{
  "@id": "urn:uuid:2d789852-25d9-46dc-873f-f95dca0036e1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T22:42:59.641005+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/bl@0.9.5",
          "identifiers": {
            "purl": "pkg:npm/bl@0.9.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-8244 affects version 0.9.5 of bl, and is fixed in 0.9.5-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2020-8244"
      },
      "action_statement": "Vulnerability CVE-2020-8244 affects version 0.9.5 of bl, and is fixed in 0.9.5-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/bl@0.9.5",
          "identifiers": {
            "purl": "pkg:npm/bl@0.9.5"
          }
        }
      ],
      "timestamp": "2026-11-03T22:42:59.641005+00:00",
      "status_notes": "Vulnerability GHSA-wrw9-m778-g6mc does not affect version 0.9.5 of bl. not_affected \u2014 The target repository (bl version 0.9.5-tuxcare.1) is NOT vulnerable to GHSA-wrw9-m778-g6mc. The vulnerability fix was already present in the upstream v0.9.5 release that TuxCare onboarded. The fix (commit def51b16369dca8a2f008b6348312de576496838 by upstream author Feross Aboukhadijeh) converts number arguments to strings before Buffer construction, preventing uninitialized memory exposure. Sin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wrw9-m778-g6mc"
      },
      "impact_statement": "not_affected \u2014 The target repository (bl version 0.9.5-tuxcare.1) is NOT vulnerable to GHSA-wrw9-m778-g6mc. The vulnerability fix was already present in the upstream v0.9.5 release that TuxCare onboarded. The fix (commit def51b16369dca8a2f008b6348312de576496838 by upstream author Feross Aboukhadijeh) converts number arguments to strings before Buffer construction, preventing uninitialized memory exposure. Sin..."
    }
  ]
}