{
  "@id": "urn:uuid:177c2f9a-fec3-4ac4-9c6b-252e0cff698a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T02:50:04.890115+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/ws@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T12:28:33.638846+00:00",
      "status_notes": "Vulnerability CVE-2016-10518 affects version 7.4.0-tuxcare.1 of ws.",
      "vulnerability": {
        "name": "CVE-2016-10518"
      },
      "action_statement": "Vulnerability CVE-2016-10518 affects version 7.4.0-tuxcare.1 of ws."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/ws@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T12:28:33.638846+00:00",
      "status_notes": "Vulnerability CVE-2016-10542 affects version 7.4.0-tuxcare.1 of ws.",
      "vulnerability": {
        "name": "CVE-2016-10542"
      },
      "action_statement": "Vulnerability CVE-2016-10542 affects version 7.4.0-tuxcare.1 of ws."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/ws@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/ws@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:51:00.268817+00:00",
      "status_notes": "Vulnerability CVE-2021-32640 is fixed in version 7.4.0-tuxcare.1 of ws.",
      "vulnerability": {
        "name": "CVE-2021-32640"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/ws@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/ws@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:51:00.268817+00:00",
      "status_notes": "Vulnerability CVE-2024-37890 is fixed in version 7.4.0-tuxcare.1 of ws.",
      "vulnerability": {
        "name": "CVE-2024-37890"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/ws@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T02:50:04.890115+00:00",
      "status_notes": "Vulnerability CVE-2026-45736 does not affect version 7.4.0-tuxcare.1 of ws. not_affected \u2014 Version 7.4.0 is NOT AFFECTED by CVE-2026-45736. The vulnerability exists only in ws >= 8.0.0 < 8.20.1 where the close() method uses buf.set() with TypedArrays. Version 7.4.0 uses a different code structure (buf.write() only, no buf.set() call) that does not exhibit this vulnerability. The GitHub Security Advisory explicitly excludes version 7.x from the vulnerable range, and all TuxCare backpo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45736"
      },
      "impact_statement": "not_affected \u2014 Version 7.4.0 is NOT AFFECTED by CVE-2026-45736. The vulnerability exists only in ws >= 8.0.0 < 8.20.1 where the close() method uses buf.set() with TypedArrays. Version 7.4.0 uses a different code structure (buf.write() only, no buf.set() call) that does not exhibit this vulnerability. The GitHub Security Advisory explicitly excludes version 7.x from the vulnerable range, and all TuxCare backpo..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/ws@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/ws@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:51:00.268817+00:00",
      "status_notes": "Vulnerability CVE-2026-48779 is fixed in version 7.4.0-tuxcare.1 of ws.",
      "vulnerability": {
        "name": "CVE-2026-48779"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.4.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/ws@7.4.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T12:28:33.638846+00:00",
      "status_notes": "Vulnerability GHSA-5v72-xg48-5rpm affects version 7.4.0-tuxcare.1 of ws.",
      "vulnerability": {
        "name": "GHSA-5v72-xg48-5rpm"
      },
      "action_statement": "Vulnerability GHSA-5v72-xg48-5rpm affects version 7.4.0-tuxcare.1 of ws."
    }
  ]
}