{ "@id": "urn:uuid:f91d662e-46c1-4c7a-8dd6-416ac0ca2a43", "role": "Document Creator", "author": "https://tuxcare.com", "version": 47, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:52:39.198546+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 6.21.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T23:59:37.286671+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 6.21.3 of undici. not_affected \u2014 Target undici 6.21.3 already contains the upstream fix for CVE-2023-45143. httpRedirectFetch in lib/web/fetch/index.js deletes the cookie header (plus host, authorization and proxy-authorization) when a redirect crosses origins. The fix is the upstream commit e041de35, which is in HEAD's history. HEAD has no TuxCare-authored commits, so it is a plain upstream release and the fix is upstream-att...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Target undici 6.21.3 already contains the upstream fix for CVE-2023-45143. httpRedirectFetch in lib/web/fetch/index.js deletes the cookie header (plus host, authorization and proxy-authorization) when a redirect crosses origins. The fix is the upstream commit e041de35, which is in HEAD's history. HEAD has no TuxCare-authored commits, so it is a plain upstream release and the fix is upstream-att..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 6.21.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T22:18:00.036497+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 6.21.3 of undici. not_affected \u2014 undici 6.21.3 is not affected by CVE-2024-24758. The redirect handler's shouldRemoveHeader() already strips proxy-authorization, alongside authorization and cookie, when a redirect goes to a different origin. This fix shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 undici 6.21.3 is not affected by CVE-2024-24758. The redirect handler's shouldRemoveHeader() already strips proxy-authorization, alongside authorization and cookie, when a redirect goes to a different origin. This fix shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-14T00:27:00.079854+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 6.21.3 of undici. not_affected \u2014 undici 6.21.3 is not affected by CVE-2024-30260. lib/handler/redirect-handler.js already strips authorization, proxy-authorization and cookie when a redirect crosses origins. This is the upstream fix (6805746), and it shipped in the upstream release that was onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 undici 6.21.3 is not affected by CVE-2024-30260. lib/handler/redirect-handler.js already strips authorization, proxy-authorization and cookie when a redirect crosses origins. This is the upstream fix (6805746), and it shipped in the upstream release that was onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T23:33:00.074877+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 6.21.3 of undici. not_affected \u2014 undici 6.21.3 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd, released in 6.11.1). The fix is an ancestor of HEAD and ships in the upstream release. The bytesMatch integrity logic in lib/web/fetch/util.js matches the post-fix code. Nothing from TuxCare is involved.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 undici 6.21.3 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd, released in 6.11.1). The fix is an ancestor of HEAD and ships in the upstream release. The bytesMatch integrity logic in lib/web/fetch/util.js matches the post-fix code. Nothing from TuxCare is involved." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 6.21.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T21:30:44.648777+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 6.21.3 of undici. not_affected \u2014 The multipart boundary in lib/web/fetch/body.js is generated with crypto.randomInt (CSPRNG), which is the upstream fix for CVE-2025-22150 (upstream commit c3acc605, GHSA fix in 6.21.1). That commit is already in HEAD as part of the upstream 6.21.x release. No TuxCare-authored commit carries the fix, so the verdict is not_affected, not already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 The multipart boundary in lib/web/fetch/body.js is generated with crypto.randomInt (CSPRNG), which is the upstream fix for CVE-2025-22150 (upstream commit c3acc605, GHSA fix in 6.21.1). That commit is already in HEAD as part of the upstream 6.21.x release. No TuxCare-authored commit carries the fix, so the verdict is not_affected, not already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T21:37:00.197268+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 6.21.3 of undici. not_affected \u2014 The upstream fix for CVE-2025-47279 (nodejs/undici#4088, commit 13338713) is already in HEAD (undici 6.21.3). Pool now removes a client from its list when that client emits connectionError, so repeated failed TLS connections no longer accumulate clients. The fix shipped in the upstream release, and the history has no TuxCare-domain commit, so this is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2025-47279 (nodejs/undici#4088, commit 13338713) is already in HEAD (undici 6.21.3). Pool now removes a client from its list when that client emits connectionError, so repeated failed TLS connections no longer accumulate clients. The fix shipped in the upstream release, and the history has no TuxCare-domain commit, so this is not_affected rather than already_fixed." