{ "@id": "urn:uuid:739ffe84-5d4f-4314-b238-e72de47ee5e6", "role": "Document Creator", "author": "https://tuxcare.com", "version": 46, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:48:45.028933+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 6.11.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 6.11.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 6.11.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 6.11.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 6.11.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 6.11.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 6.11.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-13T23:58:04.151997+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 6.11.1 of undici. not_affected \u2014 Target undici 6.11.1 already deletes the cookie header (along with authorization, proxy-authorization and host) on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The upstream fix commit e041de35 (author maitken033380023@gmail.com, committer GitHub) is an ancestor of HEAD and predates the first TuxCare commit, so the fix shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Target undici 6.11.1 already deletes the cookie header (along with authorization, proxy-authorization and host) on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The upstream fix commit e041de35 (author maitken033380023@gmail.com, committer GitHub) is an ancestor of HEAD and predates the first TuxCare commit, so the fix shipped in the upstream release." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 6.11.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-13T22:18:45.848472+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 6.11.1 of undici. not_affected \u2014 Target undici 6.11.1 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the core RedirectHandler. The fix is the upstream commit b9da3e40 (Matteo Collina), which is an ancestor of the first TuxCare commit. It shipped in the upstream release, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Target undici 6.11.1 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the core RedirectHandler. The fix is the upstream commit b9da3e40 (Matteo Collina), which is an ancestor of the first TuxCare commit. It shipped in the upstream release, so the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-14T00:20:08.913417+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 6.11.1 of undici. not_affected \u2014 Not affected. The target is undici 6.11.1-tuxcare.10, and the upstream release 6.11.1 already contains the CVE-2024-30260 fix. The redirect handler strips authorization, proxy-authorization and cookie headers when a redirect goes to a different origin. This applies to undici.request() as well as fetch().", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 Not affected. The target is undici 6.11.1-tuxcare.10, and the upstream release 6.11.1 already contains the CVE-2024-30260 fix. The redirect handler strips authorization, proxy-authorization and cookie headers when a redirect goes to a different origin. This applies to undici.request() as well as fetch()." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-13T23:30:50.888775+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 6.11.1 of undici. not_affected \u2014 Target undici 6.11.1 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd). The fix is an ancestor of HEAD and of the first TuxCare commit (dc21d3e6, onboarding), so it shipped in the upstream release. The old integrity comparison was replaced with strongest-algorithm selection plus a strict base64/base64url comparison.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Target undici 6.11.1 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd). The fix is an ancestor of HEAD and of the first TuxCare commit (dc21d3e6, onboarding), so it shipped in the upstream release. The old integrity comparison was replaced with strongest-algorithm selection plus a strict base64/base64url comparison." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 6.11.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-22150 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.1.", "vulnerability": { "name": "CVE-2025-22150" }, "action_statement": "Vulnerability CVE-2025-22150 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47279 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.1.", "vulnerability": { "name": "CVE-2025-47279" }, "action_statement": "Vulnerability CVE-2025-47279 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-10-31T12:26:51.699226+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.9.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:06:00.064776+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 6.11.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T13:25:37.649409+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 6.11.1 of undici. not_affected \u2014 Target undici 6.11.1-tuxcare.9 does not have the SRI case-sensitivity regression. parseMetadata matches the algorithm token case-insensitively and lowercases it before checking supportedHashes, so SHA256-/Sha256- tokens are recognized and verified. At worst, some mixed-case multi-hash lists are rejected (fail-closed), not accepted.