{
  "@id": "urn:uuid:e0aba206-2ad0-480e-96d9-b412e40efb91",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 34,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T03:10:45.899296+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 8.4.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-14T00:07:00.231663+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 8.4.1 of undici. not_affected \u2014 Target undici 8.4.1 already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, fetch's httpRedirectFetch deletes authorization, proxy-authorization, cookie and host headers (lib/web/fetch/index.js:1350-1360). The dispatcher-level redirect handler also strips cookie on cross-origin redirects (lib/handler/redirect-handler.js:168-170). The fix commit e041de35 (author maitken...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.4.1 already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, fetch's httpRedirectFetch deletes authorization, proxy-authorization, cookie and host headers (lib/web/fetch/index.js:1350-1360). The dispatcher-level redirect handler also strips cookie on cross-origin redirects (lib/handler/redirect-handler.js:168-170). The fix commit e041de35 (author maitken..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "action_statement": "Vulnerability CVE-2024-24750 affects version 8.4.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-13T22:22:49.594925+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 8.4.1 of undici. not_affected \u2014 Undici 8.4.1 already strips Proxy-Authorization on cross-origin redirects in both the fetch path and the dispatcher RedirectHandler. The CVE-2024-24758 fix (upstream merge b9da3e4 / d3aa574, GHSA-3787-6prv-h9w3) is part of the upstream release, so the target is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 Undici 8.4.1 already strips Proxy-Authorization on cross-origin redirects in both the fetch path and the dispatcher RedirectHandler. The CVE-2024-24758 fix (upstream merge b9da3e4 / d3aa574, GHSA-3787-6prv-h9w3) is part of the upstream release, so the target is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-14T00:33:00.117062+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 does not affect version 8.4.1 of undici. not_affected \u2014 undici 8.4.1 already contains the upstream fix for CVE-2024-30260. The redirect handler strips authorization, proxy-authorization and cookie headers on cross-origin redirects for every dispatch-based API, including undici.request. The fix commit 6805746 (author hello@matteocollina.com) is an ancestor of HEAD and shipped in the upstream v8.4.1 release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "impact_statement": "not_affected \u2014 undici 8.4.1 already contains the upstream fix for CVE-2024-30260. The redirect handler strips authorization, proxy-authorization and cookie headers on cross-origin redirects for every dispatch-based API, including undici.request. The fix commit 6805746 (author hello@matteocollina.com) is an ancestor of HEAD and shipped in the upstream v8.4.1 release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-13T23:39:00.076832+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 8.4.1 of undici. not_affected \u2014 undici 8.4.1 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). The fix commit d542b8cd is an ancestor of HEAD, and the SRI check now uses spec-ordered strongest-algorithm selection with a full-length digest comparison. The fix is upstream-authored and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 undici 8.4.1 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). The fix commit d542b8cd is an ancestor of HEAD, and the SRI check now uses spec-ordered strongest-algorithm selection with a full-length digest comparison. The fix is upstream-authored and shipped in the upstream release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 8.4.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-13T21:31:44.249794+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 does not affect version 8.4.1 of undici. not_affected \u2014 Target undici 8.4.1 is not affected by CVE-2025-22150. The multipart boundary comes from crypto.randomInt via node:crypto in lib/web/fetch/formdata.js. Math.random is only a fallback when node:crypto is unavailable, which is the same fallback the upstream fix kept. The upstream fix commit c2d78cd1 (author hello@matteocollina.com) is an ancestor of HEAD and was already in the upstream release Tu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.4.1 is not affected by CVE-2025-22150. The multipart boundary comes from crypto.randomInt via node:crypto in lib/web/fetch/formdata.js. Math.random is only a fallback when node:crypto is unavailable, which is the same fallback the upstream fix kept. The upstream fix commit c2d78cd1 (author hello@matteocollina.com) is an ancestor of HEAD and was already in the upstream release Tu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-13T21:37:00.197268+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 does not affect version 8.4.1 of undici. not_affected \u2014 undici 8.4.1 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool removes failed clients from its client list on 'connectionError', so repeated TLS/connection failures no longer accumulate retained clients. The fix is upstream-authored and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "impact_statement": "not_affected \u2014 undici 8.4.1 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool removes failed clients from its client list on 'connectionError', so repeated TLS/connection failures no longer accumulate retained clients. The fix is upstream-authored and shipped in the upstream release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:44:00.132301+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:46:33.687871+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:46:33.687871+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "action_statement": "Vulnerability CVE-2026-109841 affects version 8.4.