{
  "@id": "urn:uuid:5649c076-8dc0-4e46-a937-e5242975cba8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 34,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T03:08:38.532104+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 8.4.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-14T00:07:00.231663+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 8.4.0 of undici. not_affected \u2014 Undici 8.4.0 already contains the CVE-2023-45143 fix. The cross-origin redirect step in fetch deletes authorization, proxy-authorization, cookie and host headers. The dispatcher-level redirect handler also strips cookie on cross-origin redirects. The fix came from upstream commit e041de3 (GHSA-wqq4-5wpv-mx2g), which is in the upstream release; it is not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 Undici 8.4.0 already contains the CVE-2023-45143 fix. The cross-origin redirect step in fetch deletes authorization, proxy-authorization, cookie and host headers. The dispatcher-level redirect handler also strips cookie on cross-origin redirects. The fix came from upstream commit e041de3 (GHSA-wqq4-5wpv-mx2g), which is in the upstream release; it is not a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "action_statement": "Vulnerability CVE-2024-24750 affects version 8.4.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-13T22:25:04.576492+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 8.4.0 of undici. not_affected \u2014 Target undici 8.4.0 already strips Proxy-Authorization on cross-origin redirects, in both the dispatcher redirect handler and the fetch redirect path. The fix shipped in the upstream release. It was written by upstream authors, and HEAD's history contains no TuxCare-domain commits, so this is not_affected and not already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.4.0 already strips Proxy-Authorization on cross-origin redirects, in both the dispatcher redirect handler and the fetch redirect path. The fix shipped in the upstream release. It was written by upstream authors, and HEAD's history contains no TuxCare-domain commits, so this is not_affected and not already_fixed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-14T00:33:45.023269+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 does not affect version 8.4.0 of undici. not_affected \u2014 Target is undici 8.4.0. The redirect handler already strips authorization, proxy-authorization and cookie headers on cross-origin redirects for every dispatch path, including undici.request(). The upstream fix, commit 6805746 (GHSA-m4v8-wqvr-p9f7 merge), is an ancestor of HEAD. It shipped in the upstream release, and the repo has no TuxCare-domain commits.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.4.0. The redirect handler already strips authorization, proxy-authorization and cookie headers on cross-origin redirects for every dispatch path, including undici.request(). The upstream fix, commit 6805746 (GHSA-m4v8-wqvr-p9f7 merge), is an ancestor of HEAD. It shipped in the upstream release, and the repo has no TuxCare-domain commits."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-13T23:39:00.076832+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 8.4.0 of undici. not_affected \u2014 undici 8.4.0 already contains the upstream CVE-2024-30261 fix. bytesMatch() parses the integrity metadata, selects only the strongest-algorithm entries, and returns true only if the body hash matches one of them. The fix commit d542b8cd is an ancestor of HEAD, was authored upstream by Matteo Collina, and predates any TuxCare commit, so this is an upstream fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 undici 8.4.0 already contains the upstream CVE-2024-30261 fix. bytesMatch() parses the integrity metadata, selects only the strongest-algorithm entries, and returns true only if the body hash matches one of them. The fix commit d542b8cd is an ancestor of HEAD, was authored upstream by Matteo Collina, and predates any TuxCare commit, so this is an upstream fix."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 8.4.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:31:00.047911+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 does not affect version 8.4.0 of undici. not_affected \u2014 undici 8.4.0 already contains the upstream fix for CVE-2025-22150. The multipart boundary is generated with node:crypto randomInt instead of Math.random(). The fix shipped in the upstream release (upstream commit c2d78cd1, author hello@matteocollina.com).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "impact_statement": "not_affected \u2014 undici 8.4.0 already contains the upstream fix for CVE-2025-22150. The multipart boundary is generated with node:crypto randomInt instead of Math.random(). The fix shipped in the upstream release (upstream commit c2d78cd1, author hello@matteocollina.com)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:38:00.122263+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 does not affect version 8.4.0 of undici. not_affected \u2014 undici 8.4.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool registers a 'connectionError' listener that removes failed clients from the pool's client list, so failed-certificate connections are not retained. The fix is in the upstream release and no TuxCare-domain commit carries it, so it is an upstream fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "impact_statement": "not_affected \u2014 undici 8.4.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool registers a 'connectionError' listener that removes failed clients from the pool's client list, so failed-certificate connections are not retained. The fix is in the upstream release and no TuxCare-domain commit carries it, so it is an upstream fix."