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 Target undici 6.11.1-tuxcare.9 does not have the SRI case-sensitivity regression. parseMetadata matches the algorithm token case-insensitively and lowercases it before checking supportedHashes, so SHA256-/Sha256- tokens are recognized and verified. At worst, some mixed-case multi-hash lists are rejected (fail-closed), not accepted." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-14T02:48:45.028933+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 6.11.1 of undici. not_affected \u2014 Not affected. This tree is undici 6.11.1-tuxcare.10. The CVE is a regression introduced in 8.11.0, which added WebSocket-over-HTTP/2. Here, a WebSocket upgrade request is rejected on H2 before any ClientHttp2Stream is created, so no orphaned stream exists. H2 is also off by default.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Not affected. This tree is undici 6.11.1-tuxcare.10. The CVE is a regression introduced in 8.11.0, which added WebSocket-over-HTTP/2. Here, a WebSocket upgrade request is rejected on H2 before any ClientHttp2Stream is created, so no orphaned stream exists. H2 is also off by default." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:05:31.171802+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 6.11.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-10-27T14:39:49.861389+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.8.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-10-31T12:26:51.699226+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.9.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 6.11.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T10:32:00.039627+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 6.11.1 of undici. not_affected \u2014 Target is undici 6.11.1-tuxcare.9. The CVE affects only undici 7.0.0-7.30.1 and 8.0.0-8.12.3, which ship the shared cache interceptor. The 6.x tree has no cache interceptor, cache store, or conditional revalidation. Its redirect handler therefore cannot forward cache-generated If-None-Match or If-Modified-Since validators, and nothing exists to treat a cross-origin 304 as a successful revalidat...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 Target is undici 6.11.1-tuxcare.9. The CVE affects only undici 7.0.0-7.30.1 and 8.0.0-8.12.3, which ship the shared cache interceptor. The 6.x tree has no cache interceptor, cache store, or conditional revalidation. Its redirect handler therefore cannot forward cache-generated If-None-Match or If-Modified-Since validators, and nothing exists to treat a cross-origin 304 as a successful revalidat..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T10:16:59.893945+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 6.11.1 of undici. not_affected \u2014 Target is undici 6.11.1-tuxcare.9. The CVE concerns the HTTP cache interceptor (introduced in 7.x/8.x) composed with dump/decompress interceptors. None of these exist in this 6.x tree: interceptors export only redirect and retry, and there is no cache, dump, or decompress interceptor. The Fetch Cache API in lib/web/cache is a different component and does not replay responses through dispatcher ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 Target is undici 6.11.1-tuxcare.9. The CVE concerns the HTTP cache interceptor (introduced in 7.x/8.x) composed with dump/decompress interceptors. None of these exist in this 6.x tree: interceptors export only redirect and retry, and there is no cache, dump, or decompress interceptor. The Fetch Cache API in lib/web/cache is a different component and does not replay responses through dispatcher ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T10:19:00.088475+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 6.11.1 of undici. not_affected \u2014 undici 6.11.1-tuxcare.9 has the same flat-list misreading in cleanRequestHeaders, but tuple-array headers are rejected by the Request constructor on the first hop. A tuple-array request never reaches a redirect or the wire, so credentials cannot leak. Type A2 (chain absent).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 undici 6.11.1-tuxcare.9 has the same flat-list misreading in cleanRequestHeaders, but tuple-array headers are rejected by the Request constructor on the first hop. A tuple-array request never reaches a redirect or the wire, so credentials cannot leak. Type A2 (chain absent)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T10:18:00.081064+00:00", "status_notes": "Vulnerability CVE-2026-120423 does not affect version 6.11.1 of undici. not_affected \u2014 undici 6.11.1-tuxcare.9 has the same split(' ') in parseMetadata, but the bypass does not work here. The per-token regex is unanchored, so a digest preceded or followed by a tab or other whitespace is still recognised and checked. A body that differs from the pinned digest is rejected.", "vulnerability": { "name": "CVE-2026-120423" }, "impact_statement": "not_affected \u2014 undici 6.11.1-tuxcare.9 has the same split(' ') in parseMetadata, but the bypass does not work here. The per-token regex is unanchored, so a digest preceded or followed by a tab or other whitespace is still recognised and checked. A body that differs from the pinned digest is rejected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T10:14:52.132940+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 6.11.1 of undici. not_affected \u2014 Target is undici 6.11.1-tuxcare.9 (same product as the advisory, an older line). It has no shared HTTP response cache or cache interceptor. The CVE needs the redirect interceptor combined with a shared response cache, and that cache does not exist here. