the Receiver. The fix shipped in the upstream release; HEAD has no TuxCa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T03:42:00.066874+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 does not affect version 8.11.2 of undici. not_affected \u2014 undici 8.11.2 already contains the upstream fix (fixed upstream in 8.9.0). parseCacheControlHeader in lib/util/cache.js turns empty or invalid qualified private/no-cache field lists into `true` and never calls concat on an existing `true`. The shared-cache guard therefore rejects `private=\"\"` and `private=\",\"`, and the mixed-directive TypeError cannot occur. The fix came from upstream commit c6...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.2 already contains the upstream fix (fixed upstream in 8.9.0). parseCacheControlHeader in lib/util/cache.js turns empty or invalid qualified private/no-cache field lists into `true` and never calls concat on an existing `true`. The shared-cache guard therefore rejects `private=\"\"` and `private=\",\"`, and the mixed-directive TypeError cannot occur. The fix came from upstream commit c6..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T04:03:00.047241+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 does not affect version 8.11.2 of undici. not_affected \u2014 Not affected. Target (undici 8.11.2) already contains the upstream fix for CVE-2026-14643. parseCacheControlHeader trims OWS around '=' and around quoted field names, so `no-cache =\"authorization\"` and `no-cache= \"authorization\"` yield ['authorization'], which canCacheResponse then uses to refuse shared-cache storage of authenticated responses. The fix commits (c601fff1, cb105d7c) are upstream-...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "impact_statement": "not_affected \u2014 Not affected. Target (undici 8.11.2) already contains the upstream fix for CVE-2026-14643. parseCacheControlHeader trims OWS around '=' and around quoted field names, so `no-cache =\"authorization\"` and `no-cache= \"authorization\"` yield ['authorization'], which canCacheResponse then uses to refuse shared-cache storage of authenticated responses. The fix commits (c601fff1, cb105d7c) are upstream-..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T04:47:17.663362+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 does not affect version 8.11.2 of undici. not_affected \u2014 Target undici 8.11.2 already contains the upstream fix. In lib/dispatcher/client-h1.js the blob-like body branch validates body.type with util.isValidHeaderValue() before pushing content-type, and rejects the request with InvalidArgumentError when the value is invalid. The fix is upstream commit 7d3cf924 (Matteo Collina), which is part of the upstream v8.11.2 release and predates the only TuxCa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.11.2 already contains the upstream fix. In lib/dispatcher/client-h1.js the blob-like body branch validates body.type with util.isValidHeaderValue() before pushing content-type, and rejects the request with InvalidArgumentError when the value is invalid. The fix is upstream commit 7d3cf924 (Matteo Collina), which is part of the upstream v8.11.2 release and predates the only TuxCa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:55:00.126819+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 does not affect version 8.11.2 of undici. not_affected \u2014 Not affected. undici 8.11.2 already contains the upstream fix for CVE-2026-1525. The fix is nodejs/undici commit 74495c63 (\"fix: reject duplicate content-length and host headers\", authored by Matteo Collina). It shipped inside the upstream release, before the first TuxCare commit. processHeader() in lib/core/request.js lowercases the header name and throws on a second content-length header, so ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "impact_statement": "not_affected \u2014 Not affected. undici 8.11.2 already contains the upstream fix for CVE-2026-1525. The fix is nodejs/undici commit 74495c63 (\"fix: reject duplicate content-length and host headers\", authored by Matteo Collina). It shipped inside the upstream release, before the first TuxCare commit. processHeader() in lib/core/request.js lowercases the header name and throws on a second content-length header, so ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 8.11.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:12:00.040260+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 does not affect version 8.11.2 of undici. not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2026-1527. Request construction rejects any `upgrade` value containing invalid header characters, including CR and LF, before it can reach the header serialization in client-h1.js. The fix came in with the upstream release, not from a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2026-1527. Request construction rejects any `upgrade` value containing invalid header characters, including CR and LF, before it can reach the header serialization in client-h1.js. The fix came in with the upstream release, not from a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:07:31.350927+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 does not affect version 8.11.2 of undici. not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2026-1528 (Matteo Collina's commit 84235c62, \"Fix websocket 64-bit length overflow\"). The fix is part of the upstream release and HEAD has no TuxCare commits. The 64-bit payload-length handler in lib/web/websocket/receiver.js rejects any length with a non-zero upper 32 bits, or a lower half above 2^31-1, by failing the connection with code...