{ "@id": "urn:uuid:7e4c6583-2360-4d49-b768-d242d581475b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 43, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T03:10:45.899296+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 8.7.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-14T00:07:00.231663+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 8.7.0 of undici. not_affected \u2014 undici 8.7.0 already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, fetch deletes authorization, proxy-authorization, cookie and host from the request header list. The fix commit e041de3 is an ancestor of HEAD and was authored upstream, so this is an upstream fix shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 undici 8.7.0 already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, fetch deletes authorization, proxy-authorization, cookie and host from the request header list. The fix commit e041de3 is an ancestor of HEAD and was authored upstream, so this is an upstream fix shipped in the release." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 8.7.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-13T22:22:49.594925+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 8.7.0 of undici. not_affected \u2014 Target undici 8.7.0 already strips proxy-authorization on cross-origin redirects, in both the fetch path and the RedirectHandler path. The fix shipped in the upstream release (commit e041de35, GHSA-wqq4-5wpv-mx2g, author maitken033380023@gmail.com) and is an ancestor of HEAD. HEAD's only post-release commit is a tuxcare.yaml build-config commit, so there is no TuxCare-authored fix and the verdi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Target undici 8.7.0 already strips proxy-authorization on cross-origin redirects, in both the fetch path and the RedirectHandler path. The fix shipped in the upstream release (commit e041de35, GHSA-wqq4-5wpv-mx2g, author maitken033380023@gmail.com) and is an ancestor of HEAD. HEAD's only post-release commit is a tuxcare.yaml build-config commit, so there is no TuxCare-authored fix and the verdi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-14T00:33:00.117062+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 8.7.0 of undici. not_affected \u2014 Target is undici 8.7.0. The upstream fix for CVE-2024-30260 (commit 6805746, in the redirect handler) is already part of HEAD. On a cross-origin redirect, RedirectHandler strips authorization, proxy-authorization and cookie headers. The fix is upstream-authored and shipped in the upstream release, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 Target is undici 8.7.0. The upstream fix for CVE-2024-30260 (commit 6805746, in the redirect handler) is already part of HEAD. On a cross-origin redirect, RedirectHandler strips authorization, proxy-authorization and cookie headers. The fix is upstream-authored and shipped in the upstream release, so the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-13T23:39:20.408363+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 8.7.0 of undici. not_affected \u2014 Target is upstream undici 8.7.0 (plus a tuxcare.yaml-only commit). The upstream fix for CVE-2024-30261 (d542b8cd, Matteo Collina, GHSA-9qxr-qj54-h672) is an ancestor of HEAD and the SRI code has since been rewritten to the spec-compliant form. bytesMatch now parses metadata strictly, ignores unsupported algorithms, selects the strongest supported algorithm and requires a digest match. The vulne...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Target is upstream undici 8.7.0 (plus a tuxcare.yaml-only commit). The upstream fix for CVE-2024-30261 (d542b8cd, Matteo Collina, GHSA-9qxr-qj54-h672) is an ancestor of HEAD and the SRI code has since been rewritten to the spec-compliant form. bytesMatch now parses metadata strictly, ignores unsupported algorithms, selects the strongest supported algorithm and requires a digest match. The vulne..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 8.7.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-13T21:32:55.414966+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 8.7.0 of undici. not_affected \u2014 Target undici 8.7.0 already contains the upstream CVE-2025-22150 fix. The multipart boundary is generated with node:crypto randomInt, not Math.random. The Math.random fallback applies only when the crypto module is unavailable, which matches the upstream fix (35f5d45e). The fix is in the upstream release and has no TuxCare attribution.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 Target undici 8.7.0 already contains the upstream CVE-2025-22150 fix. The multipart boundary is generated with node:crypto randomInt, not Math.random. The Math.random fallback applies only when the crypto module is unavailable, which matches the upstream fix (35f5d45e). The fix is in the upstream release and has no TuxCare attribution." