{
  "@id": "urn:uuid:319788a7-ffe4-40fc-a65f-35f6995c0323",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T21:05:04.452255+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2019-17426 does not affect version 9.6.2 of mongoose. not_affected \u2014 CVE-2019-17426 affects Mongoose through version 5.7.4, where query objects with a `_bsontype` attribute could bypass access control due to how older bson parsers (1.x) handled this special property. The target version 9.6.2-tuxcare.2 is not affected because: (1) The vulnerability was fixed upstream in Mongoose 5.7.5 (commit f3eca5b94d82), (2) The workaround code was later removed when Mongoose ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17426"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17426 affects Mongoose through version 5.7.4, where query objects with a `_bsontype` attribute could bypass access control due to how older bson parsers (1.x) handled this special property. The target version 9.6.2-tuxcare.2 is not affected because: (1) The vulnerability was fixed upstream in Mongoose 5.7.5 (commit f3eca5b94d82), (2) The workaround code was later removed when Mongoose ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.2"
          }
        }
      ],
      "timestamp": "2026-11-02T20:06:00.090260+00:00",
      "status_notes": "Vulnerability CVE-2022-24304 affects version 9.6.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2022-24304"
      },
      "action_statement": "Vulnerability CVE-2022-24304 affects version 9.6.2 of mongoose."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2564 does not affect version 9.6.2 of mongoose. not_affected \u2014 CVE-2022-2564 (Prototype Pollution in Schema.path()) is NOT present in Mongoose 9.6.2-tuxcare.2. The upstream fix (commit 6a197316564742c0422309e1b5fecfa4faec126e by Valeri Karpov on July 18, 2022) was already included in the upstream release that TuxCare onboarded. The fix validates all schema path segments against a specialProperties Set containing ['__proto__', 'constructor', 'prototype'], t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2564"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2564 (Prototype Pollution in Schema.path()) is NOT present in Mongoose 9.6.2-tuxcare.2. The upstream fix (commit 6a197316564742c0422309e1b5fecfa4faec126e by Valeri Karpov on July 18, 2022) was already included in the upstream release that TuxCare onboarded. The fix validates all schema path segments against a specialProperties Set containing ['__proto__', 'constructor', 'prototype'], t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2023-3696 does not affect version 9.6.2 of mongoose. not_affected \u2014 CVE-2023-3696 (prototype pollution in document initialization) is not present in mongoose 9.6.2-tuxcare.2. The vulnerability was fixed in upstream releases 7.3.3, 6.11.3, and 5.13.20 (July 2023). The fix was already present in the upstream 9.6.2 release that TuxCare onboarded, as evidenced by commit 305ce4ff7 being an ancestor of the TuxCare onboarding commit 99acdd0ccc. The target code at lib/...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-3696"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-3696 (prototype pollution in document initialization) is not present in mongoose 9.6.2-tuxcare.2. The vulnerability was fixed in upstream releases 7.3.3, 6.11.3, and 5.13.20 (July 2023). The fix was already present in the upstream 9.6.2 release that TuxCare onboarded, as evidenced by commit 305ce4ff7 being an ancestor of the TuxCare onboarding commit 99acdd0ccc. The target code at lib/..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.2"
          }
        }
      ],
      "timestamp": "2026-11-02T20:06:00.090260+00:00",
      "status_notes": "Vulnerability CVE-2024-53900 affects version 9.6.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2024-53900"
      },
      "action_statement": "Vulnerability CVE-2024-53900 affects version 9.6.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.2"
          }
        }
      ],
      "timestamp": "2026-11-02T20:07:00.091345+00:00",
      "status_notes": "Vulnerability CVE-2025-23061 affects version 9.6.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2025-23061"
      },
      "action_statement": "Vulnerability CVE-2025-23061 affects version 9.6.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.2"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:04.452255+00:00",
      "status_notes": "Vulnerability CVE-2026-125116 affects version 9.6.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125116"
      },
      "action_statement": "Vulnerability CVE-2026-125116 affects version 9.6.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.2"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:02.047764+00:00",
      "status_notes": "Vulnerability CVE-2026-125117 affects version 9.6.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125117"
      },
      "action_statement": "Vulnerability CVE-2026-125117 affects version 9.6.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.2"
          }
        }
      ],
      "timestamp": "2026-11-10T20:58:50.437512+00:00",
      "status_notes": "Vulnerability CVE-2026-125118 affects version 9.6.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125118"
      },
      "action_statement": "Vulnerability CVE-2026-125118 affects version 9.6.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.2"
          }
        }
      ],
      "timestamp": "2026-11-10T20:03:31.902906+00:00",
      "status_notes": "Vulnerability CVE-2026-125119 affects version 9.6.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125119"
      },
      "action_statement": "Vulnerability CVE-2026-125119 affects version 9.6.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.2"
          }
        }
      ],
      "timestamp": "2026-11-10T19:43:34.920122+00:00",
      "status_notes": "Vulnerability CVE-2026-125120 affects version 9.6.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125120"
      },
      "action_statement": "Vulnerability CVE-2026-125120 affects version 9.6.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.2"
          }
        }
      ],
      "timestamp": "2026-11-02T20:07:00.091345+00:00",
      "status_notes": "Vulnerability CVE-2026-42334 affects version 9.6.2 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-42334"
      },
      "action_statement": "Vulnerability CVE-2026-42334 affects version 9.6.2 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.2"
          }
        }
      ],
      "timestamp": "2026-10-18T15:55:00.507763+00:00",
      "status_notes": "Vulnerability CVE-2026-73562 affects version 9.6.2 of mongoose, and is fixed in 9.6.2-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-73562"
      },
      "action_statement": "Vulnerability CVE-2026-73562 affects version 9.6.2 of mongoose, and is fixed in 9.6.2-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.2"
          }
        }
      ],
      "timestamp": "2026-10-18T15:55:00.507763+00:00",
      "status_notes": "Vulnerability GHSA-664h-wqgq-64gw affects version 9.6.2 of mongoose, and is fixed in 9.6.2-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-664h-wqgq-64gw"
      },
      "action_statement": "Vulnerability GHSA-664h-wqgq-64gw affects version 9.6.2 of mongoose, and is fixed in 9.6.2-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.6.2",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.6.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability GHSA-r5xw-q988-826m does not affect version 9.6.2 of mongoose. not_affected \u2014 Target version 9.6.2 is not affected by GHSA-r5xw-q988-826m (remote memory exposure via number-to-Buffer casting). The vulnerability was fixed in upstream mongoose version 4.3.6 (January 2016) by commit 8066b145c, which added defensive code to wrap numeric values in arrays before Buffer creation, preventing uninitialized memory allocation. The fix is present in the target at lib/schema/buffer.j...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r5xw-q988-826m"
      },
      "impact_statement": "not_affected \u2014 Target version 9.6.2 is not affected by GHSA-r5xw-q988-826m (remote memory exposure via number-to-Buffer casting). The vulnerability was fixed in upstream mongoose version 4.3.6 (January 2016) by commit 8066b145c, which added defensive code to wrap numeric values in arrays before Buffer creation, preventing uninitialized memory allocation. The fix is present in the target at lib/schema/buffer.j..."
    }
  ]
}