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2026-1528 (Matteo Collina's commit 84235c62, \"Fix websocket 64-bit length overflow\"). The fix is part of the upstream release and HEAD has no TuxCare commits. The 64-bit payload-length handler in lib/web/websocket/receiver.js rejects any length with a non-zero upper 32 bits, or a lower half above 2^31-1, by failing the connection with code..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T03:48:00.037960+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 does not affect version 8.11.2 of undici. not_affected \u2014 Undici 8.11.2 already contains the upstream fix (commit e11a68ed, \"fix(retry): reject partial content length mismatch\"). It ships in the upstream release, so the target is not affected. The retry handler rejects a 206 response whose Content-Length differs from the length implied by Content-Range. The check runs before response headers reach the application, so the stale Content-Length 300 versu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "impact_statement": "not_affected \u2014 Undici 8.11.2 already contains the upstream fix (commit e11a68ed, \"fix(retry): reject partial content length mismatch\"). It ships in the upstream release, so the target is not affected. The retry handler rejects a 206 response whose Content-Length differs from the length implied by Content-Range. The check runs before response headers reach the application, so the stale Content-Length 300 versu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T04:01:00.041330+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 does not affect version 8.11.2 of undici. not_affected \u2014 undici 8.11.2 already contains the upstream fix (nodejs/undici 10d93fc, \"harden cookie domain, path, and unparsed attribute validation\"). validateCookieDomain enforces RFC 1034 letter-digit-hyphen syntax, so ';' is rejected. Each unparsed entry has its name and value validated, and validateCookieValue rejects ';'. The fix shipped in the upstream release, and the history has no TuxCare-domain co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.2 already contains the upstream fix (nodejs/undici 10d93fc, \"harden cookie domain, path, and unparsed attribute validation\"). validateCookieDomain enforces RFC 1034 letter-digit-hyphen syntax, so ';' is rejected. Each unparsed entry has its name and value validated, and validateCookieValue rejects ';'. The fix shipped in the upstream release, and the history has no TuxCare-domain co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:57:30.897255+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 does not affect version 8.11.2 of undici. not_affected \u2014 The target is undici 8.11.2 and already contains the upstream fix e905b5b8 (\"fix(retry): settle exposed body on terminal failure\"). It was authored by Matteo Collina and shipped in the upstream release. RetryHandler now forwards a terminal error to the consumer instead of dropping the retry's response and leaving the original body pending.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "impact_statement": "not_affected \u2014 The target is undici 8.11.2 and already contains the upstream fix e905b5b8 (\"fix(retry): settle exposed body on terminal failure\"). It was authored by Matteo Collina and shipped in the upstream release. RetryHandler now forwards a terminal error to the consumer instead of dropping the retry's response and leaving the original body pending."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:59:47.836927+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 does not affect version 8.11.2 of undici. not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2026-18540 (commit 0160a719, \"fix(retry): validate resumed response framing\"). The fix ships in the upstream release and is authored by Matteo Collina. No TuxCare-domain commit exists in HEAD's history, so this is an upstream fix and the target is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2026-18540 (commit 0160a719, \"fix(retry): validate resumed response framing\"). The fix ships in the upstream release and is authored by Matteo Collina. No TuxCare-domain commit exists in HEAD's history, so this is an upstream fix and the target is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:08:37.118467+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 does not affect version 8.11.2 of undici. not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2026-19534 (commit 66e12816, \"fix(websocket): reject unrequested subprotocols\"). In lib/web/websocket/connection.js, the opening-handshake check is now `requestProtocols === null || !requestProtocols.includes(secProtocol)`. An unrequested Sec-WebSocket-Protocol therefore goes to failHandshake with close code 1002 instead of throwing a Type...