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-14T03:10:45.899296+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 does not affect version 8.4.1 of undici. not_affected \u2014 Target is undici 8.4.1; the CVE is a regression introduced in 8.11.0 (affects 8.11.0 and 8.11.1). In this tree the HTTP/2 WebSocket upgrade path never marks the request as completed, so the abort issued after a failed handshake validation is effective: it closes the ClientHttp2Stream (RST_STREAM) and the orphaned-stream unhandled 'error' crash cannot occur. The regressed code is absent. The ven...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.4.1; the CVE is a regression introduced in 8.11.0 (affects 8.11.0 and 8.11.1). In this tree the HTTP/2 WebSocket upgrade path never marks the request as completed, so the abort issued after a failed handshake validation is effective: it closes the ClientHttp2Stream (RST_STREAM) and the orphaned-stream unhandled 'error' crash cannot occur. The regressed code is absent. The ven..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:29:00.261196+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:34:00.250279+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "action_statement": "Vulnerability CVE-2026-109924 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "action_statement": "Vulnerability CVE-2026-11525 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:20:57.098620+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "action_statement": "Vulnerability CVE-2026-116630 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "action_statement": "Vulnerability CVE-2026-120222 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "action_statement": "Vulnerability CVE-2026-120415 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "action_statement": "Vulnerability CVE-2026-120423 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:06:35.912230+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "action_statement": "Vulnerability CVE-2026-120474 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "action_statement": "Vulnerability CVE-2026-12151 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "action_statement": "Vulnerability CVE-2026-13697 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "action_statement": "Vulnerability CVE-2026-14643 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "action_statement": "Vulnerability CVE-2026-15157 affects version 8.4.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-13T21:55:34.449898+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 does not affect version 8.4.1 of undici. not_affected \u2014 Target is undici 8.4.1. The upstream fix for CVE-2026-1525 (commit 74495c63, \"fix: reject duplicate content-length and host headers\") is already in HEAD's history and in the shipped code. processHeader lowercases every header name, so case-variant Content-Length entries in a flat array collapse to one name. A second one throws 'duplicate content-length header'. The upstream authors made the fix...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.4.1. The upstream fix for CVE-2026-1525 (commit 74495c63, \"fix: reject duplicate content-length and host headers\") is already in HEAD's history and in the shipped code. processHeader lowercases every header name, so case-variant Content-Length entries in a flat array collapse to one name. A second one throws 'duplicate content-length header'. The upstream authors made the fix..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 8.4.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-13T22:11:00.043442+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 does not affect version 8.4.1 of undici. not_affected \u2014 undici 8.4.1 already contains the upstream fix for CVE-2026-1527. The Request constructor rejects any non-string `upgrade` value, and rejects any value containing CR, LF or other control characters, before the value reaches the HTTP/1 writer. The fix is upstream commit 77594f92 by Matteo Collina. It is an ancestor of HEAD and was part of the upstream release before the first TuxCare commit (356...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "impact_statement": "not_affected \u2014 undici 8.4.1 already contains the upstream fix for CVE-2026-1527. The Request constructor rejects any non-string `upgrade` value, and rejects any value containing CR, LF or other control characters, before the value reaches the HTTP/1 writer. The fix is upstream commit 77594f92 by Matteo Collina. It is an ancestor of HEAD and was part of the upstream release before the first TuxCare commit (356..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-13T22:02:00.042261+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 does not affect version 8.4.1 of undici. not_affected \u2014 Target undici 8.4.1 already contains the upstream fix for CVE-2026-1528. In lib/web/websocket/receiver.js the PAYLOADLENGTH_64 state rejects any 64-bit length with upper != 0 or lower > 2^31-1 via failWebsocketConnection(1009). It no longer computes (upper << 8) + lower. The fix is upstream commit 84235c62 (hello@matteocollina.com), an ancestor of HEAD. HEAD has no TuxCare-domain commits, so it...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.4.1 already contains the upstream fix for CVE-2026-1528. In lib/web/websocket/receiver.js the PAYLOADLENGTH_64 state rejects any 64-bit length with upper != 0 or lower > 2^31-1 via failWebsocketConnection(1009). It no longer computes (upper << 8) + lower. The fix is upstream commit 84235c62 (hello@matteocollina.com), an ancestor of HEAD. HEAD has no TuxCare-domain commits, so it..