{
  "@id": "urn:uuid:506c9eca-fc5a-4925-843d-3a9f79069466",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T21:05:02.047764+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@5.13.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@5.13.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:00:00.113087+00:00",
      "status_notes": "Vulnerability CVE-2019-17426 does not affect version 5.13.23-tuxcare.3 of mongoose. not_affected \u2014 CVE-2019-17426 affects Mongoose through 5.7.4. The target version 5.13.23-tuxcare.5 contains an upstream fix (commit f88eb2524, July 2020) that strips `_bsontype` properties from query objects before processing. This fix was authored by upstream maintainer Valeri Karpov and shipped in the upstream release before TuxCare's involvement. The vulnerable code pattern (unprotected `_bsontype` in quer...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17426"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17426 affects Mongoose through 5.7.4. The target version 5.13.23-tuxcare.5 contains an upstream fix (commit f88eb2524, July 2020) that strips `_bsontype` properties from query objects before processing. This fix was authored by upstream maintainer Valeri Karpov and shipped in the upstream release before TuxCare's involvement. The vulnerable code pattern (unprotected `_bsontype` in quer..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@5.13.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@5.13.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T20:06:00.090260+00:00",
      "status_notes": "Vulnerability CVE-2022-24304 affects version 5.13.23-tuxcare.3 of mongoose.",
      "vulnerability": {
        "name": "CVE-2022-24304"
      },
      "action_statement": "Vulnerability CVE-2022-24304 affects version 5.13.23-tuxcare.3 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@5.13.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@5.13.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T20:06:00.090260+00:00",
      "status_notes": "Vulnerability CVE-2022-2564 affects version 5.13.23-tuxcare.3 of mongoose.",
      "vulnerability": {
        "name": "CVE-2022-2564"
      },
      "action_statement": "Vulnerability CVE-2022-2564 affects version 5.13.23-tuxcare.3 of mongoose."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@5.13.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@5.13.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2023-3696 does not affect version 5.13.23-tuxcare.3 of mongoose. not_affected \u2014 CVE-2023-3696 describes a prototype pollution vulnerability in mongoose versions prior to 5.13.20. The target version (5.13.23-tuxcare.5) contains the upstream fix that was shipped in version 5.13.20. The vulnerability allowed attackers to pollute Object.prototype by using MongoDB's $rename operator to create fields named __proto__ or constructor, which were then unsafely processed during docum...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-3696"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-3696 describes a prototype pollution vulnerability in mongoose versions prior to 5.13.20. The target version (5.13.23-tuxcare.5) contains the upstream fix that was shipped in version 5.13.20. The vulnerability allowed attackers to pollute Object.prototype by using MongoDB's $rename operator to create fields named __proto__ or constructor, which were then unsafely processed during docum..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/mongoose@5.13.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@5.13.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-53900 is fixed in version 5.13.23-tuxcare.3 of mongoose.",
      "vulnerability": {
        "name": "CVE-2024-53900"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/mongoose@5.13.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@5.13.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-23061 is fixed in version 5.13.23-tuxcare.3 of mongoose.",
      "vulnerability": {
        "name": "CVE-2025-23061"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@5.13.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@5.13.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:02.047764+00:00",
      "status_notes": "Vulnerability CVE-2026-125116 affects version 5.13.23-tuxcare.3 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125116"
      },
      "action_statement": "Vulnerability CVE-2026-125116 affects version 5.13.23-tuxcare.3 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@5.13.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@5.13.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:02.047764+00:00",
      "status_notes": "Vulnerability CVE-2026-125117 affects version 5.13.23-tuxcare.3 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125117"
      },
      "action_statement": "Vulnerability CVE-2026-125117 affects version 5.13.23-tuxcare.3 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@5.13.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@5.13.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T20:58:50.437512+00:00",
      "status_notes": "Vulnerability CVE-2026-125118 affects version 5.13.23-tuxcare.3 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125118"
      },
      "action_statement": "Vulnerability CVE-2026-125118 affects version 5.13.23-tuxcare.3 of mongoose."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@5.13.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@5.13.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T20:07:38.866692+00:00",