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2026-19534 (commit 66e12816, \"fix(websocket): reject unrequested subprotocols\"). In lib/web/websocket/connection.js, the opening-handshake check is now `requestProtocols === null || !requestProtocols.includes(secProtocol)`. An unrequested Sec-WebSocket-Protocol therefore goes to failHandshake with close code 1002 instead of throwing a Type..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:46:00.052523+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 does not affect version 8.11.2 of undici. not_affected \u2014 The target (undici 8.11.2) already contains the upstream fix for CVE-2026-22036 (commit b04e3cbb by Matteo Collina). Both fetch() and the decompress interceptor reject responses with more than 5 Content-Encoding codings before building the decoder chain. The fix is part of the upstream release, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "impact_statement": "not_affected \u2014 The target (undici 8.11.2) already contains the upstream fix for CVE-2026-22036 (commit b04e3cbb by Matteo Collina). Both fetch() and the decompress interceptor reject responses with more than 5 Content-Encoding codings before building the decoder chain. The fix is part of the upstream release, so the verdict is not_affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 8.11.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T01:43:58.135819+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 does not affect version 8.11.2 of undici. not_affected \u2014 Target (undici 8.11.2) already contains the upstream fix for CVE-2026-2581. The patch commit 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\") is an ancestor of HEAD and is part of the upstream release. DeduplicationHandler streams each chunk to waiting handlers and refuses late attachment once body data has started. Buffering is bounded only for paused consumers.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "impact_statement": "not_affected \u2014 Target (undici 8.11.2) already contains the upstream fix for CVE-2026-2581. The patch commit 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\") is an ancestor of HEAD and is part of the upstream release. DeduplicationHandler streams each chunk to waiting handlers and refuses late attachment once body data has started. Buffering is bounded only for paused consumers."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T03:28:00.049541+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 does not affect version 8.11.2 of undici. not_affected \u2014 The upstream fix for CVE-2026-6733 is already in the shipped release (undici 8.11.2, past the fixed 8.5.0). Before a reused keep-alive socket carries the next request, the client now yields once so that bytes the server sent while idle are parsed against an empty request queue. Parsing then fails with 'bad response' and the socket is destroyed. The fix commit is upstream-authored and no TuxCare...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-6733 is already in the shipped release (undici 8.11.2, past the fixed 8.5.0). Before a reused keep-alive socket carries the next request, the client now yields once so that bytes the server sent while idle are parsed against an empty request queue. Parsing then fails with 'bad response' and the socket is destroyed. The fix commit is upstream-authored and no TuxCare..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T03:50:29.950665+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 does not affect version 8.11.2 of undici. not_affected \u2014 Not affected. Socks5ProxyAgent in this target (v8.11.2) already keeps one Pool per origin in a Map. The upstream fix a516f870 (\"use per-origin pools to prevent cross-origin routing\") is an ancestor of HEAD, and so are the later pool eviction and closed-pool handling. The fix shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "impact_statement": "not_affected \u2014 Not affected. Socks5ProxyAgent in this target (v8.11.2) already keeps one Pool per origin in a Map. The upstream fix a516f870 (\"use per-origin pools to prevent cross-origin routing\") is an ancestor of HEAD, and so are the later pool eviction and closed-pool handling. The fix shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:51:00.036177+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 does not affect version 8.11.2 of undici. not_affected \u2014 The upstream fix for CVE-2026-84890 (commit 7aac7f12, \"fix(decompress): limit decompressed response size\", by Matteo Collina) is already in the target (v8.11.2) as shipped upstream. lib/interceptor/decompress.js has a maxSize option that is enforced on the final decoder output and on every intermediate stage of a multi-layer chain. Over-limit output is rejected with ResponseExceededMaxSizeError...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-84890 (commit 7aac7f12, \"fix(decompress): limit decompressed response size\", by Matteo Collina) is already in the target (v8.11.2) as shipped upstream. lib/interceptor/decompress.js has a maxSize option that is enforced on the final decoder output and on every intermediate stage of a multi-layer chain. Over-limit output is rejected with ResponseExceededMaxSizeError..