{
  "@id": "urn:uuid:887bed2c-bd08-46c1-ba80-1f739db44a31",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T18:16:55.158687+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/tough-cookie@4.0.0",
          "identifiers": {
            "purl": "pkg:npm/tough-cookie@4.0.0"
          }
        }
      ],
      "timestamp": "2026-11-13T17:45:00.601377+00:00",
      "status_notes": "Vulnerability CVE-2016-1000232 does not affect version 4.0.0 of tough-cookie. Not affected CVE-2016-1000232 / GHSA-qhv9-728r-6jqg: ReDoS in Cookie.parse() via a long run of semicolons. Affected range: tough-cookie < 2.3.0 (fixed upstream in 2.3.0 by https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae, which removed the TRAILING_SEMICOLON regexp). 4.0.0 is far outside that range and does not contain the vulnerable regexp. Checked on 13 Nov 2026 with the upstream regression payload 'foo=bar' + ';'.repeat(262144) + ' domain=example.com': 2.2.2 (vulnerable) 38.8 s, 2.3.2 (fixed) 4.2 s, 4.0.0 (this branch) 4.2 s. Verdict recorded for the audit trail: not affected, CycloneDX justification code_not_present",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-1000232"
      },
      "impact_statement": "Not affected CVE-2016-1000232 / GHSA-qhv9-728r-6jqg: ReDoS in Cookie.parse() via a long run of semicolons. Affected range: tough-cookie < 2.3.0 (fixed upstream in 2.3.0 by https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae, which removed the TRAILING_SEMICOLON regexp). 4.0.0 is far outside that range and does not contain the vulnerable regexp. Checked on 13 Nov 2026 with the upstream regression payload 'foo=bar' + ';'.repeat(262144) + ' domain=example.com': 2.2.2 (vulnerable) 38.8 s, 2.3.2 (fixed) 4.2 s, 4.0.0 (this branch) 4.2 s. Verdict recorded for the audit trail: not affected, CycloneDX justification code_not_present"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/tough-cookie@4.0.0",
          "identifiers": {
            "purl": "pkg:npm/tough-cookie@4.0.0"
          }
        }
      ],
      "timestamp": "2026-11-13T17:45:00.601377+00:00",
      "status_notes": "Vulnerability CVE-2017-15010 does not affect version 4.0.0 of tough-cookie. Not affected CVE-2017-15010 / GHSA-g7q5-pjjr-gqvp: ReDoS in Cookie.parse() via a long run of spaces before \"=\" (issue #92). Affected range: tough-cookie < 2.3.3 (fixed upstream in 2.3.3 by https://github.com/salesforce/tough-cookie/commit/f1ed420a6a92ea7a5418df6e39e676556bc0c71d). 4.0.0 is far outside that range; its cookie-pair parsing no longer backtracks on spaces. Checked on 13 Nov 2026 with the upstream regression payload 'x' + ' '.repeat(65535) + 'x': 2.2.2 2.0 s, 2.3.2 2.0 s (both vulnerable), 4.0.0 (this branch) 0 ms. Verdict recorded for the audit trail: not affected, CycloneDX justification code_not_present",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15010"
      },
      "impact_statement": "Not affected CVE-2017-15010 / GHSA-g7q5-pjjr-gqvp: ReDoS in Cookie.parse() via a long run of spaces before \"=\" (issue #92). Affected range: tough-cookie < 2.3.3 (fixed upstream in 2.3.3 by https://github.com/salesforce/tough-cookie/commit/f1ed420a6a92ea7a5418df6e39e676556bc0c71d). 4.0.0 is far outside that range; its cookie-pair parsing no longer backtracks on spaces. Checked on 13 Nov 2026 with the upstream regression payload 'x' + ' '.repeat(65535) + 'x': 2.2.2 2.0 s, 2.3.2 2.0 s (both vulnerable), 4.0.0 (this branch) 0 ms. Verdict recorded for the audit trail: not affected, CycloneDX justification code_not_present"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/tough-cookie@4.0.0",
          "identifiers": {
            "purl": "pkg:npm/tough-cookie@4.0.0"
          }
        }
      ],
      "timestamp": "2026-11-13T18:16:55.158687+00:00",
      "status_notes": "Vulnerability CVE-2023-26136 affects version 4.0.0 of tough-cookie, and is fixed in 4.0.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2023-26136"
      },
      "action_statement": "Vulnerability CVE-2023-26136 affects version 4.0.0 of tough-cookie, and is fixed in 4.0.0-tuxcare.1."
    }
  ]
}