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 Target is undici 6.11.1-tuxcare.9 (same product as the advisory, an older line). It has no shared HTTP response cache or cache interceptor. The CVE needs the redirect interceptor combined with a shared response cache, and that cache does not exist here. Not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 6.11.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T12:13:07.020500+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 6.11.1 of undici. not_affected \u2014 undici 6.11.1 has no HTTP cache interceptor (interceptors.cache), no CacheHandler, no cache-control parser, and no shared-cache mode. The vulnerable Cache-Control qualified-directive parsing is absent, so the CVE does not apply. The patch is given only as commit URLs; analysis relied on the CVE text.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 undici 6.11.1 has no HTTP cache interceptor (interceptors.cache), no CacheHandler, no cache-control parser, and no shared-cache mode. The vulnerable Cache-Control qualified-directive parsing is absent, so the CVE does not apply. The patch is given only as commit URLs; analysis relied on the CVE text." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-09-30T08:14:17.776706+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1525 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-1525" }, "action_statement": "Vulnerability CVE-2026-1525 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1526 does not affect version 6.11.1 of undici. not_affected \u2014 Version 6.11.1 is not affected by CVE-2026-1526. The permessage-deflate WebSocket extension is explicitly disabled in this version and no decompression code exists. The vulnerable feature was only added in later version 6.18.0 (commit 5a564bd9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1526" }, "impact_statement": "not_affected \u2014 Version 6.11.1 is not affected by CVE-2026-1526. The permessage-deflate WebSocket extension is explicitly disabled in this version and no decompression code exists. The vulnerable feature was only added in later version 6.18.0 (commit 5a564bd9)." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1527 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-1527" }, "action_statement": "Vulnerability CVE-2026-1527 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1528 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-1528" }, "action_statement": "Vulnerability CVE-2026-1528 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-09-30T08:14:17.776706+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-09-30T08:14:17.776706+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:05:18.396710+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 6.11.1 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-10-13T16:23:00.166692+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.6.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-10-10T21:46:00.149501+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.5.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22036 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-22036" }, "action_statement": "Vulnerability CVE-2026-22036 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2229 does not affect version 6.11.1 of undici. not_affected \u2014 The target repository (undici v6.11.1) does not have the permessage-deflate WebSocket extension implemented. The vulnerable code does not exist in this version. The extension was added later in v6.18.0 (commit 5a564bd9, May 2024), while the target is an earlier version where permessage-deflate is explicitly disabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2229" }, "impact_statement": "not_affected \u2014 The target repository (undici v6.11.1) does not have the permessage-deflate WebSocket extension implemented. The vulnerable code does not exist in this version. The extension was added later in v6.18.0 (commit 5a564bd9, May 2024), while the target is an earlier version where permessage-deflate is explicitly disabled." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-14T01:25:13.546710+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 6.11.1 of undici. not_affected \u2014 undici 6.11.1 (tuxcare.10) has no deduplicate interceptor. The vulnerable component, interceptors.deduplicate(), does not exist in this tree. The only exported interceptors are redirect and retry. The CVE flaw (buffering response bodies for deduplicated waiters) has no code to live in, so the target is not affected. This is Type A1: the Brief's input path is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 undici 6.11.1 (tuxcare.10) has no deduplicate interceptor. The vulnerable component, interceptors.deduplicate(), does not exist in this tree. The only exported interceptors are redirect and retry. The CVE flaw (buffering response bodies for deduplicated waiters) has no code to live in, so the target is not affected. This is Type A1: the Brief's input path is absent." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-6734 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2026-6734" }, "action_statement": "Vulnerability CVE-2026-6734 affects version 6.11.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T13:02:26.327888+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 6.11.1 of undici. not_affected \u2014 The vulnerable component, the `interceptors.decompress()` interceptor, does not exist in undici 6.11.1-tuxcare.9. The upstream fix modifies only lib/interceptor/decompress.js, which is absent here, so the advisory's component is not present in this tree.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 The vulnerable component, the `interceptors.decompress()` interceptor, does not exist in undici 6.11.1-tuxcare.9. The upstream fix modifies only lib/interceptor/decompress.js, which is absent here, so the advisory's component is not present in this tree." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T13:02:00.039785+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 6.11.1 of undici. not_affected \u2014 Target is undici 6.11.1-tuxcare.9. It has no HTTP cache interceptor (interceptors.cache(), cache stores, or shared/private cache modes). Only the redirect and retry interceptors exist. The vulnerable component from CVE-2026-84933 (shared-cache storing and re-serving Set-Cookie) is absent, so cookies cannot be cached and re-served to other callers.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 Target is undici 6.11.1-tuxcare.9. It has no HTTP cache interceptor (interceptors.cache(), cache stores, or shared/private cache modes). Only the redirect and retry interceptors exist. The vulnerable component from CVE-2026-84933 (shared-cache storing and re-serving Set-Cookie) is absent, so cookies cannot be cached and re-served to other callers." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T12:50:11.047822+00:00", "status_notes": "Vulnerability CVE-2026-84947 does not affect version 6.11.1 of undici. not_affected \u2014 Target is undici 6.11.1-tuxcare.9. It has no dump interceptor, so the code the CVE and patch modify does not exist here. The only interceptors exported are redirect and retry. The unrelated BodyReadable.dump() method tears down the body stream once the limit is reached. It does not end a response early and leave a truncated 200 for the caller, so it does not have this flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84947" }, "impact_statement": "not_affected \u2014 Target is undici 6.11.1-tuxcare.9. It has no dump interceptor, so the code the CVE and patch modify does not exist here. The only interceptors exported are redirect and retry. The unrelated BodyReadable.dump() method tears down the body stream once the limit is reached. It does not end a response early and leave a truncated 200 for the caller, so it does not have this flaw." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 6.11.1 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T12:53:00.054682+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 6.11.1 of undici. not_affected \u2014 undici 6.11.1-tuxcare.9 has no HTTP cache interceptor. The vulnerable component, interceptors.cache() (cache store, canCacheResponse, method skip-list), does not exist in this tree. The only exported interceptors are redirect and retry. The Cache API under lib/web/cache is a separate WHATWG implementation and is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 undici 6.11.1-tuxcare.9 has no HTTP cache interceptor. The vulnerable component, interceptors.cache() (cache store, canCacheResponse, method skip-list), does not exist in this tree. The only exported interceptors are redirect and retry. The Cache API under lib/web/cache is a separate WHATWG implementation and is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T12:45:46.929874+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 6.11.1 of undici. not_affected \u2014 The target is undici 6.11.1-tuxcare.9, which has no WebSocketStream API. The CVE affects only releases from 7.0.0, where WebSocketStream was introduced. The 6.x tree has only the classic WebSocket class, which uses no WritableStream or writer-lock stream abort in its close path. The vulnerable code is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 The target is undici 6.11.1-tuxcare.9, which has no WebSocketStream API. The CVE affects only releases from 7.0.0, where WebSocketStream was introduced. The 6.x tree has only the classic WebSocket class, which uses no WritableStream or writer-lock stream abort in its close path. The vulnerable code is absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-14T02:13:19.192215+00:00", "status_notes": "Vulnerability CVE-2026-85024 does not affect version 6.11.1 of undici. not_affected \u2014 undici 6.11.1 has no permessage-deflate support. lib/web/websocket/permessage-deflate.js does not exist, and the code never creates a zlib InflateRaw. The client sends no permessage-deflate offer and fails the connection if the server answers with a Sec-WebSocket-Extensions header. A compressed message therefore can't reach the buggy cleanup path.