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:45:32.817100+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 does not affect version 8.11.2 of undici. not_affected \u2014 Target is undici 8.11.2. It already contains the upstream fix for CVE-2026-84933 (upstream commit cb75bbb3, \"fix(cache): do not cache Set-Cookie in shared caches\", by Matteo Collina). The fix shipped in the upstream release that TuxCare onboarded, so this is an upstream fix and the target is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.11.2. It already contains the upstream fix for CVE-2026-84933 (upstream commit cb75bbb3, \"fix(cache): do not cache Set-Cookie in shared caches\", by Matteo Collina). The fix shipped in the upstream release that TuxCare onboarded, so this is an upstream fix and the target is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:24:00.044920+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 does not affect version 8.11.2 of undici. not_affected \u2014 Target undici 8.11.2 already contains the upstream fix for CVE-2026-84947 (commit 6d583124, \"fix(interceptor/dump): abort oversized chunked responses\"). The fix shipped in the upstream release, so the vulnerable early-end pattern is absent from lib/interceptor/dump.js.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.11.2 already contains the upstream fix for CVE-2026-84947 (commit 6d583124, \"fix(interceptor/dump): abort oversized chunked responses\"). The fix shipped in the upstream release, so the vulnerable early-end pattern is absent from lib/interceptor/dump.js."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:40:43.690916+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 does not affect version 8.11.2 of undici. not_affected \u2014 Target (undici 8.11.2) already contains the upstream fix for the BalancedPool JSON-clone bug. The constructor destructures connect and tls out of the options before the deep clone and re-attaches them afterwards, so function-valued TLS options (checkServerIdentity, custom connector) reach each per-upstream Pool. The fix commits are upstream-authored and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "impact_statement": "not_affected \u2014 Target (undici 8.11.2) already contains the upstream fix for the BalancedPool JSON-clone bug. The constructor destructures connect and tls out of the options before the deep clone and re-attaches them afterwards, so function-valued TLS options (checkServerIdentity, custom connector) reach each per-upstream Pool. The fix commits are upstream-authored and shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:35:00.099220+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 does not affect version 8.11.2 of undici. not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2026-85008 (nodejs/undici commit 2be07bf9, \"fix(cache): reject unsafe method response caching\"). The fix shipped in the upstream release. HEAD has no TuxCare-domain commit (the only TuxCare-side commit is a tuxcare.yaml build config added by an automation account). Unsafe methods are neither looked up in the cache nor stored, and successfu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2026-85008 (nodejs/undici commit 2be07bf9, \"fix(cache): reject unsafe method response caching\"). The fix shipped in the upstream release. HEAD has no TuxCare-domain commit (the only TuxCare-side commit is a tuxcare.yaml build config added by an automation account). Unsafe methods are neither looked up in the cache nor stored, and successfu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:20:00.281753+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 does not affect version 8.11.2 of undici. not_affected \u2014 The target (undici 8.11.2) already contains the upstream fix. On an unclean close, WebSocketStream#onSocketClose errors the writable stream through the retained WritableStreamDefaultController. It does not call abort() on the stream, so a held writer lock cannot produce a discarded TypeError rejection. The fix is upstream commit 662d0ea6 (Matteo Collina), which is an ancestor of HEAD and predat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "impact_statement": "not_affected \u2014 The target (undici 8.11.2) already contains the upstream fix. On an unclean close, WebSocketStream#onSocketClose errors the writable stream through the retained WritableStreamDefaultController. It does not call abort() on the stream, so a held writer lock cannot produce a discarded TypeError rejection. The fix is upstream commit 662d0ea6 (Matteo Collina), which is an ancestor of HEAD and predat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:18:36.754439+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 does not affect version 8.11.2 of undici. not_affected \u2014 Target (undici 8.11.2) already contains the upstream fix. In lib/web/websocket/permessage-deflate.js the size-limit cleanup calls removeAllListeners() and then destroy() on the InflateRaw, so a late Z_DATA_ERROR cannot surface as an unhandled error event. The fix is upstream commit 4411a238 (Matteo Collina, CVE-2026-85024), an ancestor of HEAD. No TuxCare-domain commit exists in history.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "impact_statement": "not_affected \u2014 Target (undici 8.11.2) already contains the upstream fix. In lib/web/websocket/permessage-deflate.js the size-limit cleanup calls removeAllListeners() and then destroy() on the InflateRaw, so a late Z_DATA_ERROR cannot surface as an unhandled error event. The fix is upstream commit 4411a238 (Matteo Collina, CVE-2026-85024), an ancestor of HEAD. No TuxCare-domain commit exists in history."