{ "@id": "urn:uuid:eded2c80-7bd6-44aa-ab7a-ef78760fb3bf", "role": "Document Creator", "author": "https://tuxcare.com", "version": 47, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:57:29.427470+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45143 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2023-45143" }, "action_statement": "Vulnerability CVE-2023-45143 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24758 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2024-24758" }, "action_statement": "Vulnerability CVE-2024-24758 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30260 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2024-30260" }, "action_statement": "Vulnerability CVE-2024-30260 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30261 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2024-30261" }, "action_statement": "Vulnerability CVE-2024-30261 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-22150 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2025-22150" }, "action_statement": "Vulnerability CVE-2025-22150 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47279 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2025-47279" }, "action_statement": "Vulnerability CVE-2025-47279 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-10-15T18:43:00.151252+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 5.25.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T21:14:00.047255+00:00", "status_notes": "Vulnerability CVE-2026-109829 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3. The vulnerable pieces (the HTTP cache interceptor, shared MemoryCacheStore/SqliteCacheStore, and interceptor compose()) were introduced in undici 7.0.0 and do not exist in this tree. The only interceptor is lib/interceptor/redirectInterceptor.js. There is no code that stores redirect responses under the original request key, so the flaw cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109829" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3. The vulnerable pieces (the HTTP cache interceptor, shared MemoryCacheStore/SqliteCacheStore, and interceptor compose()) were introduced in undici 7.0.0 and do not exist in this tree. The only interceptor is lib/interceptor/redirectInterceptor.js. There is no code that stores redirect responses under the original request key, so the flaw cannot occur." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T21:17:27.820564+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 5.25.3 of undici. not_affected \u2014 undici 5.25.3 is not affected. The case-sensitive SRI token lookup was a regression introduced in 7.15.0, and this older tree does not contain it. parseMetadata() in lib/fetch/util.js lowercases the token before checking it against crypto.getHashes(), and the regex is case-insensitive. A token such as SHA256-... is therefore recognized and verified, not skipped.", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 undici 5.25.3 is not affected. The case-sensitive SRI token lookup was a regression introduced in 7.15.0, and this older tree does not contain it. parseMetadata() in lib/fetch/util.js lowercases the token before checking it against crypto.getHashes(), and the regex is case-insensitive. A token such as SHA256-... is therefore recognized and verified, not skipped." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-14T02:57:29.427470+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3. The CVE is a regression introduced in undici 8.11.0, which added WebSocket-over-HTTP/2. This tree does not support WebSocket upgrades over H2: writeH2() rejects any upgrade request before a stream is created. HTTP/2 is also opt-in (allowH2 defaults to false). No orphaned ClientHttp2Stream can result from a failed WebSocket handshake.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3. The CVE is a regression introduced in undici 8.11.0, which added WebSocket-over-HTTP/2. This tree does not support WebSocket upgrades over H2: writeH2() rejects any upgrade request before a stream is created. HTTP/2 is also opt-in (allowH2 defaults to false). No orphaned ClientHttp2Stream can result from a failed WebSocket handshake." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T21:09:51.991863+00:00", "status_notes": "Vulnerability CVE-2026-109869 does not affect version 5.25.3 of undici. not_affected \u2014 undici 5.25.3 has no content-encoding count limit, so the rejection path that orphans an unobserved internal stream does not exist. In onHeaders (lib/fetch/index.js:1973-2057), the body Readable is always handed to pipeline() with a callback or given an 'error' listener before resolve(). The CVE names only the 6.x, 7.x and 8.x lines, and none of the vulnerable behavior is present in this 5.x tree.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109869" }, "impact_statement": "not_affected \u2014 undici 5.25.3 has no content-encoding count limit, so the rejection path that orphans an unobserved internal stream does not exist. In onHeaders (lib/fetch/index.js:1973-2057), the body Readable is always handed to pipeline() with a callback or given an 'error' listener before resolve(). The CVE names only the 6.x, 7.x and 8.x lines, and none of the vulnerable behavior is present in this 5.x tree." