{ "@id": "urn:uuid:dac67e53-664f-4ee4-8139-2f2787921b4e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 46, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:58:00.113753+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 6.20.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 6.20.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 6.20.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 6.20.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 6.20.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 6.20.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 6.20.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-14T00:04:00.566721+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 6.20.0 of undici. not_affected \u2014 The target (undici 6.20.0) already clears the cookie and host headers on cross-origin redirects in the fetch redirect path. The upstream fix commit e041de35 (author maitken033380023@gmail.com, committer GitHub) is an ancestor of HEAD. It is part of the upstream release, because it predates the first TuxCare commit f7060f80. The verdict is therefore an upstream fix: not_affected with justificati...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 The target (undici 6.20.0) already clears the cookie and host headers on cross-origin redirects in the fetch redirect path. The upstream fix commit e041de35 (author maitken033380023@gmail.com, committer GitHub) is an ancestor of HEAD. It is part of the upstream release, because it predates the first TuxCare commit f7060f80. The verdict is therefore an upstream fix: not_affected with justificati..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 6.20.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-13T22:22:49.594925+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 6.20.0 of undici. not_affected \u2014 undici 6.20.0 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The upstream fix for CVE-2024-24758 (GHSA-3787-6prv-h9w3, merged as b9da3e40) is in the upstream release that TuxCare onboarded, so the verdict is not_affected (upstream fix).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 undici 6.20.0 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The upstream fix for CVE-2024-24758 (GHSA-3787-6prv-h9w3, merged as b9da3e40) is in the upstream release that TuxCare onboarded, so the verdict is not_affected (upstream fix)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-14T00:31:00.130291+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 6.20.0 of undici. not_affected \u2014 The upstream fix for CVE-2024-30260 (commit 6805746, which adds proxy-authorization to the headers stripped on cross-origin redirects) is already in HEAD. It shipped in the upstream release before TuxCare's first commit, so this is an upstream fix and the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2024-30260 (commit 6805746, which adds proxy-authorization to the headers stripped on cross-origin redirects) is already in HEAD. It shipped in the upstream release before TuxCare's first commit, so this is an upstream fix and the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-13T23:39:00.076832+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 6.20.0 of undici. not_affected \u2014 Target undici 6.20.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). Commit d542b8cd (Matteo Collina, upstream) is an ancestor of HEAD and of the first TuxCare commit, so the fix shipped in the upstream release. The integrity checker in lib/web/fetch/util.js has the patched structure.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Target undici 6.20.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). Commit d542b8cd (Matteo Collina, upstream) is an ancestor of HEAD and of the first TuxCare commit, so the fix shipped in the upstream release. The integrity checker in lib/web/fetch/util.js has the patched structure." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 6.20.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-14T10:27:20.312467+00:00", "status_notes": "Vulnerability CVE-2025-22150 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3.", "vulnerability": { "name": "CVE-2025-22150" }, "action_statement": "Vulnerability CVE-2025-22150 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-14T10:27:39.916666+00:00", "status_notes": "Vulnerability CVE-2025-47279 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3.", "vulnerability": { "name": "CVE-2025-47279" }, "action_statement": "Vulnerability CVE-2025-47279 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.5.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:06:00.064776+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 6.20.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-06T13:30:25.835538+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 6.20.0 of undici. not_affected \u2014 undici 6.20.0 is not affected. The case-sensitive SRI algorithm lookup is a regression introduced in 7.15.0. In this tree, parseMetadata() lowercases the algorithm token before checking it against the supported-hash list. Valid uppercase and mixed-case tokens such as SHA256-... are therefore recognized and verified, not skipped. A body that differs from the digest still fails bytesMatch().", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 undici 6.20.0 is not affected. The case-sensitive SRI algorithm lookup is a regression introduced in 7.15.0. In this tree, parseMetadata() lowercases the algorithm token before checking it against the supported-hash list. Valid uppercase and mixed-case tokens such as SHA256-... are therefore recognized and verified, not skipped. A body that differs from the digest still fails bytesMatch()." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-14T02:58:00.113753+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 6.20.0 of undici. not_affected \u2014 Not affected. The CVE is a regression introduced in undici 8.11.0, which added WebSocket-over-HTTP/2 support. This target (6.20.0-tuxcare.6) has no such support. Its HTTP/2 client explicitly rejects upgrade requests, and allowH2 defaults to false. A server's HTTP/2 handshake response therefore never reaches the WebSocket validation code, and no orphaned ClientHttp2Stream can be created.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Not affected. The CVE is a regression introduced in undici 8.11.0, which added WebSocket-over-HTTP/2 support. This target (6.20.0-tuxcare.6) has no such support. Its HTTP/2 client explicitly rejects upgrade requests, and allowH2 defaults to false. A server's HTTP/2 handshake response therefore never reaches the WebSocket validation code, and no orphaned ClientHttp2Stream can be created." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:05:31.171802+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 6.20.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-27T14:38:05.037020+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.5.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-14T10:27:39.916666+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 6.20.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-06T10:32:00.039627+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 6.20.0 of undici. not_affected \u2014 Target is undici 6.20.0-tuxcare.5. The CVE needs the shared cache interceptor (introduced in undici 7.x) composed with the redirect interceptor. The 6.20.0 tree has no cache interceptor, cache store or cache handler, so the stored-response revalidation chain does not exist. Affected ranges are 7.0.0-7.30.1 and 8.0.0-8.12.3, and 6.20.0 is outside them.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 Target is undici 6.20.0-tuxcare.5. The CVE needs the shared cache interceptor (introduced in undici 7.x) composed with the redirect interceptor. The 6.20.0 tree has no cache interceptor, cache store or cache handler, so the stored-response revalidation chain does not exist. Affected ranges are 7.0.0-7.30.1 and 8.0.0-8.12.3, and 6.20.0 is outside them." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-06T10:16:59.893945+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 6.20.0 of undici. not_affected \u2014 Target is undici 6.20.0-tuxcare.5. The HTTP cache interceptor (and cache stores / cache handler) that the CVE concerns was introduced in undici 7.0.0 and does not exist in this tree. The shipped interceptors are only redirect, retry and dump. There is no decompress interceptor and no cached-response replay path. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 Target is undici 6.20.0-tuxcare.5. The HTTP cache interceptor (and cache stores / cache handler) that the CVE concerns was introduced in undici 7.0.0 and does not exist in this tree. The shipped interceptors are only redirect, retry and dump. There is no decompress interceptor and no cached-response replay path. Not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-06T10:18:00.081064+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 6.20.0 of undici. not_affected \u2014 undici 6.20.0-tuxcare.5 contains the redirect-handler flaw (cleanRequestHeaders treats arrays as flat lists), but the CVE's attack chain cannot be completed here. The core Request constructor rejects tuple-array headers on the first hop, before any network I/O. There is also no cache or deduplicate interceptor in this tree to flatten and re-serialize retained headers. No sensitive header reache...", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 undici 6.20.0-tuxcare.5 contains the redirect-handler flaw (cleanRequestHeaders treats arrays as flat lists), but the CVE's attack chain cannot be completed here. The core Request constructor rejects tuple-array headers on the first hop, before any network I/O. There is also no cache or deduplicate interceptor in this tree to flatten and re-serialize retained headers. No sensitive header reache..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-06T10:19:00.088475+00:00", "status_notes": "Vulnerability CVE-2026-120423 does not affect version 6.20.0 of undici. not_affected \u2014 undici 6.20.0-tuxcare.5 still splits the SRI integrity string on a single space (lib/web/fetch/util.js:637), which is the upstream flaw. In this version, though, the per-token regex is unanchored, so a tab or other whitespace around a digest does not make the token unparseable. The bypass in the CVE (token skipped, list treated as empty, response accepted) therefore does not occur. I confirmed ...", "vulnerability": { "name": "CVE-2026-120423" }, "impact_statement": "not_affected \u2014 undici 6.20.0-tuxcare.5 still splits the SRI integrity string on a single space (lib/web/fetch/util.js:637), which is the upstream flaw. In this version, though, the per-token regex is unanchored, so a tab or other whitespace around a digest does not make the token unparseable. The bypass in the CVE (token skipped, list treated as empty, response accepted) therefore does not occur. I confirmed ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-06T10:14:52.132940+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 6.20.0 of undici. not_affected \u2014 undici 6.20.0-tuxcare.5 has no HTTP response-cache interceptor or cache store. The CVE needs the redirect interceptor and a shared response cache working together, so the vulnerable chain cannot exist here. The CVE's affected ranges (7.0.0-7.30.1 and 8.0.0-8.12.3) also exclude this 6.x line.