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:42:09.185511+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 does not affect version 8.11.2 of undici. not_affected \u2014 Target is undici 8.11.2, which is past the fixed release 8.10.2. The upstream fix commit caf6194d (\"fix(cache): isolate interceptor state by dispatcher origin\"), authored by Matteo Collina, is an ancestor of HEAD. The cache and deduplicate interceptors now key on the real destination origin, and they bypass caching when no authoritative origin exists. The only TuxCare commit in history is the t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.11.2, which is past the fixed release 8.10.2. The upstream fix commit caf6194d (\"fix(cache): isolate interceptor state by dispatcher origin\"), authored by Matteo Collina, is an ancestor of HEAD. The cache and deduplicate interceptors now key on the real destination origin, and they bypass caching when no authoritative origin exists. The only TuxCare commit in history is the t..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:08:00.152629+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 8.11.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:08:00.152629+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 affects version 8.11.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "action_statement": "Vulnerability CVE-2026-87029 affects version 8.11.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:06:45.296491+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 does not affect version 8.11.2 of undici. not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2026-9675. The fix is in the release itself, so it is an upstream fix and not a TuxCare backport. Receiver.#validatePayloadLength adds the bytes already buffered for the message (#fragmentsBytes) to each new frame's length and fails the connection with 1009 once the total exceeds maxPayloadSize. The fix commits b4c287b3, 32dbf0b3 and c5ed7...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.2 already contains the upstream fix for CVE-2026-9675. The fix is in the release itself, so it is an upstream fix and not a TuxCare backport. Receiver.#validatePayloadLength adds the bytes already buffered for the message (#fragmentsBytes) to each new frame's length and fails the connection with 1009 once the total exceeds maxPayloadSize. The fix commits b4c287b3, 32dbf0b3 and c5ed7..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:13:00.036418+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 does not affect version 8.11.2 of undici. not_affected \u2014 undici 8.11.2 already contains the upstream fix. Qualified private/no-cache field names are trimmed of spaces and tabs before they are stored. The shared-cache check for 'authorization' therefore matches padded values such as private=\" authorization\", and those responses are not stored. The fix commit cb105d7c is Matteo Collina's upstream commit and was already in the v8.11.2 release (7e016ad7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.2 already contains the upstream fix. Qualified private/no-cache field names are trimmed of spaces and tabs before they are stored. The shared-cache check for 'authorization' therefore matches padded values such as private=\" authorization\", and those responses are not stored. The fix commit cb105d7c is Matteo Collina's upstream commit and was already in the v8.11.2 release (7e016ad7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-14T03:30:12.116884+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 does not affect version 8.11.2 of undici. not_affected \u2014 Target is undici 8.11.2. The upstream fix 5655ea43 (\"fix(cookies): preserve values and parse SameSite strictly\"), which removes percent-decoding of cookie values, is already in the shipped upstream release. lib/web/cookies/parse.js no longer decodes cookie values.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.11.2. The upstream fix 5655ea43 (\"fix(cookies): preserve values and parse SameSite strictly\"), which removes percent-decoding of cookie values, is already in the shipped upstream release. lib/web/cookies/parse.js no longer decodes cookie values."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:18:00.067289+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 does not affect version 8.11.2 of undici. not_affected \u2014 The target is undici 8.11.2. It already contains the upstream fix 42d49559 (\"fix: honor requestTls when proxy is SOCKS5\"). ProxyAgent forwards requestTls to Socks5ProxyAgent, and Socks5ProxyAgent applies it in the tls.connect call that upgrades the SOCKS5 tunnel. The fix was authored and committed by non-TuxCare identities and shipped in the upstream release before TuxCare's only commit (a tuxc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "impact_statement": "not_affected \u2014 The target is undici 8.11.2. It already contains the upstream fix 42d49559 (\"fix: honor requestTls when proxy is SOCKS5\"). ProxyAgent forwards requestTls to Socks5ProxyAgent, and Socks5ProxyAgent applies it in the tls.connect call that upgrades the SOCKS5 tunnel. The fix was authored and committed by non-TuxCare identities and shipped in the upstream release before TuxCare's only commit (a tuxc..."
    }
  ]
}