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T21:12:00.068117+00:00", "status_notes": "Vulnerability CVE-2026-109924 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3. It has no EventSource client and no Server-Sent Events parser, so the unbounded parser-state memory exhaustion in CVE-2026-109924 cannot occur. The EventSource implementation was added in a later undici line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109924" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3. It has no EventSource client and no Server-Sent Events parser, so the unbounded parser-state memory exhaustion in CVE-2026-109924 cannot occur. The EventSource implementation was added in a later undici line." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 5.25.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T21:25:37.080118+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 5.25.3 of undici. not_affected \u2014 undici 5.25.3 has no dispatcher-level shared HTTP cache interceptor and nothing that generates If-None-Match or If-Modified-Since validators from stored responses. Only redirectInterceptor exists in lib/interceptor. The fetch implementation never revalidates (revalidatingFlag is a constant false). The Cache Storage API in lib/cache is a different component and does no conditional revalidation. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 undici 5.25.3 has no dispatcher-level shared HTTP cache interceptor and nothing that generates If-None-Match or If-Modified-Since validators from stored responses. Only redirectInterceptor exists in lib/interceptor. The fetch implementation never revalidates (revalidatingFlag is a constant false). The Cache Storage API in lib/cache is a different component and does no conditional revalidation. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T21:21:48.734291+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3, which predates the affected 7.x/8.x lines. It has no HTTP cache interceptor, no dump interceptor and no decompress interceptor. The CVE's replay-then-throw chain cannot exist. The only interceptor is the redirect interceptor, and lib/cache is the Fetch Cache API (CacheStorage), not a dispatcher cache interceptor.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3, which predates the affected 7.x/8.x lines. It has no HTTP cache interceptor, no dump interceptor and no decompress interceptor. The CVE's replay-then-throw chain cannot exist. The only interceptor is the redirect interceptor, and lib/cache is the Fetch Cache API (CacheStorage), not a dispatcher cache interceptor." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T21:23:00.051505+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3, which predates the affected ranges (7.0.0-7.30.1, 8.0.0-8.12.3). Its RedirectHandler only handles flat name/value arrays and plain objects. The tuple-array header form is rejected by core Request validation, and the target has no cache or deduplicate interceptor to re-serialize retained headers. The CVE's chain from tuple-array headers to credential disclosure on a cros...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3, which predates the affected ranges (7.0.0-7.30.1, 8.0.0-8.12.3). Its RedirectHandler only handles flat name/value arrays and plain objects. The tuple-array header form is rejected by core Request validation, and the target has no cache or deduplicate interceptor to re-serialize retained headers. The CVE's chain from tuple-array headers to credential disclosure on a cros..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T21:24:42.697192+00:00", "status_notes": "Vulnerability CVE-2026-120423 does not affect version 5.25.3 of undici. not_affected \u2014 undici 5.25.3 is outside the CVE's affected ranges (7.15.0-7.30.1 and 8.0.0-8.12.3). Its parseMetadata still splits on a single space (lib/fetch/util.js:616), but the token regex is unanchored and `.` matches a tab. A whitespace-prefixed digest is therefore still recognized and verified. The CVE's skipped-token bypass does not occur: the check either verifies the body or fails closed.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120423" }, "impact_statement": "not_affected \u2014 undici 5.25.3 is outside the CVE's affected ranges (7.15.0-7.30.1 and 8.0.0-8.12.3). Its parseMetadata still splits on a single space (lib/fetch/util.js:616), but the token regex is unanchored and `.` matches a tab. A whitespace-prefixed digest is therefore still recognized and verified. The CVE's skipped-token bypass does not occur: the check either verifies the body or fails closed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T21:20:59.401455+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3, which predates the HTTP cache interceptor and shared response-cache store that CVE-2026-120474 (affecting 7.0.0-7.30.1 and 8.0.0-8.12.3) requires. The redirect interceptor exists, but no component stores dispatcher responses under a request-derived cache key, so the cross-user cache disclosure chain cannot exist here.