{
  "@id": "urn:uuid:f342b789-1bc9-4b70-8565-3900e4a718b5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T21:05:07.936188+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.4",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2019-17426 does not affect version 9.7.4 of mongoose. not_affected \u2014 CVE-2019-17426 affected Mongoose through version 5.7.4 due to a bson 1.x parser bug where query filters with top-level `_bsontype` properties were ignored, enabling access control bypass. Target version 9.7.4 uses mongodb ~7.2 with bson 4.x+, which fixed the underlying parser bug. The workaround code that deleted `_bsontype` was intentionally removed in 2022 (commit 94570a640) as obsolete after...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2019-17426"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17426 affected Mongoose through version 5.7.4 due to a bson 1.x parser bug where query filters with top-level `_bsontype` properties were ignored, enabling access control bypass. Target version 9.7.4 uses mongodb ~7.2 with bson 4.x+, which fixed the underlying parser bug. The workaround code that deleted `_bsontype` was intentionally removed in 2022 (commit 94570a640) as obsolete after..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.4",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2022-24304 does not affect version 9.7.4 of mongoose. not_affected \u2014 CVE-2022-24304 describes a Prototype Pollution vulnerability in Mongoose's Schema.path() function. Analysis of Mongoose v9.7.4 at SHA 37b57df880f8efc65f6cce15946ff2cc2e1b5c46 confirms the target is NOT AFFECTED. The vulnerable pattern is not present because an upstream fix (commit 6a1973165) authored by Valeri Karpov (val@karpov.io) was already included in the upstream release before TuxCare on...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24304"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24304 describes a Prototype Pollution vulnerability in Mongoose's Schema.path() function. Analysis of Mongoose v9.7.4 at SHA 37b57df880f8efc65f6cce15946ff2cc2e1b5c46 confirms the target is NOT AFFECTED. The vulnerable pattern is not present because an upstream fix (commit 6a1973165) authored by Valeri Karpov (val@karpov.io) was already included in the upstream release before TuxCare on..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.4",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2022-2564 does not affect version 9.7.4 of mongoose. not_affected \u2014 CVE-2022-2564 (prototype pollution in Schema.path()) was fixed by upstream Mongoose in July 2022 (commit 6a19731), 4 years before TuxCare began maintaining this repository. The fix blocks special properties (__proto__, constructor, prototype) in three critical locations: Schema.prototype.add() (line 799), Schema.prototype.path() last-segment check (line 1301), and Schema.prototype.path() all-se...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2564"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2564 (prototype pollution in Schema.path()) was fixed by upstream Mongoose in July 2022 (commit 6a19731), 4 years before TuxCare began maintaining this repository. The fix blocks special properties (__proto__, constructor, prototype) in three critical locations: Schema.prototype.add() (line 799), Schema.prototype.path() last-segment check (line 1301), and Schema.prototype.path() all-se..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.4",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2023-3696 does not affect version 9.7.4 of mongoose. not_affected \u2014 CVE-2023-3696 prototype pollution vulnerability is NOT present in mongoose 9.7.4. The fix was applied in upstream commit e29578d2ec (July 2023) as part of version 7.3.3, and is present in the current version. The fix adds checks to skip special properties (__proto__, constructor, prototype) during document initialization, preventing prototype pollution attacks.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-3696"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-3696 prototype pollution vulnerability is NOT present in mongoose 9.7.4. The fix was applied in upstream commit e29578d2ec (July 2023) as part of version 7.3.3, and is present in the current version. The fix adds checks to skip special properties (__proto__, constructor, prototype) during document initialization, preventing prototype pollution attacks."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.4",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.4"
          }
        }
      ],
      "timestamp": "2026-11-02T20:06:00.090260+00:00",
      "status_notes": "Vulnerability CVE-2024-53900 affects version 9.7.4 of mongoose.",
      "vulnerability": {
        "name": "CVE-2024-53900"
      },
      "action_statement": "Vulnerability CVE-2024-53900 affects version 9.7.4 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.4",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.4"
          }
        }
      ],
      "timestamp": "2026-11-02T20:07:00.091345+00:00",
