{
  "@id": "urn:uuid:2c77e257-7818-442c-b9a9-0d016c8d35f4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T00:46:12.805922+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongodb@7.1.1",
          "identifiers": {
            "purl": "pkg:npm/mongodb@7.1.1"
          }
        }
      ],
      "timestamp": "2026-11-04T00:46:12.805922+00:00",
      "status_notes": "Vulnerability CVE-2021-32050 does not affect version 7.1.1 of mongodb. not_affected \u2014 CVE-2021-32050 is not present in MongoDB Node.js Driver v7.1.1. The upstream vendor (MongoDB) fixed this vulnerability in commit 536e5ffbc9 (2021-06-16) by implementing the maybeRedact() function that returns empty objects for sensitive authentication commands (saslStart, saslContinue, authenticate) before publishing to command listeners. This fix was first included in upstream v4.0.0 and is pr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-32050"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-32050 is not present in MongoDB Node.js Driver v7.1.1. The upstream vendor (MongoDB) fixed this vulnerability in commit 536e5ffbc9 (2021-06-16) by implementing the maybeRedact() function that returns empty objects for sensitive authentication commands (saslStart, saslContinue, authenticate) before publishing to command listeners. This fix was first included in upstream v4.0.0 and is pr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongodb@7.1.1",
          "identifiers": {
            "purl": "pkg:npm/mongodb@7.1.1"
          }
        }
      ],
      "timestamp": "2026-11-04T00:46:12.805922+00:00",
      "status_notes": "Vulnerability GHSA-mh5c-679w-hh4r does not affect version 7.1.1 of mongodb. not_affected \u2014 Version 7.1.1 of the mongodb driver is not affected by GHSA-mh5c-679w-hh4r. The vulnerability (uncaught exception when creating a collection with an invalid name on a non-existent database) was fixed by MongoDB upstream in version 3.1.13 (January 2019) via commit 210c71dccd. Version 7.1.1 includes this fix and additionally removed all client-side validation in October 2023, making the original ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-mh5c-679w-hh4r"
      },
      "impact_statement": "not_affected \u2014 Version 7.1.1 of the mongodb driver is not affected by GHSA-mh5c-679w-hh4r. The vulnerability (uncaught exception when creating a collection with an invalid name on a non-existent database) was fixed by MongoDB upstream in version 3.1.13 (January 2019) via commit 210c71dccd. Version 7.1.1 includes this fix and additionally removed all client-side validation in October 2023, making the original ..."
    }
  ]
}