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3, which predates the HTTP cache interceptor and shared response-cache store that CVE-2026-120474 (affecting 7.0.0-7.30.1 and 8.0.0-8.12.3) requires. The redirect interceptor exists, but no component stores dispatcher responses under a request-derived cache key, so the cross-user cache disclosure chain cannot exist here." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 5.25.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T20:09:00.046186+00:00", "status_notes": "Vulnerability CVE-2026-13697 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3. It has no HTTP cache interceptor (interceptors.cache()), no shared or private response cache, and no Cache-Control response parser. lib/util/cache.js, which the upstream fix modifies, does not exist. The only interceptor is redirectInterceptor. lib/cache/ is the WHATWG Cache API (CacheStorage), which stores only what callers explicitly put and does not parse `private` d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-13697" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3. It has no HTTP cache interceptor (interceptors.cache()), no shared or private response cache, and no Cache-Control response parser. lib/util/cache.js, which the upstream fix modifies, does not exist. The only interceptor is redirectInterceptor. lib/cache/ is the WHATWG Cache API (CacheStorage), which stores only what callers explicitly put and does not parse `private` d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T20:07:00.106745+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3, which predates the HTTP cache interceptor (interceptors.cache(), shared-cache mode, Cache-Control response directive parsing). No code parses response Cache-Control directives like no-cache/private with field-name lists, so the CVE-2026-14643 flaw cannot exist here. Same product lineage, so not a false_positive.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3, which predates the HTTP cache interceptor (interceptors.cache(), shared-cache mode, Cache-Control response directive parsing). No code parses response Cache-Control directives like no-cache/private with field-name lists, so the CVE-2026-14643 flaw cannot exist here. Same product lineage, so not a false_positive." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1525 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2026-1525" }, "action_statement": "Vulnerability CVE-2026-1525 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1527 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2026-1527" }, "action_statement": "Vulnerability CVE-2026-1527 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1528 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2026-1528" }, "action_statement": "Vulnerability CVE-2026-1528 affects version 5.25.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T20:03:00.065439+00:00", "status_notes": "Vulnerability CVE-2026-16728 does not affect version 5.25.3 of undici. not_affected \u2014 undici 5.25.3 has no retry interceptor or retry handler. The CVE-2026-16728 flaw is in `interceptors.retry()` (the RetryHandler), which resumes a partial response with a Range request and passes the stale first-response Content-Length to the application. That code does not exist in this release, so the Content-Length mismatch cannot occur here. The patch diff could not be fetched, so the fix wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16728" }, "impact_statement": "not_affected \u2014 undici 5.25.3 has no retry interceptor or retry handler. The CVE-2026-16728 flaw is in `interceptors.retry()` (the RetryHandler), which resumes a partial response with a Range request and passes the stale first-response Content-Length to the application. That code does not exist in this release, so the Content-Length mismatch cannot occur here. The patch diff could not be fetched, so the fix wa..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 5.25.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T20:54:00.045132+00:00", "status_notes": "Vulnerability CVE-2026-18149 does not affect version 5.25.3 of undici. not_affected \u2014 undici 5.25.3 has no RetryHandler or any retry logic, so CVE-2026-18149 (original response body left pending when a retried request gets a non-retryable response after a truncated one) cannot occur. The retry feature was added in a later undici line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-18149" }, "impact_statement": "not_affected \u2014 undici 5.25.3 has no RetryHandler or any retry logic, so CVE-2026-18149 (original response body left pending when a retried request gets a non-retryable response after a truncated one) cannot occur. The retry feature was added in a later undici line." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T20:58:00.045389+00:00", "status_notes": "Vulnerability CVE-2026-18540 does not affect version 5.25.3 of undici. not_affected \u2014 Target undici 5.25.3 has no retry interceptor or RetryHandler (introduced in later 5.x), so the retry-resume-append flaw in CVE-2026-18540 cannot occur. The only handlers are DecoratorHandler and RedirectHandler.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-18540" }, "impact_statement": "not_affected \u2014 Target undici 5.25.3 has no retry interceptor or RetryHandler (introduced in later 5.x), so the retry-resume-append flaw in CVE-2026-18540 cannot occur. The only handlers are DecoratorHandler and RedirectHandler." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T21:09:00.036652+00:00", "status_notes": "Vulnerability CVE-2026-19534 does not affect version 5.25.3 of undici. not_affected \u2014 undici 5.25.3 (before the 6.7.0 introduction point) handles an unrequested Sec-WebSocket-Protocol in the 101 response by calling failWebsocketConnection, which destroys the socket and fires an 'error' event. The throw that crashes the process in 6.7.0+ is not present in this code.", "vulnerability": { "name": "CVE-2026-19534" }, "impact_statement": "not_affected \u2014 undici 5.25.3 (before the 6.7.0 introduction point) handles an unrequested Sec-WebSocket-Protocol in the 101 response by calling failWebsocketConnection, which destroys the socket and fires an 'error' event. The throw that crashes the process in 6.7.0+ is not present in this code." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22036 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2026-22036" }, "action_statement": "Vulnerability CVE-2026-22036 affects version 5.25.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 5.25.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-14T01:30:50.391236+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3. The deduplicate interceptor (interceptors.deduplicate()) and its deduplication handler do not exist anywhere in the tree. The only interceptor is lib/interceptor/redirectInterceptor.js. The memory-accumulation flaw therefore cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3. The deduplicate interceptor (interceptors.deduplicate()) and its deduplication handler do not exist anywhere in the tree. The only interceptor is lib/interceptor/redirectInterceptor.js. The memory-accumulation flaw therefore cannot occur." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 5.25.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T20:09:39.760132+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3. It has no SOCKS5 proxy support: no Socks5ProxyAgent, and no \"socks\" string anywhere in the tree. The CVE says the bug was introduced in 7.23.0 by PR #4385, which this version predates. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3. It has no SOCKS5 proxy support: no Socks5ProxyAgent, and no \"socks\" string anywhere in the tree. The CVE says the bug was introduced in 7.23.0 by PR #4385, which this version predates. Not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T20:49:00.046850+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 5.25.3 of undici. not_affected \u2014 undici 5.25.3 has no interceptors.decompress() interceptor, which is the component CVE-2026-84890 and its fix (a maxSize option) concern. The only built-in interceptor is the redirect interceptor. The only Content-Encoding decoding is inside fetch(), which is a different, spec-defined code path that the patch does not touch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 undici 5.25.3 has no interceptors.decompress() interceptor, which is the component CVE-2026-84890 and its fix (a maxSize option) concern. The only built-in interceptor is the redirect interceptor. The only Content-Encoding decoding is inside fetch(), which is a different, spec-defined code path that the patch does not touch." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T20:42:47.265621+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 5.25.3 of undici. not_affected \u2014 undici 5.25.3 has no HTTP caching interceptor (`interceptors.cache()`), no shared/private cache store and no cache handler. The only interceptor in the tree is the redirect interceptor. The `lib/cache` directory is the WHATWG Cache Storage API, a different component with no `type: 'shared'` mode. The CVE's affected component (the cache interceptor added in later undici lines) is absent, so ther...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 undici 5.25.3 has no HTTP caching interceptor (`interceptors.cache()`), no shared/private cache store and no cache handler. The only interceptor in the tree is the redirect interceptor. The `lib/cache` directory is the WHATWG Cache Storage API, a different component with no `type: 'shared'` mode. The CVE's affected component (the cache interceptor added in later undici lines) is absent, so ther..