{
  "@id": "urn:uuid:15cc2684-5bca-4d6d-b6db-e0d8b01884c1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T21:04:58.956727+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@7.8.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@7.8.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2019-17426 does not affect version 7.8.8-tuxcare.2 of mongoose. not_affected \u2014 Target Mongoose 7.8.8-tuxcare.4 with bson 5.5.0 is not affected by CVE-2019-17426. The vulnerability existed in Mongoose \u22645.7.4 using bson 1.x, where query objects containing `_bsontype` attributes were incorrectly ignored by the buggy bson parser, allowing attackers to bypass query filters. Mongoose 5.7.5 (Oct 2019, commit f3eca5b94) added a workaround to strip `_bsontype` properties. Later (J...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17426"
      },
      "impact_statement": "not_affected \u2014 Target Mongoose 7.8.8-tuxcare.4 with bson 5.5.0 is not affected by CVE-2019-17426. The vulnerability existed in Mongoose \u22645.7.4 using bson 1.x, where query objects containing `_bsontype` attributes were incorrectly ignored by the buggy bson parser, allowing attackers to bypass query filters. Mongoose 5.7.5 (Oct 2019, commit f3eca5b94) added a workaround to strip `_bsontype` properties. Later (J..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@7.8.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@7.8.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T20:06:00.090260+00:00",
      "status_notes": "Vulnerability CVE-2022-24304 affects version 7.8.8-tuxcare.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2022-24304"
      },
      "action_statement": "Vulnerability CVE-2022-24304 affects version 7.8.8-tuxcare.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@7.8.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@7.8.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T20:06:00.090260+00:00",
      "status_notes": "Vulnerability CVE-2022-2564 affects version 7.8.8-tuxcare.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2022-2564"
      },
      "action_statement": "Vulnerability CVE-2022-2564 affects version 7.8.8-tuxcare.2 of mongoose."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@7.8.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@7.8.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2023-3696 does not affect version 7.8.8-tuxcare.2 of mongoose. not_affected \u2014 CVE-2023-3696 affects Mongoose versions prior to 7.3.3, 6.11.3, and 5.13.20. The target repository is Mongoose version 7.8.8-tuxcare.4, which already contains the upstream fix for this prototype pollution vulnerability. The fix (commit e29578d2ec18a68) was authored by upstream Mongoose maintainer Valeri Karpov and shipped in the upstream release before TuxCare onboarded version 7.8.8. The vulne...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-3696"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-3696 affects Mongoose versions prior to 7.3.3, 6.11.3, and 5.13.20. The target repository is Mongoose version 7.8.8-tuxcare.4, which already contains the upstream fix for this prototype pollution vulnerability. The fix (commit e29578d2ec18a68) was authored by upstream Mongoose maintainer Valeri Karpov and shipped in the upstream release before TuxCare onboarded version 7.8.8. The vulne..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@7.8.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@7.8.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-53900 affects version 7.8.8-tuxcare.2 of mongoose, and is fixed in 7.8.8-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2024-53900"
      },
      "action_statement": "Vulnerability CVE-2024-53900 affects version 7.8.8-tuxcare.2 of mongoose, and is fixed in 7.8.8-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@7.8.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@7.8.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T20:07:00.091345+00:00",
      "status_notes": "Vulnerability CVE-2025-23061 affects version 7.8.8-tuxcare.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2025-23061"
      },
      "action_statement": "Vulnerability CVE-2025-23061 affects version 7.8.8-tuxcare.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@7.8.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@7.8.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T21:04:58.956727+00:00",
      "status_notes": "Vulnerability CVE-2026-125116 affects version 7.8.8-tuxcare.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125116"
      },
      "action_statement": "Vulnerability CVE-2026-125116 affects version 7.8.8-tuxcare.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@7.8.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@7.8.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T21:04:58.956727+00:00",
      "status_notes": "Vulnerability CVE-2026-125117 affects version 7.8.8-tuxcare.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125117"
      },
      "action_statement": "Vulnerability CVE-2026-125117 affects version 7.8.8-tuxcare.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@7.8.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@7.8.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T20:58:50.437512+00:00",
      "status_notes": "Vulnerability CVE-2026-125118 affects version 7.8.8-tuxcare.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125118"
      },
      "action_statement": "Vulnerability CVE-2026-125118 affects version 7.8.8-tuxcare.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@7.8.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@7.8.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T20:03:31.902906+00:00",
      "status_notes": "Vulnerability CVE-2026-125119 affects version 7.8.8-tuxcare.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125119"
      },
      "action_statement": "Vulnerability CVE-2026-125119 affects version 7.8.8-tuxcare.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@7.8.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@7.8.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T19:43:34.920122+00:00",
      "status_notes": "Vulnerability CVE-2026-125120 affects version 7.8.8-tuxcare.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125120"
      },
      "action_statement": "Vulnerability CVE-2026-125120 affects version 7.8.8-tuxcare.2 of mongoose."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/mongoose@7.8.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@7.8.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42334 is fixed in version 7.8.8-tuxcare.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-42334"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@7.8.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@7.8.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-73562 affects version 7.8.8-tuxcare.2 of mongoose, and is fixed in 7.8.8-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-73562"
      },
      "action_statement": "Vulnerability CVE-2026-73562 affects version 7.8.8-tuxcare.2 of mongoose, and is fixed in 7.8.8-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@7.8.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@7.8.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-664h-wqgq-64gw affects version 7.8.8-tuxcare.2 of mongoose, and is fixed in 7.8.8-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-664h-wqgq-64gw"
      },
      "action_statement": "Vulnerability GHSA-664h-wqgq-64gw affects version 7.8.8-tuxcare.2 of mongoose, and is fixed in 7.8.8-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@7.8.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@7.8.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:01:00.133094+00:00",
      "status_notes": "Vulnerability GHSA-r5xw-q988-826m does not affect version 7.8.8-tuxcare.2 of mongoose. not_affected \u2014 The target mongoose version 7.8.8-tuxcare.4 is NOT affected by GHSA-r5xw-q988-826m (remote memory exposure via uninitialized Buffer allocation). The vulnerability was fixed in the upstream mongoose release via commit 4a1c77b87 (Aug 2018) by using Buffer.alloc() for zero-initialized memory allocation instead of new Buffer(). This fix predates all TuxCare modifications and was already present in ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r5xw-q988-826m"
      },
      "impact_statement": "not_affected \u2014 The target mongoose version 7.8.8-tuxcare.4 is NOT affected by GHSA-r5xw-q988-826m (remote memory exposure via uninitialized Buffer allocation). The vulnerability was fixed in the upstream mongoose release via commit 4a1c77b87 (Aug 2018) by using Buffer.alloc() for zero-initialized memory allocation instead of new Buffer(). This fix predates all TuxCare modifications and was already present in ..."
    }
  ]
}