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-10-15T18:44:00.132301+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-10-15T18:46:33.687871+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-10-15T18:46:33.687871+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "action_statement": "Vulnerability CVE-2026-109841 affects version 8.4.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-14T03:08:38.532104+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 does not affect version 8.4.0 of undici. not_affected \u2014 Target is undici 8.4.0. CVE-2026-109855 is a regression introduced in 8.11.0 (affecting 8.11.0 and 8.11.1). In the 8.4.0 HTTP/2 WebSocket upgrade path the request is never marked completed, so a handshake-failure abort still closes the HTTP/2 stream. The specific no-op-abort defect is absent. I could not read the upstream diff (only a URL was supplied), so this rests on the CVE text and code in...",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.4.0. CVE-2026-109855 is a regression introduced in 8.11.0 (affecting 8.11.0 and 8.11.1). In the 8.4.0 HTTP/2 WebSocket upgrade path the request is never marked completed, so a handshake-failure abort still closes the HTTP/2 stream. The specific no-op-abort defect is absent. I could not read the upstream diff (only a URL was supplied), so this rests on the CVE text and code in..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-10-15T18:29:00.261196+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-10-15T18:34:00.250279+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "action_statement": "Vulnerability CVE-2026-109924 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "action_statement": "Vulnerability CVE-2026-11525 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-06T10:20:26.750713+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "action_statement": "Vulnerability CVE-2026-116630 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "action_statement": "Vulnerability CVE-2026-120222 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "action_statement": "Vulnerability CVE-2026-120415 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "action_statement": "Vulnerability CVE-2026-120423 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-06T10:06:35.912230+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "action_statement": "Vulnerability CVE-2026-120474 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "action_statement": "Vulnerability CVE-2026-12151 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "action_statement": "Vulnerability CVE-2026-13697 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "action_statement": "Vulnerability CVE-2026-14643 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "action_statement": "Vulnerability CVE-2026-15157 affects version 8.4.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:51:25.708621+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 does not affect version 8.4.0 of undici. not_affected \u2014 Target undici 8.4.0 already contains the upstream fix for CVE-2026-1525 (commit 74495c63, \"reject duplicate content-length and host headers\"). processHeader in lib/core/request.js lower-cases header names and rejects a second content-length. Content-length is consumed into request.contentLength and not pushed into the wire headers. The fix shipped in the upstream release, and the repo has no Tu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.4.0 already contains the upstream fix for CVE-2026-1525 (commit 74495c63, \"reject duplicate content-length and host headers\"). processHeader in lib/core/request.js lower-cases header names and rejects a second content-length. Content-length is consumed into request.contentLength and not pushed into the wire headers. The fix shipped in the upstream release, and the repo has no Tu..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 8.4.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-13T22:11:00.043442+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 does not affect version 8.4.0 of undici. not_affected \u2014 Undici 8.4.0 already contains the upstream fix for CVE-2026-1527. The Request constructor rejects any non-string `upgrade` value and any value that fails isValidHeaderValue, so CR/LF cannot reach the socket write in client-h1.js. The fix is upstream commit 77594f92 by Matteo Collina. No commit in HEAD's history has a TuxCare/CloudLinux author or committer.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "impact_statement": "not_affected \u2014 Undici 8.4.0 already contains the upstream fix for CVE-2026-1527. The Request constructor rejects any non-string `upgrade` value and any value that fails isValidHeaderValue, so CR/LF cannot reach the socket write in client-h1.js. The fix is upstream commit 77594f92 by Matteo Collina. No commit in HEAD's history has a TuxCare/CloudLinux author or committer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-13T22:01:22.274965+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 does not affect version 8.4.0 of undici. not_affected \u2014 undici 8.4.0 already contains the upstream fix for CVE-2026-1528. The PAYLOADLENGTH_64 state in lib/web/websocket/receiver.js fails the connection with code 1009 when the upper 32 bits are non-zero or the lower 32 bits exceed 2^31-1. The fix is upstream commit 84235c62 (Matteo Collina, \"Fix websocket 64-bit length overflow\"), which is an ancestor of HEAD. HEAD has no TuxCare-domain commit, so t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "impact_statement": "not_affected \u2014 undici 8.4.0 already contains the upstream fix for CVE-2026-1528. The PAYLOADLENGTH_64 state in lib/web/websocket/receiver.js fails the connection with code 1009 when the upper 32 bits are non-zero or the lower 32 bits exceed 2^31-1. The fix is upstream commit 84235c62 (Matteo Collina, \"Fix websocket 64-bit length overflow\"), which is an ancestor of HEAD. HEAD has no TuxCare-domain commit, so t..