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85024" }, "impact_statement": "not_affected \u2014 undici 6.11.1 has no permessage-deflate support. lib/web/websocket/permessage-deflate.js does not exist, and the code never creates a zlib InflateRaw. The client sends no permessage-deflate offer and fails the connection if the server answers with a Sec-WebSocket-Extensions header. A compressed message therefore can't reach the buggy cleanup path." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-14T02:28:42.740195+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 6.11.1 of undici. not_affected \u2014 Target is undici 6.11.1-tuxcare.10. The vulnerable `interceptors.cache()` and `interceptors.deduplicate()` were introduced in 8.10.0 and do not exist here. Only the `redirect` and `retry` interceptors are exported. Not affected (Type A1: the vulnerable feature is absent).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 6.11.1-tuxcare.10. The vulnerable `interceptors.cache()` and `interceptors.deduplicate()` were introduced in 8.10.0 and do not exist here. Only the `redirect` and `retry` interceptors are exported. Not affected (Type A1: the vulnerable feature is absent)." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T14:55:00.051375+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.10.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 6.11.1 of undici, and is fixed in 6.11.1-tuxcare.10." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T13:26:42.796685+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 6.11.1 of undici. not_affected \u2014 The target is undici 6.11.1-tuxcare.9. It has no `decompress` interceptor and no `dump` interceptor. The flaw only exists in the `decompress` interceptor, so this version is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 The target is undici 6.11.1-tuxcare.9. It has no `decompress` interceptor and no `dump` interceptor. The flaw only exists in the `decompress` interceptor, so this version is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-14T01:54:31.473047+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 6.11.1 of undici. not_affected \u2014 CVE-2026-9675 is a regression in undici 8.1.0, introduced with the new maxPayloadSize option. It was a per-frame limit that was not applied cumulatively across fragmented messages. The target is undici 6.11.1-tuxcare.10, which has no maxPayloadSize option, no configured payload limit and no per-frame payload check, so the regressed code is absent. The CVE itself says lines without that feature ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 CVE-2026-9675 is a regression in undici 8.1.0, introduced with the new maxPayloadSize option. It was a per-frame limit that was not applied cumulatively across fragmented messages. The target is undici 6.11.1-tuxcare.10, which has no maxPayloadSize option, no configured payload limit and no per-frame payload check, so the regressed code is absent. The CVE itself says lines without that feature ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-06T12:26:00.035392+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 6.11.1 of undici. not_affected \u2014 undici 6.11.1-tuxcare.9 has no HTTP cache interceptor (interceptors.cache(), cache store, or Cache-Control response parser). The vulnerable code from CVE-2026-9678 is absent, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 undici 6.11.1-tuxcare.9 has no HTTP cache interceptor (interceptors.cache(), cache store, or Cache-Control response parser). The vulnerable code from CVE-2026-9678 is absent, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 6.11.1 of undici. not_affected \u2014 Target version 6.11.1 does not contain the vulnerable code pattern. The vulnerability (percent-decoding of cookie values via qsUnescape) was introduced in undici 7.0.0 via PR #3789. Version 6.11.1 predates this change and does not perform any percent-decoding of cookie values, returning them as-is. Without the decoding transformation, percent-encoded sequences like %0D%0A remain as harmless lit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 Target version 6.11.1 does not contain the vulnerable code pattern. The vulnerability (percent-decoding of cookie values via qsUnescape) was introduced in undici 7.0.0 via PR #3789. Version 6.11.1 predates this change and does not perform any percent-decoding of cookie values, returning them as-is. Without the decoding transformation, percent-encoded sequences like %0D%0A remain as harmless lit..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.11.1", "identifiers": { "purl": "pkg:npm/undici@6.11.1" } } ], "timestamp": "2026-11-05T09:04:00.091712+00:00", "status_notes": "Vulnerability CVE-2026-9697 affects version 6.11.1 of undici.", "vulnerability": { "name": "CVE-2026-9697" }, "action_statement": "Vulnerability CVE-2026-9697 affects version 6.11.1 of undici." } ] }