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-13T21:39:00.116210+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 8.7.0 of undici. not_affected \u2014 CVE-2025-47279 (memory leak when a Pool repeatedly connects to a server with an invalid TLS certificate) was fixed upstream by nodejs/undici PR #4088 (commit f317618e). That commit is an ancestor of HEAD and is already in the upstream 8.7.0 release (cb4c2f1f). lib/dispatcher/pool.js lines 84-95 contain the fix. The fix was authored by upstream (Matteo Collina) and was not backported by TuxCare,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 CVE-2025-47279 (memory leak when a Pool repeatedly connects to a server with an invalid TLS certificate) was fixed upstream by nodejs/undici PR #4088 (commit f317618e). That commit is an ancestor of HEAD and is already in the upstream 8.7.0 release (cb4c2f1f). lib/dispatcher/pool.js lines 84-95 contain the fix. The fix was authored by upstream (Matteo Collina) and was not backported by TuxCare,..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 8.7.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-14T03:10:45.899296+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 8.7.0 of undici. not_affected \u2014 Target is undici 8.7.0, which predates the 8.11.0 regression. The H2 websocket upgrade path never marks the request completed after an upgrade response, so a failed handshake aborts the request and actually closes and destroys the ClientHttp2Stream. The CVE's chain (abort is a no-op, stream is orphaned, later teardown raises an unhandled error) does not form here.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 8.7.0, which predates the 8.11.0 regression. The H2 websocket upgrade path never marks the request completed after an upgrade response, so a failed handshake aborts the request and actually closes and destroys the ClientHttp2Stream. The CVE's chain (abort is a no-op, stream is orphaned, later teardown raises an unhandled error) does not form here." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-10-15T18:29:00.261196+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-10-15T18:34:00.250279+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 8.7.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-13T20:01:00.036985+00:00", "status_notes": "Vulnerability CVE-2026-11525 does not affect version 8.7.0 of undici. not_affected \u2014 Target is undici 8.7.0. The upstream fix (5655ea43, \"fix(cookies): preserve values and parse SameSite strictly\") is already in the upstream release. lib/web/cookies/parse.js now compares the lowercased SameSite value for exact equality with none/strict/lax, and ignores anything else. The substring-match flaw is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-11525" }, "impact_statement": "not_affected \u2014 Target is undici 8.7.0. The upstream fix (5655ea43, \"fix(cookies): preserve values and parse SameSite strictly\") is already in the upstream release. lib/web/cookies/parse.js now compares the lowercased SameSite value for exact equality with none/strict/lax, and ignores anything else. The substring-match flaw is absent." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-06T10:20:57.098620+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 8.7.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-13T20:03:00.065439+00:00", "status_notes": "Vulnerability CVE-2026-12151 does not affect version 8.7.0 of undici. not_affected \u2014 undici 8.7.0 already contains the upstream fix for CVE-2026-12151. The WebSocket receiver caps the number of fragments per message (default 131072) and fails the connection with 1008 when the cap is reached. The fix is upstream commit 32dbf0b3 (listed in the provided patch URLs). It shipped in the upstream release, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-12151" }, "impact_statement": "not_affected \u2014 undici 8.7.0 already contains the upstream fix for CVE-2026-12151. The WebSocket receiver caps the number of fragments per message (default 131072) and fails the connection with 1008 when the cap is reached. The fix is upstream commit 32dbf0b3 (listed in the provided patch URLs). It shipped in the upstream release, so the target is not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-14643 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-14643" }, "action_statement": "Vulnerability CVE-2026-14643 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 8.7.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-13T21:51:37.743034+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 8.7.0 of undici. not_affected \u2014 undici 8.7.0 already contains the upstream fix for CVE-2026-1525. processHeader() in lib/core/request.js lowercases every header name and throws 'duplicate content-length header' on a second Content-Length, including case-variant duplicates in a flat array. The fix is upstream commit 74495c63 (Matteo Collina), which is an ancestor of HEAD. HEAD's history has no TuxCare-domain commits, so this i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 undici 8.7.0 already contains the upstream fix for CVE-2026-1525. processHeader() in lib/core/request.js lowercases every header name and throws 'duplicate content-length header' on a second Content-Length, including case-variant duplicates in a flat array. The fix is upstream commit 74495c63 (Matteo Collina), which is an ancestor of HEAD. HEAD's history has no TuxCare-domain commits, so this i..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 8.7.