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "action_statement": "Vulnerability CVE-2026-16728 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "action_statement": "Vulnerability CVE-2026-16729 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "action_statement": "Vulnerability CVE-2026-18149 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "action_statement": "Vulnerability CVE-2026-18540 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "action_statement": "Vulnerability CVE-2026-19534 affects version 8.4.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:44:00.039648+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 does not affect version 8.4.0 of undici. not_affected \u2014 Target undici 8.4.0 already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses whose Content-Encoding lists more than 5 codings. The fix is upstream commit b04e3cbb, which is an ancestor of HEAD and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.4.0 already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses whose Content-Encoding lists more than 5 codings. The fix is upstream commit b04e3cbb, which is an ancestor of HEAD and shipped in the upstream release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 8.4.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-14T01:40:03.504280+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 does not affect version 8.4.0 of undici. not_affected \u2014 The target (undici 8.4.0) already contains the upstream fix 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\"). Chunks are forwarded to waiting handlers as they arrive, late attachment is refused once body data has started, and any per-handler paused buffer is capped. The fix shipped in the upstream release, so this is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "impact_statement": "not_affected \u2014 The target (undici 8.4.0) already contains the upstream fix 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\"). Chunks are forwarded to waiting handlers as they arrive, late attachment is refused once body data has started, and any per-handler paused buffer is capped. The fix shipped in the upstream release, so this is not_affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "action_statement": "Vulnerability CVE-2026-6733 affects version 8.4.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-13T20:10:07.561437+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 does not affect version 8.4.0 of undici. not_affected \u2014 Target undici 8.4.0 already contains the upstream fix for CVE-2026-6734. Socks5ProxyAgent keeps one Pool per origin in a Map, so requests are not routed through the first origin's pool. The fix is upstream commit a516f870 (author deepview-autofix, GitHub noreply). It is an ancestor of HEAD and was shipped in the upstream 8.x release. No TuxCare-domain commit exists on HEAD's first-parent history.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.4.0 already contains the upstream fix for CVE-2026-6734. Socks5ProxyAgent keeps one Pool per origin in a Map, so requests are not routed through the first origin's pool. The fix is upstream commit a516f870 (author deepview-autofix, GitHub noreply). It is an ancestor of HEAD and was shipped in the upstream 8.x release. No TuxCare-domain commit exists on HEAD's first-parent history."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "action_statement": "Vulnerability CVE-2026-84890 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "action_statement": "Vulnerability CVE-2026-84933 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "action_statement": "Vulnerability CVE-2026-84947 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "action_statement": "Vulnerability CVE-2026-84961 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "action_statement": "Vulnerability CVE-2026-85008 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-29T18:27:17.765346+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "action_statement": "Vulnerability CVE-2026-85014 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-10-15T12:23:19.034848+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "action_statement": "Vulnerability CVE-2026-85024 affects version 8.4.0 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-11-14T02:36:29.324890+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 does not affect version 8.4.0 of undici. not_affected \u2014 Target is undici 8.4.0. The CVE says the flaw was introduced in 8.10.0 (affects 8.10.0 and 8.10.1), and this tree predates that change. Here the cache and dedup interceptors always key on the request's own opts.origin and skip caching and deduplication when no origin is present. No key is ever built without an origin, so keys for different origins cannot collide.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.4.0. The CVE says the flaw was introduced in 8.10.0 (affects 8.10.0 and 8.10.1), and this tree predates that change. Here the cache and dedup interceptors always key on the request's own opts.origin and skip caching and deduplication when no origin is present. No key is ever built without an origin, so keys for different origins cannot collide."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-10-15T18:48:04.069265+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "action_statement": "Vulnerability CVE-2026-87029 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "action_statement": "Vulnerability CVE-2026-9675 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "action_statement": "Vulnerability CVE-2026-9678 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "action_statement": "Vulnerability CVE-2026-9679 affects version 8.4.0 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.0",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 affects version 8.4.0 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "action_statement": "Vulnerability CVE-2026-9697 affects version 8.4.0 of undici."
    }
  ]
}