{ "@id": "urn:uuid:aef0bc53-325b-41fa-a241-0041bd66ea2e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 32, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T00:06:08.584527+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-14T00:06:08.584527+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 8.3.0 of undici. not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2023-45143 (commit e041de35). Both the fetch redirect path and the dispatcher redirect handler strip the Cookie header on cross-origin redirects. The fix shipped in the upstream release, not through a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2023-45143 (commit e041de35). Both the fetch redirect path and the dispatcher redirect handler strip the Cookie header on cross-origin redirects. The fix shipped in the upstream release, not through a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T22:22:49.594925+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 8.3.0 of undici. not_affected \u2014 Target undici 8.3.0 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The fix came from the upstream release (merge b9da3e40, GHSA-3787-6prv-h9w3, by Matteo Collina). HEAD contains no commits from an allowlisted TuxCare/CloudLinux domain, so the verdict is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Target undici 8.3.0 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The fix came from the upstream release (merge b9da3e40, GHSA-3787-6prv-h9w3, by Matteo Collina). HEAD contains no commits from an allowlisted TuxCare/CloudLinux domain, so the verdict is not_affected rather than already_fixed." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-30260 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2024-30260" }, "action_statement": "Vulnerability CVE-2024-30260 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T23:34:14.677808+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 8.3.0 of undici. not_affected \u2014 Target undici 8.3.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd, authored by Matteo Collina). The commit is an ancestor of HEAD. The SRI integrity check now follows the spec: it keeps only the strongest-algorithm entries and compares the body against them. No TuxCare-authored commit exists in HEAD's history, so this is an upstream fix and not a Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Target undici 8.3.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd, authored by Matteo Collina). The commit is an ancestor of HEAD. The SRI integrity check now follows the spec: it keeps only the strongest-algorithm entries and compares the body against them. No TuxCare-authored commit exists in HEAD's history, so this is an upstream fix and not a Tux..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T21:31:00.047911+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 8.3.0 of undici. not_affected \u2014 undici 8.3.0 is not affected by CVE-2025-22150. The multipart boundary no longer comes from Math.random() when node:crypto is available. lib/web/fetch/formdata.js uses crypto.randomInt, and the upstream fix commit c2d78cd1 (author hello@matteocollina.com, Matteo Collina) is an ancestor of HEAD. It was already in the upstream release before the first TuxCare commit, so this is an upstream fix an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 undici 8.3.0 is not affected by CVE-2025-22150. The multipart boundary no longer comes from Math.random() when node:crypto is available. lib/web/fetch/formdata.js uses crypto.randomInt, and the upstream fix commit c2d78cd1 (author hello@matteocollina.com, Matteo Collina) is an ancestor of HEAD. It was already in the upstream release before the first TuxCare commit, so this is an upstream fix an..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T21:37:00.197268+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 8.3.0 of undici. not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool registers a 'connectionError' handler that splices failed clients out of the pool's client list, so failed-certificate clients are not retained. The fix shipped in the upstream release the target is built from, and it is not a TuxCare-authored commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool registers a 'connectionError' handler that splices failed clients out of the pool's client list, so failed-certificate clients are not retained. The fix shipped in the upstream release the target is built from, and it is not a TuxCare-authored commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T18:47:21.529900+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:06:00.064776+00:00", "status_notes": "Vulnerability CVE-2026-109855 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-109855" }, "action_statement": "Vulnerability CVE-2026-109855 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T18:29:00.261196+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T18:34:00.250279+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T21:36:16.074202+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-06T10:20:26.750713+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-14643 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-14643" }, "action_statement": "Vulnerability CVE-2026-14643 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T21:51:37.743034+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 8.3.0 of undici. not_affected \u2014 Not affected. undici 8.3.0 already contains the upstream fix (commit 74495c63, Matteo Collina, \"reject duplicate content-length and host headers\"). processHeader() lowercases the header name and throws on a second content-length header, so case-variant duplicates in array-form headers cannot reach the wire.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 Not affected. undici 8.3.0 already contains the upstream fix (commit 74495c63, Matteo Collina, \"reject duplicate content-length and host headers\"). processHeader() lowercases the header name and throws on a second content-length header, so case-variant duplicates in array-form headers cannot reach the wire." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T22:10:09.898362+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 8.3.0 of undici. not_affected \u2014 Target undici 8.3.0 already contains the upstream fix for CVE-2026-1527. Request construction rejects any `upgrade` value containing CR/LF or other invalid header characters before it reaches the socket writer in client-h1.js. The fix is upstream commit 77594f92 (author hello@matteocollina.com), which is an ancestor of HEAD. HEAD has no TuxCare commits in its history, so this is a plain upstrea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 Target undici 8.3.0 already contains the upstream fix for CVE-2026-1527. Request construction rejects any `upgrade` value containing CR/LF or other invalid header characters before it reaches the socket writer in client-h1.js. The fix is upstream commit 77594f92 (author hello@matteocollina.com), which is an ancestor of HEAD. HEAD has no TuxCare commits in its history, so this is a plain upstrea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T22:01:22.274965+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 8.3.0 of undici. not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2026-1528 (upstream commit 84235c62, \"Fix websocket 64-bit length overflow\"). The 64-bit length branch of the WebSocket frame parser rejects any length whose upper 32 bits are non-zero or whose lower 32 bits exceed 2^31-1, and fails the connection with close code 1009. The fix shipped in the upstream release and is not TuxCare-attributed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2026-1528 (upstream commit 84235c62, \"Fix websocket 64-bit length overflow\"). The 64-bit length branch of the WebSocket frame parser rejects any length whose upper 32 bits are non-zero or whose lower 32 bits exceed 2^31-1, and fails the connection with close code 1009. The fix shipped in the upstream release and is not TuxCare-attributed." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T21:44:27.229058+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 8.3.0 of undici. not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2026-22036. Both the fetch() response path and the decompress interceptor reject a Content-Encoding chain longer than 5 before any decoder is built. The fix, upstream commit b04e3cbb, shipped in the upstream release. No TuxCare-domain commit exists in HEAD's history.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2026-22036. Both the fetch() response path and the decompress interceptor reject a Content-Encoding chain longer than 5 before any decoder is built. The fix, upstream commit b04e3cbb, shipped in the upstream release. No TuxCare-domain commit exists in HEAD's history." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2581 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-2581" }, "action_statement": "Vulnerability CVE-2026-2581 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T20:09:50.079453+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 8.3.0 of undici. not_affected \u2014 Socks5ProxyAgent in this undici 8.3.0 tree already uses one Pool per origin, so requests cannot be routed to a pool for a different origin. The upstream fix commit a516f87 (PR #5041) is in HEAD and was in the upstream release before any TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Socks5ProxyAgent in this undici 8.3.0 tree already uses one Pool per origin, so requests cannot be routed to a pool for a different origin. The upstream fix commit a516f87 (PR #5041) is in HEAD and was in the upstream release before any TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:27:17.765346+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-28T21:53:00.082407+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-85152 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-85152" }, "action_statement": "Vulnerability CVE-2026-85152 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9675 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-9675" }, "action_statement": "Vulnerability CVE-2026-9675 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9678 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-9678" }, "action_statement": "Vulnerability CVE-2026-9678 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9679 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-9679" }, "action_statement": "Vulnerability CVE-2026-9679 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9697 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-9697" }, "action_statement": "Vulnerability CVE-2026-9697 affects version 8.3.0 of undici." } ] }