{
  "@id": "urn:uuid:6e5f5795-405d-4ed4-b542-22bed0e0cb33",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T21:05:04.452255+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.0"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2019-17426 does not affect version 9.7.0 of mongoose. not_affected \u2014 CVE-2019-17426 affects Mongoose through 5.7.4 due to bson 1.x silently ignoring query filters with `_bsontype` properties. The target (Mongoose 9.7.0) uses mongodb driver 7.2+ which includes bson 6.x. The underlying vulnerability in bson 1.x is not present. Mongoose 5.7.5 added a workaround (deleting `_bsontype` from queries), which was removed in 6.1.8 after upgrading to bson 4.x. The architec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17426"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17426 affects Mongoose through 5.7.4 due to bson 1.x silently ignoring query filters with `_bsontype` properties. The target (Mongoose 9.7.0) uses mongodb driver 7.2+ which includes bson 6.x. The underlying vulnerability in bson 1.x is not present. Mongoose 5.7.5 added a workaround (deleting `_bsontype` from queries), which was removed in 6.1.8 after upgrading to bson 4.x. The architec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.0"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-24304 does not affect version 9.7.0 of mongoose. not_affected \u2014 The target (Mongoose v9.7.0) is not affected by CVE-2022-24304. The vulnerability pattern (prototype pollution via dotted property paths containing __proto__) was already fixed by upstream maintainer Valeri Karpov in commit a45cfb6b0 (2022-07-18), which shipped in the upstream release prior to TuxCare onboarding. The fix adds validation to reject special properties (__proto__, constructor, prot...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24304"
      },
      "impact_statement": "not_affected \u2014 The target (Mongoose v9.7.0) is not affected by CVE-2022-24304. The vulnerability pattern (prototype pollution via dotted property paths containing __proto__) was already fixed by upstream maintainer Valeri Karpov in commit a45cfb6b0 (2022-07-18), which shipped in the upstream release prior to TuxCare onboarding. The fix adds validation to reject special properties (__proto__, constructor, prot..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.0"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2564 does not affect version 9.7.0 of mongoose. not_affected \u2014 CVE-2022-2564 describes prototype pollution in Mongoose's Schema.path() function. The target repository (Mongoose 9.7.0) contains comprehensive protection against this vulnerability. The fix was implemented in upstream commit 6a197316564742c0422309e1b5fecfa4faec126e (July 18, 2022) by Valeri Karpov, which added validation to reject special properties (__proto__, constructor, prototype) in both ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2564"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2564 describes prototype pollution in Mongoose's Schema.path() function. The target repository (Mongoose 9.7.0) contains comprehensive protection against this vulnerability. The fix was implemented in upstream commit 6a197316564742c0422309e1b5fecfa4faec126e (July 18, 2022) by Valeri Karpov, which added validation to reject special properties (__proto__, constructor, prototype) in both ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.0"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2023-3696 does not affect version 9.7.0 of mongoose. not_affected \u2014 CVE-2023-3696 is a prototype pollution vulnerability in mongoose versions prior to 7.3.3, 6.11.3, and 5.13.20. The target repository is mongoose version 9.7.0, which already contains the upstream fix. The vulnerability allowed attackers to pollute JavaScript's Object prototype by using special property names like '__proto__' or 'constructor' in MongoDB documents. The fix, authored by upstream m...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-3696"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-3696 is a prototype pollution vulnerability in mongoose versions prior to 7.3.3, 6.11.3, and 5.13.20. The target repository is mongoose version 9.7.0, which already contains the upstream fix. The vulnerability allowed attackers to pollute JavaScript's Object prototype by using special property names like '__proto__' or 'constructor' in MongoDB documents. The fix, authored by upstream m..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.0"
          }
        }
      ],
      "timestamp": "2026-11-02T20:06:00.090260+00:00",
      "status_notes": "Vulnerability CVE-2024-53900 affects version 9.7.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2024-53900"
      },
      "action_statement": "Vulnerability CVE-2024-53900 affects version 9.7.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.0"
          }
        }
      ],
      "timestamp": "2026-11-02T20:07:00.091345+00:00",
      "status_notes": "Vulnerability CVE-2025-23061 affects version 9.7.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2025-23061"
      },
      "action_statement": "Vulnerability CVE-2025-23061 affects version 9.7.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.0"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:04.452255+00:00",
      "status_notes": "Vulnerability CVE-2026-125116 affects version 9.7.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125116"
      },
      "action_statement": "Vulnerability CVE-2026-125116 affects version 9.7.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.0"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:04.452255+00:00",
      "status_notes": "Vulnerability CVE-2026-125117 affects version 9.7.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125117"
      },
      "action_statement": "Vulnerability CVE-2026-125117 affects version 9.7.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.0"
          }
        }
      ],
      "timestamp": "2026-11-10T20:58:50.437512+00:00",
      "status_notes": "Vulnerability CVE-2026-125118 affects version 9.7.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125118"
      },
      "action_statement": "Vulnerability CVE-2026-125118 affects version 9.7.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.0"
          }
        }
      ],
      "timestamp": "2026-11-10T20:03:31.902906+00:00",
      "status_notes": "Vulnerability CVE-2026-125119 affects version 9.7.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125119"
      },
      "action_statement": "Vulnerability CVE-2026-125119 affects version 9.7.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.0"
          }
        }
      ],
      "timestamp": "2026-11-10T19:43:34.920122+00:00",
      "status_notes": "Vulnerability CVE-2026-125120 affects version 9.7.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125120"
      },
      "action_statement": "Vulnerability CVE-2026-125120 affects version 9.7.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.0"
          }
        }
      ],
      "timestamp": "2026-11-02T20:07:00.091345+00:00",
      "status_notes": "Vulnerability CVE-2026-42334 affects version 9.7.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-42334"
      },
      "action_statement": "Vulnerability CVE-2026-42334 affects version 9.7.0 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.0"
          }
        }
      ],
      "timestamp": "2026-10-18T16:00:00.661972+00:00",
      "status_notes": "Vulnerability CVE-2026-73562 affects version 9.7.0 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-73562"
      },
      "action_statement": "Vulnerability CVE-2026-73562 affects version 9.7.0 of mongoose."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.0",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.0"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability GHSA-r5xw-q988-826m does not affect version 9.7.0 of mongoose. not_affected \u2014 Mongoose 9.7.0 is NOT affected by GHSA-r5xw-q988-826m (remote memory exposure via number-to-Buffer casting). The vulnerability was fixed in upstream mongoose commit 8066b145c0 (Jan 15, 2016) by Valeri Karpov, which added validation to convert numbers to arrays before Buffer allocation. This fix was already present in the upstream release when TuxCare onboarded version 9.7.0, making the vulnerab...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r5xw-q988-826m"
      },
      "impact_statement": "not_affected \u2014 Mongoose 9.7.0 is NOT affected by GHSA-r5xw-q988-826m (remote memory exposure via number-to-Buffer casting). The vulnerability was fixed in upstream mongoose commit 8066b145c0 (Jan 15, 2016) by Valeri Karpov, which added validation to convert numbers to arrays before Buffer allocation. This fix was already present in the upstream release when TuxCare onboarded version 9.7.0, making the vulnerab..."
    }
  ]
}