      "status_notes": "Vulnerability CVE-2026-125119 does not affect version 5.13.23-tuxcare.3 of mongoose. not_affected \u2014 Not affected. The CVE is a mismatch where a connection-level sanitizeFilter option is stored in Connection.config but never consulted by query casting. Mongoose 5.13.23 has no sanitizeFilter feature at all (the feature landed in 6.0.0), so there is no option that is reported as enabled but ignored.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-125119"
      },
      "impact_statement": "not_affected \u2014 Not affected. The CVE is a mismatch where a connection-level sanitizeFilter option is stored in Connection.config but never consulted by query casting. Mongoose 5.13.23 has no sanitizeFilter feature at all (the feature landed in 6.0.0), so there is no option that is reported as enabled but ignored."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@5.13.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@5.13.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T19:49:06.188780+00:00",
      "status_notes": "Vulnerability CVE-2026-125120 does not affect version 5.13.23-tuxcare.3 of mongoose. not_affected \u2014 The target (mongoose 5.13.23-tuxcare.5) has no sanitizeFilter feature. The CVE is a gap where an opt-in sanitizer was skipped for countDocuments(). That sanitizer does not exist in this 5.x tree, so the described flaw cannot occur. The patches/ directory holds one patch note (CVE-2026-42334.patch) that says the same, though its claim about the 5.x release was not checked independently.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-125120"
      },
      "impact_statement": "not_affected \u2014 The target (mongoose 5.13.23-tuxcare.5) has no sanitizeFilter feature. The CVE is a gap where an opt-in sanitizer was skipped for countDocuments(). That sanitizer does not exist in this 5.x tree, so the described flaw cannot occur. The patches/ directory holds one patch note (CVE-2026-42334.patch) that says the same, though its claim about the 5.x release was not checked independently."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@5.13.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@5.13.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42334 does not affect version 5.13.23-tuxcare.3 of mongoose. Mongoose 5.13.23 is not affected by CVE-2026-42334 because the vulnerable feature (sanitizeFilter) does not exist in this version. The sanitizeFilter feature was introduced in Mongoose 6.x; version 5.13.23 only has sanitizeProjection, which handles query projections (field selection), not query filters (document matching). Exhaustive searches confirm no sanitizeFilter code exists in the codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42334"
      },
      "impact_statement": "Mongoose 5.13.23 is not affected by CVE-2026-42334 because the vulnerable feature (sanitizeFilter) does not exist in this version. The sanitizeFilter feature was introduced in Mongoose 6.x; version 5.13.23 only has sanitizeProjection, which handles query projections (field selection), not query filters (document matching). Exhaustive searches confirm no sanitizeFilter code exists in the codebase."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@5.13.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@5.13.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-73562 affects version 5.13.23-tuxcare.3 of mongoose, and is fixed in 5.13.23-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-73562"
      },
      "action_statement": "Vulnerability CVE-2026-73562 affects version 5.13.23-tuxcare.3 of mongoose, and is fixed in 5.13.23-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@5.13.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@5.13.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-664h-wqgq-64gw affects version 5.13.23-tuxcare.3 of mongoose, and is fixed in 5.13.23-tuxcare.5.",
      "vulnerability": {
        "name": "GHSA-664h-wqgq-64gw"
      },
      "action_statement": "Vulnerability GHSA-664h-wqgq-64gw affects version 5.13.23-tuxcare.3 of mongoose, and is fixed in 5.13.23-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@5.13.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/mongoose@5.13.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability GHSA-r5xw-q988-826m does not affect version 5.13.23-tuxcare.3 of mongoose. not_affected \u2014 The target mongoose version 5.13.23-tuxcare.5 is not affected by GHSA-r5xw-q988-826m (remote memory exposure via number-to-Buffer casting). The vulnerability was fixed upstream by Valeri Karpov in commit 8066b145c (January 2016), which wraps number values in an array before Buffer allocation at lib/schema/buffer.js:188-190. This fix was already present in the upstream release before TuxCare onb...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r5xw-q988-826m"
      },
      "impact_statement": "not_affected \u2014 The target mongoose version 5.13.23-tuxcare.5 is not affected by GHSA-r5xw-q988-826m (remote memory exposure via number-to-Buffer casting). The vulnerability was fixed upstream by Valeri Karpov in commit 8066b145c (January 2016), which wraps number values in an array before Buffer allocation at lib/schema/buffer.js:188-190. This fix was already present in the upstream release before TuxCare onb..."
    }
  ]
}