{
  "@id": "urn:uuid:0fc9c5c0-9949-4988-bb22-8b85c613bd78",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T00:50:00.073591+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongodb@7.0.0",
          "identifiers": {
            "purl": "pkg:npm/mongodb@7.0.0"
          }
        }
      ],
      "timestamp": "2026-11-04T00:50:00.073591+00:00",
      "status_notes": "Vulnerability CVE-2021-32050 does not affect version 7.0.0 of mongodb. not_affected \u2014 CVE-2021-32050 affects MongoDB drivers that erroneously publish authentication-sensitive data to command listeners. The target MongoDB Node.js Driver v7.0.0 is NOT AFFECTED because the upstream vendor (MongoDB) fixed this vulnerability in commit 536e5ffbc (June 16, 2021), which shipped in upstream v4.0.0 and all subsequent releases including v7.0.0. The fix implements redaction via the maybeRed...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-32050"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-32050 affects MongoDB drivers that erroneously publish authentication-sensitive data to command listeners. The target MongoDB Node.js Driver v7.0.0 is NOT AFFECTED because the upstream vendor (MongoDB) fixed this vulnerability in commit 536e5ffbc (June 16, 2021), which shipped in upstream v4.0.0 and all subsequent releases including v7.0.0. The fix implements redaction via the maybeRed..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongodb@7.0.0",
          "identifiers": {
            "purl": "pkg:npm/mongodb@7.0.0"
          }
        }
      ],
      "timestamp": "2026-11-04T00:48:42.876667+00:00",
      "status_notes": "Vulnerability GHSA-mh5c-679w-hh4r does not affect version 7.0.0 of mongodb. not_affected \u2014 The target (mongodb@7.0.0) is not affected by GHSA-mh5c-679w-hh4r. The vulnerability was fixed in upstream version 3.1.13 (Jan 2019, commit 210c71dcc), and version 7.0.0 includes this fix. The vulnerable pattern (unhandled exception when Collection constructor is called with invalid name and non-existent DB) has been eliminated through proper exception handling in the executeOperation framework...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-mh5c-679w-hh4r"
      },
      "impact_statement": "not_affected \u2014 The target (mongodb@7.0.0) is not affected by GHSA-mh5c-679w-hh4r. The vulnerability was fixed in upstream version 3.1.13 (Jan 2019, commit 210c71dcc), and version 7.0.0 includes this fix. The vulnerable pattern (unhandled exception when Collection constructor is called with invalid name and non-existent DB) has been eliminated through proper exception handling in the executeOperation framework..."
    }
  ]
}