{
  "@id": "urn:uuid:0a093f0e-2e26-4990-8cc2-085d1fdcd2b9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T21:05:04.452255+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.1",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2019-17426 does not affect version 9.7.1 of mongoose. not_affected \u2014 CVE-2019-17426 affected Mongoose through version 5.7.4 when using bson 1.x. The target repository (Mongoose 9.7.1-tuxcare.1) is not affected because upstream Mongoose fixed this vulnerability in July 2020 (commit f88eb2524) by adding a workaround to delete `_bsontype` properties from query objects. The workaround was later removed in January 2022 (commit 94570a640) after upgrading to bson 4.x, ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17426"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17426 affected Mongoose through version 5.7.4 when using bson 1.x. The target repository (Mongoose 9.7.1-tuxcare.1) is not affected because upstream Mongoose fixed this vulnerability in July 2020 (commit f88eb2524) by adding a workaround to delete `_bsontype` properties from query objects. The workaround was later removed in January 2022 (commit 94570a640) after upgrading to bson 4.x, ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.1",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.1"
          }
        }
      ],
      "timestamp": "2026-11-02T20:06:00.090260+00:00",
      "status_notes": "Vulnerability CVE-2022-24304 affects version 9.7.1 of mongoose.",
      "vulnerability": {
        "name": "CVE-2022-24304"
      },
      "action_statement": "Vulnerability CVE-2022-24304 affects version 9.7.1 of mongoose."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.1",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2022-2564 does not affect version 9.7.1 of mongoose. not_affected \u2014 CVE-2022-2564 (Prototype Pollution in Schema.path()) is NOT present in Mongoose v9.7.1-tuxcare.1. The vulnerability was fixed by upstream maintainer Valeri Karpov in commit 6a197316 (July 2022), which shipped in the upstream release before TuxCare onboarded this version. The fix adds checks for special properties (__proto__, constructor, prototype) in both Schema.prototype.add() and Schema.prot...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2564"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2564 (Prototype Pollution in Schema.path()) is NOT present in Mongoose v9.7.1-tuxcare.1. The vulnerability was fixed by upstream maintainer Valeri Karpov in commit 6a197316 (July 2022), which shipped in the upstream release before TuxCare onboarded this version. The fix adds checks for special properties (__proto__, constructor, prototype) in both Schema.prototype.add() and Schema.prot..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.1",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.1"
          }
        }
      ],
      "timestamp": "2026-11-02T20:06:00.090260+00:00",
      "status_notes": "Vulnerability CVE-2023-3696 affects version 9.7.1 of mongoose.",
      "vulnerability": {
        "name": "CVE-2023-3696"
      },
      "action_statement": "Vulnerability CVE-2023-3696 affects version 9.7.1 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.1",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.1"
          }
        }
      ],
      "timestamp": "2026-11-02T20:06:00.090260+00:00",
      "status_notes": "Vulnerability CVE-2024-53900 affects version 9.7.1 of mongoose.",
      "vulnerability": {
        "name": "CVE-2024-53900"
      },
      "action_statement": "Vulnerability CVE-2024-53900 affects version 9.7.1 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.1",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.1"
          }
        }
      ],
      "timestamp": "2026-11-02T20:07:00.091345+00:00",
      "status_notes": "Vulnerability CVE-2025-23061 affects version 9.7.1 of mongoose.",
      "vulnerability": {
        "name": "CVE-2025-23061"
      },
      "action_statement": "Vulnerability CVE-2025-23061 affects version 9.7.1 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.1",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.1"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:04.452255+00:00",
      "status_notes": "Vulnerability CVE-2026-125116 affects version 9.7.1 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125116"
      },
      "action_statement": "Vulnerability CVE-2026-125116 affects version 9.7.1 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.1",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.1"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:04.452255+00:00",
      "status_notes": "Vulnerability CVE-2026-125117 affects version 9.7.1 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125117"
      },
      "action_statement": "Vulnerability CVE-2026-125117 affects version 9.7.1 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.1",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.1"
          }
        }
      ],
      "timestamp": "2026-11-10T20:58:50.437512+00:00",
      "status_notes": "Vulnerability CVE-2026-125118 affects version 9.7.1 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125118"
      },
      "action_statement": "Vulnerability CVE-2026-125118 affects version 9.7.1 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.1",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.1"
          }
        }
      ],
      "timestamp": "2026-11-10T20:03:31.902906+00:00",
      "status_notes": "Vulnerability CVE-2026-125119 affects version 9.7.1 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125119"
      },
      "action_statement": "Vulnerability CVE-2026-125119 affects version 9.7.1 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.1",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.1"
          }
        }
      ],
      "timestamp": "2026-11-10T19:43:34.920122+00:00",
      "status_notes": "Vulnerability CVE-2026-125120 affects version 9.7.1 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125120"
      },
      "action_statement": "Vulnerability CVE-2026-125120 affects version 9.7.1 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.1",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.1"
          }
        }
      ],
      "timestamp": "2026-11-02T20:07:00.091345+00:00",
      "status_notes": "Vulnerability CVE-2026-42334 affects version 9.7.1 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-42334"
      },
      "action_statement": "Vulnerability CVE-2026-42334 affects version 9.7.1 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.1",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.1"
          }
        }
      ],
      "timestamp": "2026-10-20T09:37:00.091393+00:00",
      "status_notes": "Vulnerability CVE-2026-73562 affects version 9.7.1 of mongoose, and is fixed in 9.7.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-73562"
      },
      "action_statement": "Vulnerability CVE-2026-73562 affects version 9.7.1 of mongoose, and is fixed in 9.7.1-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.1",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability GHSA-r5xw-q988-826m does not affect version 9.7.1 of mongoose. not_affected \u2014 Target mongoose 9.7.1-tuxcare.1 is NOT AFFECTED by GHSA-r5xw-q988-826m (remote memory exposure via uninitialized Buffer allocation). The vulnerability affected versions before 4.3.6/3.8.39 where assigning a number to a Buffer field used `new Buffer(val)`, allocating uninitialized memory. The fix (commit 4a1c77b87 from 2018-08-07 by upstream contributor Fonger) replaced this with `Buffer.alloc(v...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r5xw-q988-826m"
      },
      "impact_statement": "not_affected \u2014 Target mongoose 9.7.1-tuxcare.1 is NOT AFFECTED by GHSA-r5xw-q988-826m (remote memory exposure via uninitialized Buffer allocation). The vulnerability affected versions before 4.3.6/3.8.39 where assigning a number to a Buffer field used `new Buffer(val)`, allocating uninitialized memory. The fix (commit 4a1c77b87 from 2018-08-07 by upstream contributor Fonger) replaced this with `Buffer.alloc(v..."
    }
  ]
}