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 undici 6.20.0-tuxcare.5 has no HTTP response-cache interceptor or cache store. The CVE needs the redirect interceptor and a shared response cache working together, so the vulnerable chain cannot exist here. The CVE's affected ranges (7.0.0-7.30.1 and 8.0.0-8.12.3) also exclude this 6.x line." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-14T10:27:39.916666+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 6.20.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-06T12:14:00.044444+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 6.20.0 of undici. not_affected \u2014 undici 6.20.0 (tuxcare.5) has no HTTP cache interceptor (interceptors.cache), no Cache-Control response parser, and no shared-cache store. The vulnerable code (qualified no-cache/private directive parsing in the cache interceptor) is absent, so the CVE does not apply.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 undici 6.20.0 (tuxcare.5) has no HTTP cache interceptor (interceptors.cache), no Cache-Control response parser, and no shared-cache store. The vulnerable code (qualified no-cache/private directive parsing in the cache interceptor) is absent, so the CVE does not apply." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-14T10:27:39.916666+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-14T10:27:39.916666+00:00", "status_notes": "Vulnerability CVE-2026-1525 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-1525" }, "action_statement": "Vulnerability CVE-2026-1525 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-14T10:27:39.916666+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-14T10:28:00.156809+00:00", "status_notes": "Vulnerability CVE-2026-1527 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-1527" }, "action_statement": "Vulnerability CVE-2026-1527 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-14T10:28:00.156809+00:00", "status_notes": "Vulnerability CVE-2026-1528 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-1528" }, "action_statement": "Vulnerability CVE-2026-1528 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-14T10:28:00.156809+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-14T10:28:00.156809+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:05:18.396710+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 6.20.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-10T21:17:00.426669+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-01T12:02:29.846725+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-14T10:28:00.156809+00:00", "status_notes": "Vulnerability CVE-2026-22036 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-22036" }, "action_statement": "Vulnerability CVE-2026-22036 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-14T10:28:00.156809+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-14T01:37:47.119617+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 6.20.0 of undici. not_affected \u2014 Target is undici 6.20.0-tuxcare.6. It has no deduplicate interceptor at all. interceptors exports only redirect, retry and dump. The vulnerable request-sharing and body-buffering code that CVE-2026-2581 describes is absent from this release line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 Target is undici 6.20.0-tuxcare.6. It has no deduplicate interceptor at all. interceptors exports only redirect, retry and dump. The vulnerable request-sharing and body-buffering code that CVE-2026-2581 describes is absent from this release line." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-14T10:28:00.156809+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-6734 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2026-6734" }, "action_statement": "Vulnerability CVE-2026-6734 affects version 6.20.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-06T13:05:00.204353+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 6.20.0 of undici. not_affected \u2014 CVE-2026-84890 affects the interceptors.decompress() interceptor, which the patch hardens with a maxSize cap. Target undici 6.20.0 has no decompress interceptor, so the vulnerable component is absent. The exported interceptors are only redirect, retry and dump.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 CVE-2026-84890 affects the interceptors.decompress() interceptor, which the patch hardens with a maxSize cap. Target undici 6.20.0 has no decompress interceptor, so the vulnerable component is absent. The exported interceptors are only redirect, retry and dump." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-06T13:02:26.327888+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 6.20.0 of undici. not_affected \u2014 Target undici 6.20.0-tuxcare.5 has no HTTP response-caching interceptor (interceptors.cache, cache handlers, cache stores). The CVE-2026-84933 flaw is in that component, which was added in undici 7.x, so the code is absent here. The only 'cache' code is the WHATWG Cache API (lib/web/cache), a different component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 Target undici 6.20.0-tuxcare.5 has no HTTP response-caching interceptor (interceptors.cache, cache handlers, cache stores). The CVE-2026-84933 flaw is in that component, which was added in undici 7.x, so the code is absent here. The only 'cache' code is the WHATWG Cache API (lib/web/cache), a different component." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 6.20.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 6.20.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-06T12:55:00.223983+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 6.20.0 of undici. not_affected \u2014 undici 6.20.0-tuxcare.5 has no HTTP cache interceptor (interceptors.cache(), cache store, canCacheResponse). Only redirect, retry and dump interceptors exist, so the flawed method skip-list and cache-storage gate that CVE-2026-85008 describes are absent. The web Cache API (lib/web/cache) rejects non-GET methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 undici 6.20.0-tuxcare.5 has no HTTP cache interceptor (interceptors.cache(), cache store, canCacheResponse). Only redirect, retry and dump interceptors exist, so the flawed method skip-list and cache-storage gate that CVE-2026-85008 describes are absent. The web Cache API (lib/web/cache) rejects non-GET methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-06T12:45:34.125314+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 6.20.0 of undici. not_affected \u2014 Target is undici 6.20.0-tuxcare.5. The CVE concerns the WebSocketStream API, which was introduced in undici 7.0.0 and does not exist in this tree. lib/web/websocket has only the classic WebSocket implementation. The only WebSocketStream references are WPT test fixtures. There is nothing to patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 Target is undici 6.20.0-tuxcare.5. The CVE concerns the WebSocketStream API, which was introduced in undici 7.0.0 and does not exist in this tree. lib/web/websocket has only the classic WebSocket implementation. The only WebSocketStream references are WPT test fixtures. There is nothing to patch." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 6.20.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-14T02:34:22.669842+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 6.20.0 of undici. not_affected \u2014 Not affected. The target is undici 6.20.0-tuxcare.6, and the cache and deduplicate interceptors named in the CVE do not exist in it. They were introduced in undici 8.10.0, and this tree exports only redirect, retry and dump interceptors. The advisory names 8.10.0 and 8.10.1 as the affected versions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Not affected. The target is undici 6.20.0-tuxcare.6, and the cache and deduplicate interceptors named in the CVE do not exist in it. They were introduced in undici 8.10.0, and this tree exports only redirect, retry and dump interceptors. The advisory names 8.10.0 and 8.10.1 as the affected versions." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-09T13:40:07.223482+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.6.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.6." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-06T13:30:25.835538+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 6.20.0 of undici. not_affected \u2014 Target is undici 6.20.0-tuxcare.5. The `decompress` interceptor that CVE-2026-87029 concerns does not exist in this version, so the flaw cannot occur. This is Type A1: the Brief's input path is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 Target is undici 6.20.0-tuxcare.5. The `decompress` interceptor that CVE-2026-87029 concerns does not exist in this version, so the flaw cannot occur. This is Type A1: the Brief's input path is absent." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-9675 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2026-9675" }, "action_statement": "Vulnerability CVE-2026-9675 affects version 6.20.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-06T12:28:55.213155+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 6.20.0 of undici. not_affected \u2014 Undici 6.20.0 (tuxcare.5) has no HTTP cache interceptor, so the Cache-Control qualified-field parsing flaw from CVE-2026-9678 cannot occur. Only redirect, retry and dump interceptors exist, and the Web Cache API does not parse Cache-Control.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Undici 6.20.0 (tuxcare.5) has no HTTP cache interceptor, so the Cache-Control qualified-field parsing flaw from CVE-2026-9678 cannot occur. Only redirect, retry and dump interceptors exist, and the Web Cache API does not parse Cache-Control." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-10-14T10:29:04.846835+00:00", "status_notes": "Vulnerability CVE-2026-9679 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-9679" }, "action_statement": "Vulnerability CVE-2026-9679 affects version 6.20.0 of undici, and is fixed in 6.20.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.20.0", "identifiers": { "purl": "pkg:npm/undici@6.20.0" } } ], "timestamp": "2026-11-05T09:04:00.091712+00:00", "status_notes": "Vulnerability CVE-2026-9697 affects version 6.20.0 of undici.", "vulnerability": { "name": "CVE-2026-9697" }, "action_statement": "Vulnerability CVE-2026-9697 affects version 6.20.0 of undici." } ] }