{
  "@id": "urn:uuid:ea6ea133-a8b8-46d9-8303-5dde065bf0bf",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T00:50:00.073591+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongodb@7.2.0",
          "identifiers": {
            "purl": "pkg:npm/mongodb@7.2.0"
          }
        }
      ],
      "timestamp": "2026-11-04T00:50:00.073591+00:00",
      "status_notes": "Vulnerability CVE-2021-32050 does not affect version 7.2.0 of mongodb. not_affected \u2014 CVE-2021-32050 concerns MongoDB drivers leaking authentication data through command listeners. The target (MongoDB Node.js Driver v7.2.0) is NOT vulnerable. The upstream fix (commit 536e5ffbc from June 2021) is present in the shipped version, implementing proper redaction of sensitive authentication data via the maybeRedact() function in command_monitoring_events.ts. This fix was authored by up...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-32050"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-32050 concerns MongoDB drivers leaking authentication data through command listeners. The target (MongoDB Node.js Driver v7.2.0) is NOT vulnerable. The upstream fix (commit 536e5ffbc from June 2021) is present in the shipped version, implementing proper redaction of sensitive authentication data via the maybeRedact() function in command_monitoring_events.ts. This fix was authored by up..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongodb@7.2.0",
          "identifiers": {
            "purl": "pkg:npm/mongodb@7.2.0"
          }
        }
      ],
      "timestamp": "2026-11-04T00:46:12.805922+00:00",
      "status_notes": "Vulnerability GHSA-mh5c-679w-hh4r does not affect version 7.2.0 of mongodb. not_affected \u2014 Version 7.2.0 is not affected by GHSA-mh5c-679w-hh4r. The vulnerability was fixed in upstream version 3.1.13 (commit 210c71dcc, January 2019), and later architectural changes (commit 98550c6ad, October 2023) removed client-side collection name validation entirely. The vulnerable code pattern\u2014client-side validation in the Collection constructor that could throw uncaught exceptions when the datab...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-mh5c-679w-hh4r"
      },
      "impact_statement": "not_affected \u2014 Version 7.2.0 is not affected by GHSA-mh5c-679w-hh4r. The vulnerability was fixed in upstream version 3.1.13 (commit 210c71dcc, January 2019), and later architectural changes (commit 98550c6ad, October 2023) removed client-side collection name validation entirely. The vulnerable code pattern\u2014client-side validation in the Collection constructor that could throw uncaught exceptions when the datab..."
    }
  ]
}