      "status_notes": "Vulnerability CVE-2025-23061 affects version 9.7.4 of mongoose.",
      "vulnerability": {
        "name": "CVE-2025-23061"
      },
      "action_statement": "Vulnerability CVE-2025-23061 affects version 9.7.4 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.4",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.4"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:07.936188+00:00",
      "status_notes": "Vulnerability CVE-2026-125116 affects version 9.7.4 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125116"
      },
      "action_statement": "Vulnerability CVE-2026-125116 affects version 9.7.4 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.4",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.4"
          }
        }
      ],
      "timestamp": "2026-11-10T21:05:04.452255+00:00",
      "status_notes": "Vulnerability CVE-2026-125117 affects version 9.7.4 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125117"
      },
      "action_statement": "Vulnerability CVE-2026-125117 affects version 9.7.4 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.4",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.4"
          }
        }
      ],
      "timestamp": "2026-11-10T20:58:50.437512+00:00",
      "status_notes": "Vulnerability CVE-2026-125118 affects version 9.7.4 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125118"
      },
      "action_statement": "Vulnerability CVE-2026-125118 affects version 9.7.4 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.4",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.4"
          }
        }
      ],
      "timestamp": "2026-11-10T20:03:31.902906+00:00",
      "status_notes": "Vulnerability CVE-2026-125119 affects version 9.7.4 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125119"
      },
      "action_statement": "Vulnerability CVE-2026-125119 affects version 9.7.4 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.4",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.4"
          }
        }
      ],
      "timestamp": "2026-11-10T19:43:34.920122+00:00",
      "status_notes": "Vulnerability CVE-2026-125120 affects version 9.7.4 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-125120"
      },
      "action_statement": "Vulnerability CVE-2026-125120 affects version 9.7.4 of mongoose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.4",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.4"
          }
        }
      ],
      "timestamp": "2026-11-02T20:07:00.091345+00:00",
      "status_notes": "Vulnerability CVE-2026-42334 affects version 9.7.4 of mongoose.",
      "vulnerability": {
        "name": "CVE-2026-42334"
      },
      "action_statement": "Vulnerability CVE-2026-42334 affects version 9.7.4 of mongoose."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.4",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2026-73562 does not affect version 9.7.4 of mongoose. not_affected \u2014 Target Mongoose 9.7.4 is not affected by CVE-2026-73562. The prototype pollution vulnerability in update casting was fixed by upstream (Automattic/mongoose) in version 9.7.2, released June 22, 2026. All three critical defense mechanisms are present in the target: (1) lib/schema.js uses Object.hasOwn() and blocks special properties (__proto__, constructor, prototype); (2) lib/document.js uses Ob...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-73562"
      },
      "impact_statement": "not_affected \u2014 Target Mongoose 9.7.4 is not affected by CVE-2026-73562. The prototype pollution vulnerability in update casting was fixed by upstream (Automattic/mongoose) in version 9.7.2, released June 22, 2026. All three critical defense mechanisms are present in the target: (1) lib/schema.js uses Object.hasOwn() and blocks special properties (__proto__, constructor, prototype); (2) lib/document.js uses Ob..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/mongoose@9.7.4",
          "identifiers": {
            "purl": "pkg:npm/mongoose@9.7.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability GHSA-r5xw-q988-826m does not affect version 9.7.4 of mongoose. not_affected \u2014 Target version 9.7.4 is NOT affected by GHSA-r5xw-q988-826m (remote memory exposure via uninitialized buffer allocation). The vulnerability was fixed in upstream commit 4a1c77b87 (August 2018) which replaced unsafe `new Buffer(number)` with safe `Buffer.alloc(number)`. This fix was shipped in upstream version 5.10.0, well before any TuxCare involvement. The target contains the fixed code that p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r5xw-q988-826m"
      },
      "impact_statement": "not_affected \u2014 Target version 9.7.4 is NOT affected by GHSA-r5xw-q988-826m (remote memory exposure via uninitialized buffer allocation). The vulnerability was fixed in upstream commit 4a1c77b87 (August 2018) which replaced unsafe `new Buffer(number)` with safe `Buffer.alloc(number)`. This fix was shipped in upstream version 5.10.0, well before any TuxCare involvement. The target contains the fixed code that p..."
    }
  ]
}