{
  "@id": "urn:uuid:09f53b5e-543d-47cb-954a-662650c92716",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T18:49:45.363574+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/file-type@17.1.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/file-type@17.1.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T18:49:45.363574+00:00",
      "status_notes": "Vulnerability CVE-2022-36313 does not affect version 17.1.6-tuxcare.1 of file-type. not_affected \u2014 Target repository file-type 17.1.6-tuxcare.1 is NOT affected by CVE-2022-36313. The vulnerability (infinite loop when parsing malformed MKV files) was fixed in upstream version 17.1.3 by commit 2c4d1200. TuxCare onboarded version 17.1.6, which already contained this upstream fix. The vulnerable pattern (unbounded bit-shift loop) is not present in the codebase - it was replaced with a guarded lo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-36313"
      },
      "impact_statement": "not_affected \u2014 Target repository file-type 17.1.6-tuxcare.1 is NOT affected by CVE-2022-36313. The vulnerability (infinite loop when parsing malformed MKV files) was fixed in upstream version 17.1.3 by commit 2c4d1200. TuxCare onboarded version 17.1.6, which already contained this upstream fix. The vulnerable pattern (unbounded bit-shift loop) is not present in the codebase - it was replaced with a guarded lo..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/file-type@17.1.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/file-type@17.1.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-31808 is fixed in version 17.1.6-tuxcare.1 of file-type.",
      "vulnerability": {
        "name": "CVE-2026-31808"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/file-type@17.1.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/file-type@17.1.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32630 does not affect version 17.1.6-tuxcare.1 of file-type. not_affected \u2014 CVE-2026-32630 affects file-type versions 20.0.0 to 21.3.1 where unbounded ZIP decompression can cause memory exhaustion. Target version 17.1.6 predates the vulnerable decompression feature (introduced in v20.0.0 via commit 399b0f1) and does not decompress ZIP entries at all. The vulnerability pattern cannot manifest in this version.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-32630"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-32630 affects file-type versions 20.0.0 to 21.3.1 where unbounded ZIP decompression can cause memory exhaustion. Target version 17.1.6 predates the vulnerable decompression feature (introduced in v20.0.0 via commit 399b0f1) and does not decompress ZIP entries at all. The vulnerability pattern cannot manifest in this version."
    }
  ]
}