{
  "@id": "urn:uuid:289ca731-ad99-4b0b-823e-39745766c360",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T21:05:02.047764+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.5.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.5.0"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2019-17426 does not affect version 9.5.0 of mongoose. not_affected \u2014 CVE-2019-17426 affected Mongoose \u22645.7.4 where query objects with `_bsontype` attributes could bypass access control filters. The vulnerability stemmed from bson 1.x silently ignoring objects with this property. Mongoose 5.7.5 (Oct 2019) introduced a workaround by deleting `_bsontype` from queries. This workaround was later removed (Jan 2022) when Mongoose upgraded to bson 4.x, which no longer e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17426"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17426 affected Mongoose \u22645.7.4 where query objects with `_bsontype` attributes could bypass access control filters. The vulnerability stemmed from bson 1.x silently ignoring objects with this property. Mongoose 5.7.5 (Oct 2019) introduced a workaround by deleting `_bsontype` from queries. This workaround was later removed (Jan 2022) when Mongoose upgraded to bson 4.x, which no longer e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.5.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.5.0"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-24304 does not affect version 9.5.0 of mongoose. not_affected \u2014 CVE-2022-24304 describes a Prototype Pollution vulnerability in Mongoose's Schema.path() function. The vulnerability allowed attackers to modify Object.prototype by passing paths containing '__proto__' (e.g., '__proto__.toString'). The target repository (mongoose v9.5.0) contains an upstream fix (commit 6a197316) that was shipped in the upstream release before TuxCare onboarded the code. The fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24304"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24304 describes a Prototype Pollution vulnerability in Mongoose's Schema.path() function. The vulnerability allowed attackers to modify Object.prototype by passing paths containing '__proto__' (e.g., '__proto__.toString'). The target repository (mongoose v9.5.0) contains an upstream fix (commit 6a197316) that was shipped in the upstream release before TuxCare onboarded the code. The fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.5.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.5.0"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2022-2564 does not affect version 9.5.0 of mongoose. not_affected \u2014 CVE-2022-2564 describes a prototype pollution vulnerability in Mongoose's Schema.path() function that allowed modification of the Object prototype via malicious property names like '__proto__', 'constructor', or 'prototype'. The fix was applied upstream by Mongoose maintainer Valeri Karpov in commit 99b418941 (August 2022), which added checks to reject these special properties in both Schema.pr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2564"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2564 describes a prototype pollution vulnerability in Mongoose's Schema.path() function that allowed modification of the Object prototype via malicious property names like '__proto__', 'constructor', or 'prototype'. The fix was applied upstream by Mongoose maintainer Valeri Karpov in commit 99b418941 (August 2022), which added checks to reject these special properties in both Schema.pr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.5.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.5.0"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2023-3696 does not affect version 9.5.0 of mongoose. not_affected \u2014 CVE-2023-3696 is NOT present in mongoose 9.5.0. The vulnerability, which allowed prototype pollution through MongoDB document initialization, was fixed in upstream release 7.3.3 (July 2023) by commit e29578d2ec. TuxCare onboarded version 9.5.0 on 2026-07-29, well after the upstream fix was applied. The defense code (specialProperties check at lib/document.js:764) is present and active in the cu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-3696"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-3696 is NOT present in mongoose 9.5.0. The vulnerability, which allowed prototype pollution through MongoDB document initialization, was fixed in upstream release 7.3.3 (July 2023) by commit e29578d2ec. TuxCare onboarded version 9.5.0 on 2026-07-29, well after the upstream fix was applied. The defense code (specialProperties check at lib/document.js:764) is present and active in the cu..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.5.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.5.0"
          }
        }
      ],
      "timestamp": "2026-11-02T20:06:00.090260+00:00",
      "status_notes": "Vulnerability CVE-2024-53900 affects version 9.5.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2024-53900"
      },
      "action_statement": "Vulnerability CVE-2024-53900 affects version 9.5.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.5.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.5.0"
          }
        }
      ],
      "timestamp": "2026-11-02T20:07:00.091345+00:00",
      "status_notes": "Vulnerability CVE-2025-23061 affects version 9.5.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2025-23061"
      },
      "action_statement": "Vulnerability CVE-2025-23061 affects version 9.5.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.5.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.5.0"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:02.047764+00:00",
      "status_notes": "Vulnerability CVE-2026-125116 affects version 9.5.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125116"
      },
      "action_statement": "Vulnerability CVE-2026-125116 affects version 9.5.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.5.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.5.0"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:02.047764+00:00",
      "status_notes": "Vulnerability CVE-2026-125117 affects version 9.5.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125117"
      },
      "action_statement": "Vulnerability CVE-2026-125117 affects version 9.5.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.5.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.5.0"
          }
        }
      ],
      "timestamp": "2026-11-10T20:58:50.437512+00:00",
      "status_notes": "Vulnerability CVE-2026-125118 affects version 9.5.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125118"
      },
      "action_statement": "Vulnerability CVE-2026-125118 affects version 9.5.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.5.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.5.0"
          }
        }
      ],
      "timestamp": "2026-11-10T20:03:31.902906+00:00",
      "status_notes": "Vulnerability CVE-2026-125119 affects version 9.5.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125119"
      },
      "action_statement": "Vulnerability CVE-2026-125119 affects version 9.5.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.5.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.5.0"
          }
        }
      ],
      "timestamp": "2026-11-10T19:43:34.920122+00:00",
      "status_notes": "Vulnerability CVE-2026-125120 affects version 9.5.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125120"
      },
      "action_statement": "Vulnerability CVE-2026-125120 affects version 9.5.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.5.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.5.0"
          }
        }
      ],
      "timestamp": "2026-11-02T20:07:00.091345+00:00",
      "status_notes": "Vulnerability CVE-2026-42334 affects version 9.5.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-42334"
      },
      "action_statement": "Vulnerability CVE-2026-42334 affects version 9.5.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.5.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.5.0"
          }
        }
      ],
      "timestamp": "2026-10-20T13:56:00.078920+00:00",
      "status_notes": "Vulnerability CVE-2026-73562 affects version 9.5.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-73562"
      },
      "action_statement": "Vulnerability CVE-2026-73562 affects version 9.5.0 of mongoose."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.5.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.5.0"
          }
        }
      ],
      "timestamp": "2026-11-04T09:01:00.133094+00:00",
      "status_notes": "Vulnerability GHSA-r5xw-q988-826m does not affect version 9.5.0 of mongoose. not_affected \u2014 The target is mongoose version 9.5.0, which is not affected by GHSA-r5xw-q988-826m (remote memory exposure when saving numbers to Buffer fields). The vulnerability was fixed in upstream versions 4.3.6 and 3.8.39 (released January 2016), and this fix is present in version 9.5.0 at lib/schema/buffer.js:214-216. The fix wraps numeric values in an array before passing to the MongooseBuffer construc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r5xw-q988-826m"
      },
      "impact_statement": "not_affected \u2014 The target is mongoose version 9.5.0, which is not affected by GHSA-r5xw-q988-826m (remote memory exposure when saving numbers to Buffer fields). The vulnerability was fixed in upstream versions 4.3.6 and 3.8.39 (released January 2016), and this fix is present in version 9.5.0 at lib/schema/buffer.js:214-216. The fix wraps numeric values in an array before passing to the MongooseBuffer construc..."
    }
  ]
}