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-13T22:11:00.043442+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 8.7.0 of undici. not_affected \u2014 undici 8.7.0 already contains the upstream CVE-2026-1527 fix. Request's constructor rejects non-string `upgrade` values and values with CR/LF or other invalid header characters, so the value written at client-h1.js:1280-1281 is always validated. The fix is upstream commit 77594f92 (Matteo Collina), shipped in the upstream release, and HEAD has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 undici 8.7.0 already contains the upstream CVE-2026-1527 fix. Request's constructor rejects non-string `upgrade` values and values with CR/LF or other invalid header characters, so the value written at client-h1.js:1280-1281 is always validated. The fix is upstream commit 77594f92 (Matteo Collina), shipped in the upstream release, and HEAD has no TuxCare-domain commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-13T22:02:00.042261+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 8.7.0 of undici. not_affected \u2014 undici 8.7.0 already contains the upstream CVE-2026-1528 fix (nodejs/undici commit 84235c62, \"Fix websocket 64-bit length overflow\"). ByteParser's PAYLOADLENGTH_64 state rejects any 64-bit length with a non-zero upper word or a lower word above 2^31-1, and fails the connection with close code 1009. The fix shipped in the upstream release. HEAD has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 undici 8.7.0 already contains the upstream CVE-2026-1528 fix (nodejs/undici commit 84235c62, \"Fix websocket 64-bit length overflow\"). ByteParser's PAYLOADLENGTH_64 state rejects any 64-bit length with a non-zero upper word or a lower word above 2^31-1, and fails the connection with close code 1009. The fix shipped in the upstream release. HEAD has no TuxCare-domain commits." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 8.7.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-13T21:44:27.229058+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 8.7.0 of undici. not_affected \u2014 Not affected. The upstream fix (nodejs/undici b04e3cbb) is already in this v8.7.0 tree. fetch() and the decompress interceptor both reject a Content-Encoding chain longer than 5 before any decoders are created. The fix shipped in the upstream release, and the only TuxCare commit in history is the final tuxcare.yaml build-config commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix (nodejs/undici b04e3cbb) is already in this v8.7.0 tree. fetch() and the decompress interceptor both reject a Content-Encoding chain longer than 5 before any decoders are created. The fix shipped in the upstream release, and the only TuxCare commit in history is the final tuxcare.yaml build-config commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 8.7.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-14T01:37:47.119617+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 8.7.0 of undici. not_affected \u2014 The upstream fix (5890c7b7, \"fix(deduplicate): stream response chunks to waiting handlers\") is already in the target. The deduplication handler streams chunks to waiting handlers as they arrive and refuses late attachment once body streaming starts. The commit is upstream-authored and shipped in the v8.7.0 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 The upstream fix (5890c7b7, \"fix(deduplicate): stream response chunks to waiting handlers\") is already in the target. The deduplication handler streams chunks to waiting handlers as they arrive and refuses late attachment once body streaming starts. The commit is upstream-authored and shipped in the v8.7.0 release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-13T19:58:35.243229+00:00", "status_notes": "Vulnerability CVE-2026-6733 does not affect version 8.7.0 of undici. not_affected \u2014 undici 8.7.0 already contains the upstream fix for CVE-2026-6733 (idle keep-alive socket validation before reuse). The fix commits are upstream-authored (Matteo Collina) and are part of the 8.7.0 release; no TuxCare commit exists in HEAD history apart from a non-allowlisted automation commit adding tuxcare.yaml.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6733" }, "impact_statement": "not_affected \u2014 undici 8.7.0 already contains the upstream fix for CVE-2026-6733 (idle keep-alive socket validation before reuse). The fix commits are upstream-authored (Matteo Collina) and are part of the 8.7.0 release; no TuxCare commit exists in HEAD history apart from a non-allowlisted automation commit adding tuxcare.yaml." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-13T20:10:07.561437+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 8.7.0 of undici. not_affected \u2014 The target (undici 8.7.0) already contains the upstream fix. Socks5ProxyAgent keeps a Map of Pools keyed by origin and builds each Pool's SOCKS5 connect function from that Pool's own origin. The fix is upstream commit a516f870 (#5041), which is part of the upstream v8.7.0 release. The first TuxCare commit in HEAD is only a tuxcare.yaml build-config commit, so the fix is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 The target (undici 8.7.0) already contains the upstream fix. Socks5ProxyAgent keeps a Map of Pools keyed by origin and builds each Pool's SOCKS5 connect function from that Pool's own origin. The fix is upstream commit a516f870 (#5041), which is part of the upstream v8.7.0 release. The first TuxCare commit in HEAD is only a tuxcare.yaml build-config commit, so the fix is not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-09-29T18:27:17.765346+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-10-15T12:23:19.034848+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 8.7.