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T20:20:12.381520+00:00", "status_notes": "Vulnerability CVE-2026-84947 does not affect version 5.25.3 of undici. not_affected \u2014 undici 5.25.3 has no interceptors.dump() interceptor. lib/interceptor/ holds only redirectInterceptor.js, and index.js exports no `interceptors` namespace and no dump interceptor. The only 'dump' in lib/api is the consumer-side BodyReadable.dump(), a different mechanism that does not produce the CVE's outcome. The target is the same product (undici) but an older version that predates the vulner...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84947" }, "impact_statement": "not_affected \u2014 undici 5.25.3 has no interceptors.dump() interceptor. lib/interceptor/ holds only redirectInterceptor.js, and index.js exports no `interceptors` namespace and no dump interceptor. The only 'dump' in lib/api is the consumer-side BodyReadable.dump(), a different mechanism that does not produce the CVE's outcome. The target is the same product (undici) but an older version that predates the vulner..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T20:42:00.077125+00:00", "status_notes": "Vulnerability CVE-2026-84961 does not affect version 5.25.3 of undici. not_affected \u2014 The target is undici 5.25.3. Its BalancedPool does not JSON-clone its constructor options, so function-valued connect/tls options (such as checkServerIdentity) are forwarded to each per-upstream Pool unchanged. The CVE's chain, in which a JSON round-trip in BalancedPool drops the callbacks, does not exist in this version. Separate observation outside the CVE's scope: Agent does JSON-clone a non...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-84961" }, "impact_statement": "not_affected \u2014 The target is undici 5.25.3. Its BalancedPool does not JSON-clone its constructor options, so function-valued connect/tls options (such as checkServerIdentity) are forwarded to each per-upstream Pool unchanged. The CVE's chain, in which a JSON round-trip in BalancedPool drops the callbacks, does not exist in this version. Separate observation outside the CVE's scope: Agent does JSON-clone a non..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T20:30:47.394503+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3, which has no HTTP caching interceptor (`interceptors.cache()`, `CacheHandler`, `canCacheResponse`, or cache stores). The vulnerable component was introduced in much later undici releases (7.x/8.x), so the CVE's flaw is not present in this tree. The only cache code is the Fetch Cache API (lib/cache), which rejects non-GET methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3, which has no HTTP caching interceptor (`interceptors.cache()`, `CacheHandler`, `canCacheResponse`, or cache stores). The vulnerable component was introduced in much later undici releases (7.x/8.x), so the CVE's flaw is not present in this tree. The only cache code is the Fetch Cache API (lib/cache), which rejects non-GET methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T20:18:00.067289+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3, which predates WebSocketStream (introduced in 7.0.0). The repo's lib/ has no WebSocketStream implementation and no WritableStream/writer-based websocket code. The vulnerable code path (socket-close handler calling abort() on a locked writable stream) does not exist. Not affected (Type A1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3, which predates WebSocketStream (introduced in 7.0.0). The repo's lib/ has no WebSocketStream implementation and no WritableStream/writer-based websocket code. The vulnerable code path (socket-close handler calling abort() on a locked writable stream) does not exist. Not affected (Type A1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-14T02:11:00.074412+00:00", "status_notes": "Vulnerability CVE-2026-85024 does not affect version 5.25.3 of undici. not_affected \u2014 undici 5.25.3 has no permessage-deflate implementation. lib/websocket/permessage-deflate.js does not exist, and the repo has no zlib InflateRaw use in the WebSocket code. The client never offers the extension, and it fails the connection if a server answers with one. The vulnerable pattern is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85024" }, "impact_statement": "not_affected \u2014 undici 5.25.3 has no permessage-deflate implementation. lib/websocket/permessage-deflate.js does not exist, and the repo has no zlib InflateRaw use in the WebSocket code. The client never offers the extension, and it fails the connection if a server answers with one. The vulnerable pattern is absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-14T02:28:42.740195+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3. The CVE concerns interceptors.cache() and interceptors.deduplicate(), introduced in undici 8.10.0 (affects 8.10.0 and 8.10.1). Neither exists in this tree, and there is no HTTP cache or dedup key-building code that can mix origins. Same product lineage (undici), so not a false_positive. Not affected (Type A1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3. The CVE concerns interceptors.cache() and interceptors.deduplicate(), introduced in undici 8.10.0 (affects 8.10.0 and 8.10.1). Neither exists in this tree, and there is no HTTP cache or dedup key-building code that can mix origins. Same product lineage (undici), so not a false_positive. Not affected (Type A1)." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-10-15T18:47:21.529900+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 5.25.3 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 5.25.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T21:19:00.470464+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3. It has no `decompress` interceptor and no `dump` interceptor. The only zlib use is fetch's response decoding, which pipes into a Readable via stream.pipeline. No code forwards decompressed data from a zlib callback into a downstream handler that can throw, so the CVE's crash chain does not exist here.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3. It has no `decompress` interceptor and no `dump` interceptor. The only zlib use is fetch's response decoding, which pipes into a Readable via stream.pipeline. No code forwards decompressed data from a zlib callback into a downstream handler that can throw, so the CVE's crash chain does not exist here." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-14T01:51:00.048861+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 5.25.3 of undici. not_affected \u2014 CVE-2026-9675 is a regression in the maxPayloadSize feature added in undici 8.1.0: the per-frame limit was enforced but the cumulative size of fragmented messages was not. The target (undici 5.25.3) has no maxPayloadSize option or any other payload-size limit, so the regressed check is not present. The advisory says the 7.x line, which also lacks the feature, is unaffected. I did not read the t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 CVE-2026-9675 is a regression in the maxPayloadSize feature added in undici 8.1.0: the per-frame limit was enforced but the cumulative size of fragmented messages was not. The target (undici 5.25.3) has no maxPayloadSize option or any other payload-size limit, so the regressed check is not present. The advisory says the 7.x line, which also lacks the feature, is unaffected. I did not read the t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T20:11:00.069805+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3. It has no HTTP cache interceptor (interceptors.cache(), cache stores, or Cache-Control parsing). The only interceptor is redirectInterceptor.js. lib/cache/* is the WHATWG Cache Storage API, which never parses a response Cache-Control header. The vulnerable component, the shared-mode cache interceptor added in later 7.x/8.x lines, is absent, so the CVE's chain cannot be ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3. It has no HTTP cache interceptor (interceptors.cache(), cache stores, or Cache-Control parsing). The only interceptor is redirectInterceptor.js. lib/cache/* is the WHATWG Cache Storage API, which never parses a response Cache-Control header. The vulnerable component, the shared-mode cache interceptor added in later 7.x/8.x lines, is absent, so the CVE's chain cannot be ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T20:01:00.036985+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 5.25.3 of undici. not_affected \u2014 undici 5.25.3 is not affected. Its cookie parser (lib/cookies/parse.js) never percent-decodes cookie values. The qsUnescape decoding was introduced in undici 7.0.0 (PR #3789) and does not exist in this 5.x tree. parseSetCookie returns the value exactly as received (trimmed only).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 undici 5.25.3 is not affected. Its cookie parser (lib/cookies/parse.js) never percent-decodes cookie values. The qsUnescape decoding was introduced in undici 7.0.0 (PR #3789) and does not exist in this 5.x tree. parseSetCookie returns the value exactly as received (trimmed only)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@5.25.3", "identifiers": { "purl": "pkg:npm/undici@5.25.3" } } ], "timestamp": "2026-11-13T20:11:32.988243+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 5.25.3 of undici. not_affected \u2014 Target is undici 5.25.3, which has no SOCKS5 support. SOCKS5 was added in 7.23.0, and the CVE's flaw is that requestTls is dropped in the SOCKS5 path. The repo has no Socks5ProxyAgent and nothing handles socks:// or socks5:// URIs. The HTTP-CONNECT ProxyAgent that does exist honors requestTls (the CVE itself says so). Product identity matches (undici), so this is not a false positive.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 Target is undici 5.25.3, which has no SOCKS5 support. SOCKS5 was added in 7.23.0, and the CVE's flaw is that requestTls is dropped in the SOCKS5 path. The repo has no Socks5ProxyAgent and nothing handles socks:// or socks5:// URIs. The HTTP-CONNECT ProxyAgent that does exist honors requestTls (the CVE itself says so). Product identity matches (undici), so this is not a false positive." } ] }