{
  "@id": "urn:uuid:a27fa928-6895-407a-8462-79016fd7e7e0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T08:09:00.106872+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-11-04T04:06:00.077468+00:00",
      "status_notes": "Vulnerability CVE-2018-3711 does not affect version 5.2.1 of fastify. not_affected \u2014 CVE-2018-3711 is NOT present in fastify 5.2.1-tuxcare.6. The vulnerability (DoS via unbounded JSON payload parsing) was fixed in upstream version 0.38.0 (January 2018) by introducing the bodyLimit protection. The target version 5.2.1 is several major versions newer and includes the complete fix with a default 1 MiB body size limit that is enabled by default and enforced for all application/json...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-3711"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-3711 is NOT present in fastify 5.2.1-tuxcare.6. The vulnerability (DoS via unbounded JSON payload parsing) was fixed in upstream version 0.38.0 (January 2018) by introducing the bodyLimit protection. The target version 5.2.1 is several major versions newer and includes the complete fix with a default 1 MiB body size limit that is enabled by default and enforced for all application/json..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-11-04T04:05:35.684366+00:00",
      "status_notes": "Vulnerability CVE-2020-8192 does not affect version 5.2.1 of fastify. not_affected \u2014 CVE-2020-8192 affects Fastify v2.14.1 and v3.0.0-rc.4 with a DoS vulnerability when allErrors option is enabled. The target (v5.2.1-tuxcare.6) is NOT AFFECTED because the upstream fix (commit 627096fb by Matteo Collina, June 2020) was already present in the upstream release v2.15.1, years before v5.2.1. The fix explicitly sets allErrors: false in the default AJV configuration, preventing resour...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8192"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-8192 affects Fastify v2.14.1 and v3.0.0-rc.4 with a DoS vulnerability when allErrors option is enabled. The target (v5.2.1-tuxcare.6) is NOT AFFECTED because the upstream fix (commit 627096fb by Matteo Collina, June 2020) was already present in the upstream release v2.15.1, years before v5.2.1. The fix explicitly sets allErrors: false in the default AJV configuration, preventing resour..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-11-04T04:06:37.843142+00:00",
      "status_notes": "Vulnerability CVE-2022-39288 does not affect version 5.2.1 of fastify. not_affected \u2014 CVE-2022-39288 affects fastify v4.x (< v4.8.0) where malicious Content-Type headers containing Object.prototype property names (e.g., 'constructor', 'toString') could cause application crashes. The vulnerability stemmed from using plain objects for parser storage, enabling prototype pollution attacks. The target (fastify v5.2.1-tuxcare.6) contains the upstream fix (commit fbb07e8d, Oct 2022) th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-39288"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-39288 affects fastify v4.x (< v4.8.0) where malicious Content-Type headers containing Object.prototype property names (e.g., 'constructor', 'toString') could cause application crashes. The vulnerability stemmed from using plain objects for parser storage, enabling prototype pollution attacks. The target (fastify v5.2.1-tuxcare.6) contains the upstream fix (commit fbb07e8d, Oct 2022) th..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:00.165420+00:00",
      "status_notes": "Vulnerability CVE-2022-41919 affects version 5.2.1 of fastify.",
      "vulnerability": {
        "name": "CVE-2022-41919"
      },
      "action_statement": "Vulnerability CVE-2022-41919 affects version 5.2.1 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-32442 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-32442"
      },
      "action_statement": "Vulnerability CVE-2025-32442 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2026-107832 affects version 5.2.1 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-107832"
      },
      "action_statement": "Vulnerability CVE-2026-107832 affects version 5.2.1 of fastify."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:09:00.106872+00:00",
      "status_notes": "Vulnerability CVE-2026-120216 does not affect version 5.2.1 of fastify. not_affected \u2014 Target version 5.2.1 is not affected by CVE-2026-120216. The vulnerability requires the handlerTimeout feature, which was introduced in Fastify v5.8.0. Version 5.2.1 predates this feature and therefore cannot exhibit the vulnerable behavior. The CVE explicitly states affected versions are \"5.8.0 through 5.12.7\", confirming the vulnerability was introduced with the handlerTimeout feature, not pr...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-120216"
      },
      "impact_statement": "not_affected \u2014 Target version 5.2.1 is not affected by CVE-2026-120216. The vulnerability requires the handlerTimeout feature, which was introduced in Fastify v5.8.0. Version 5.2.1 predates this feature and therefore cannot exhibit the vulnerable behavior. The CVE explicitly states affected versions are \"5.8.0 through 5.12.7\", confirming the vulnerability was introduced with the handlerTimeout feature, not pr..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2026-16732 affects version 5.2.1 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-16732"
      },
      "action_statement": "Vulnerability CVE-2026-16732 affects version 5.2.1 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-18504 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-18504"
      },
      "action_statement": "Vulnerability CVE-2026-18504 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25223 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-25223"
      },
      "action_statement": "Vulnerability CVE-2026-25223 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25224 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-25224"
      },
      "action_statement": "Vulnerability CVE-2026-25224 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33806 affects version 5.2.1 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-33806"
      },
      "action_statement": "Vulnerability CVE-2026-33806 affects version 5.2.1 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-3419 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-3419"
      },
      "action_statement": "Vulnerability CVE-2026-3419 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-3635 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-3635"
      },
      "action_statement": "Vulnerability CVE-2026-3635 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-10-01T21:18:28.460680+00:00",
      "status_notes": "Vulnerability CVE-2026-76169 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-76169"
      },
      "action_statement": "Vulnerability CVE-2026-76169 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-10-12T12:10:00.201185+00:00",
      "status_notes": "Vulnerability CVE-2026-84428 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-84428"
      },
      "action_statement": "Vulnerability CVE-2026-84428 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-10-12T12:10:00.201185+00:00",
      "status_notes": "Vulnerability CVE-2026-84469 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-84469"
      },
      "action_statement": "Vulnerability CVE-2026-84469 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-10-03T17:57:00.062623+00:00",
      "status_notes": "Vulnerability CVE-2026-84504 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-84504"
      },
      "action_statement": "Vulnerability CVE-2026-84504 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.2.1"
          }
        }
      ],
      "timestamp": "2026-10-17T10:36:00.166696+00:00",
      "status_notes": "Vulnerability CVE-2026-92081 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-92081"
      },
      "action_statement": "Vulnerability CVE-2026-92081 affects version 5.2.1 of fastify, and is fixed in 5.2.1-tuxcare.6."
    }
  ]
}