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "action_statement": "Vulnerability CVE-2026-16728 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "action_statement": "Vulnerability CVE-2026-16729 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "action_statement": "Vulnerability CVE-2026-18149 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "action_statement": "Vulnerability CVE-2026-18540 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "action_statement": "Vulnerability CVE-2026-19534 affects version 8.4.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-13T21:44:00.039648+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 does not affect version 8.4.1 of undici. not_affected \u2014 undici 8.4.1 already contains the upstream fix (b04e3cbb, Matteo Collina). Both fetch() and the decompress interceptor cap the Content-Encoding chain at 5 entries and reject longer chains before any decoder is created.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "impact_statement": "not_affected \u2014 undici 8.4.1 already contains the upstream fix (b04e3cbb, Matteo Collina). Both fetch() and the decompress interceptor cap the Content-Encoding chain at 5 entries and reject longer chains before any decoder is created."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 8.4.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-14T01:37:47.119617+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 does not affect version 8.4.1 of undici. not_affected \u2014 Target (undici 8.4.1) already contains the upstream fix 5890c7b (author hello@matteocollina.com, upstream). DeduplicationHandler streams chunks to waiting handlers, and late attachment is refused once body data has started. The fix shipped in the upstream release before the only post-release commit, an automation-authored tuxcare.yaml addition.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "impact_statement": "not_affected \u2014 Target (undici 8.4.1) already contains the upstream fix 5890c7b (author hello@matteocollina.com, upstream). DeduplicationHandler streams chunks to waiting handlers, and late attachment is refused once body data has started. The fix shipped in the upstream release before the only post-release commit, an automation-authored tuxcare.yaml addition."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "action_statement": "Vulnerability CVE-2026-6733 affects version 8.4.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-13T20:10:07.561437+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 does not affect version 8.4.1 of undici. not_affected \u2014 undici 8.4.1 is not affected. Socks5ProxyAgent already keeps one Pool per origin. Upstream fix a516f870 (#5041) is an ancestor of the v8.4.1 release commit, so the fix shipped in the release TuxCare onboarded. HEAD has no TuxCare-domain commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "impact_statement": "not_affected \u2014 undici 8.4.1 is not affected. Socks5ProxyAgent already keeps one Pool per origin. Upstream fix a516f870 (#5041) is an ancestor of the v8.4.1 release commit, so the fix shipped in the release TuxCare onboarded. HEAD has no TuxCare-domain commit."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "action_statement": "Vulnerability CVE-2026-84890 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "action_statement": "Vulnerability CVE-2026-84933 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "action_statement": "Vulnerability CVE-2026-84947 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "action_statement": "Vulnerability CVE-2026-84961 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "action_statement": "Vulnerability CVE-2026-85008 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-29T18:27:17.765346+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "action_statement": "Vulnerability CVE-2026-85014 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-10-15T12:23:19.034848+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "action_statement": "Vulnerability CVE-2026-85024 affects version 8.4.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-11-14T02:34:53.666741+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 does not affect version 8.4.1 of undici. not_affected \u2014 Target is undici 8.4.1. The CVE says the flaw was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In 8.4.1, both interceptors.cache() and interceptors.deduplicate() always put the destination origin into their keys, and they skip caching or dedup entirely when opts.origin is missing. A response from one origin therefore cannot be keyed together with another origin's request. I could no...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.4.1. The CVE says the flaw was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In 8.4.1, both interceptors.cache() and interceptors.deduplicate() always put the destination origin into their keys, and they skip caching or dedup entirely when opts.origin is missing. A response from one origin therefore cannot be keyed together with another origin's request. I could no..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:48:04.069265+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "action_statement": "Vulnerability CVE-2026-87029 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "action_statement": "Vulnerability CVE-2026-9675 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "action_statement": "Vulnerability CVE-2026-9678 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "action_statement": "Vulnerability CVE-2026-9679 affects version 8.4.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.4.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.4.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 affects version 8.4.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "action_statement": "Vulnerability CVE-2026-9697 affects version 8.4.1 of undici."
    }
  ]
}