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-14T02:34:22.669842+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 8.7.0 of undici. not_affected \u2014 Target is undici 8.7.0. The regression exists only in 8.10.0 and 8.10.1 and is absent here. Both interceptors include the request origin in their keys and skip caching or deduplication when no origin is present, so responses cannot cross origins.", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 8.7.0. The regression exists only in 8.10.0 and 8.10.1 and is absent here. Both interceptors include the request origin in their keys and skip caching or deduplication when no origin is present, so responses cannot cross origins." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 8.7.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 8.7.0 of undici.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 8.7.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-14T02:06:45.296491+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 8.7.0 of undici. not_affected \u2014 undici 8.7.0 already contains the upstream fix for CVE-2026-9675. The WebSocket ByteParser adds already-buffered fragment bytes to each new frame's length and compares the sum against maxPayloadSize, so many small fragments cannot exceed the limit. All three referenced upstream commits (b4c287b3, 32dbf0b3, c5ed7875) are ancestors of HEAD. They were authored upstream and shipped in the release t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 undici 8.7.0 already contains the upstream fix for CVE-2026-9675. The WebSocket ByteParser adds already-buffered fragment bytes to each new frame's length and compares the sum against maxPayloadSize, so many small fragments cannot exceed the limit. All three referenced upstream commits (b4c287b3, 32dbf0b3, c5ed7875) are ancestors of HEAD. They were authored upstream and shipped in the release t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-13T20:11:32.988243+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 8.7.0 of undici. not_affected \u2014 Target undici 8.7.0 already contains the upstream fix (cb105d7c, \"fix(cache): trim qualified field names\", by Matteo Collina). parseCacheControlHeader trims qualified private/no-cache field names in both the quoted and unquoted branches. Padded values such as private=\" authorization\" and no-cache=\"\\tauthorization\" therefore parse to \"authorization\" and canCacheResponse rejects them.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Target undici 8.7.0 already contains the upstream fix (cb105d7c, \"fix(cache): trim qualified field names\", by Matteo Collina). parseCacheControlHeader trims qualified private/no-cache field names in both the quoted and unquoted branches. Padded values such as private=\" authorization\" and no-cache=\"\\tauthorization\" therefore parse to \"authorization\" and canCacheResponse rejects them." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-13T20:02:00.043521+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 8.7.0 of undici. not_affected \u2014 The target is undici 8.7.0, and it already contains the upstream fix 5655ea43. parseSetCookie in lib/web/cookies/parse.js returns the raw cookie value, and the qsUnescape percent-decoding is gone. parseCookie in lib/web/cookies/index.js never decoded. The fix shipped in the upstream release, and the only commit after the release is an ELS automation commit that adds tuxcare.yaml.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 The target is undici 8.7.0, and it already contains the upstream fix 5655ea43. parseSetCookie in lib/web/cookies/parse.js returns the raw cookie value, and the qsUnescape percent-decoding is gone. parseCookie in lib/web/cookies/index.js never decoded. The fix shipped in the upstream release, and the only commit after the release is an ELS automation commit that adds tuxcare.yaml." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.7.0", "identifiers": { "purl": "pkg:npm/undici@8.7.0" } } ], "timestamp": "2026-11-13T20:14:00.045604+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 8.7.0 of undici. not_affected \u2014 The SOCKS5 requestTls fix is already in HEAD (undici 8.7.0, a release later than v8.5.0). ProxyAgent forwards requestTls to Socks5ProxyAgent, and Socks5ProxyAgent spreads it into tls.connect for https targets. The fix is upstream-authored (commit 42d4955), not TuxCare-authored.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 The SOCKS5 requestTls fix is already in HEAD (undici 8.7.0, a release later than v8.5.0). ProxyAgent forwards requestTls to Socks5ProxyAgent, and Socks5ProxyAgent spreads it into tls.connect for https targets. The fix is upstream-authored (commit 42d4955), not TuxCare-authored." } ] }