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 6.21.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T21:14:00.047255+00:00", "status_notes": "Vulnerability CVE-2026-109829 does not affect version 6.21.3 of undici. not_affected \u2014 undici 6.21.3 has no HTTP cache interceptor and no MemoryCacheStore or SqliteCacheStore, and the CVE says the cache interceptor was introduced in 7.0.0. lib/interceptor contains only dns, dump, redirect, response-error and retry, and index.js exports only redirect, retry, dump and dns under `interceptors`. The vulnerable `compose(redirect(), cache())` composition therefore cannot be built here.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109829" }, "impact_statement": "not_affected \u2014 undici 6.21.3 has no HTTP cache interceptor and no MemoryCacheStore or SqliteCacheStore, and the CVE says the cache interceptor was introduced in 7.0.0. lib/interceptor contains only dns, dump, redirect, response-error and retry, and index.js exports only redirect, retry, dump and dns under `interceptors`. The vulnerable `compose(redirect(), cache())` composition therefore cannot be built here." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T21:17:00.039866+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 6.21.3 of undici. not_affected \u2014 undici 6.21.3 is not affected. The regression came with the SRI refactor in 7.15.0 (lib/web/subresource-integrity), which does not exist in this tree. The 6.x implementation in lib/web/fetch/util.js matches the algorithm token case-insensitively and lowercases it before checking it against the supported hashes. SHA256-, Sha256- and similar tokens are therefore kept and verified rather than skip...", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 undici 6.21.3 is not affected. The regression came with the SRI refactor in 7.15.0 (lib/web/subresource-integrity), which does not exist in this tree. The 6.x implementation in lib/web/fetch/util.js matches the algorithm token case-insensitively and lowercases it before checking it against the supported hashes. SHA256-, Sha256- and similar tokens are therefore kept and verified rather than skip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-14T02:52:39.198546+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 6.21.3 of undici. not_affected \u2014 Not affected. The target is undici 6.21.3. The CVE is a regression introduced in 8.11.0, which added WebSocket-over-HTTP/2 support. In the target, a WebSocket request over an H2 session is rejected before any stream is created, so no orphaned ClientHttp2Stream can exist.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Not affected. The target is undici 6.21.3. The CVE is a regression introduced in 8.11.0, which added WebSocket-over-HTTP/2 support. In the target, a WebSocket request over an H2 session is rejected before any stream is created, so no orphaned ClientHttp2Stream can exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T21:11:00.063162+00:00", "status_notes": "Vulnerability CVE-2026-109869 does not affect version 6.21.3 of undici. not_affected \u2014 undici 6.21.3 does not contain the code path behind this CVE. The target has no content-encoding count limit and no early return after the response body stream is created. In onHeaders, the body stream is always created and always has an error handler attached before resolve(). An early connection close therefore cannot raise an unhandled 'error' on an orphaned stream. The upstream fix (b5084c7...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109869" }, "impact_statement": "not_affected \u2014 undici 6.21.3 does not contain the code path behind this CVE. The target has no content-encoding count limit and no early return after the response body stream is created. In onHeaders, the body stream is always created and always has an error handler attached before resolve(). An early connection close therefore cannot raise an unhandled 'error' on an orphaned stream. The upstream fix (b5084c7..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-10-15T18:33:00.174668+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 6.21.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T21:25:37.080118+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 6.21.3 of undici. not_affected \u2014 Target is undici 6.21.3 (same product as the CVE, an older line). It has no shared HTTP cache interceptor or cache store. The cache interceptor and its conditional revalidation arrived in the 7.x line. Nothing in this tree generates If-None-Match or If-Modified-Since validators, stores responses, or accepts a 304 as revalidation, so the CVE chain cannot exist here.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 Target is undici 6.21.3 (same product as the CVE, an older line). It has no shared HTTP cache interceptor or cache store. The cache interceptor and its conditional revalidation arrived in the 7.x line. Nothing in this tree generates If-None-Match or If-Modified-Since validators, stores responses, or accepts a 304 as revalidation, so the CVE chain cannot exist here." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T21:23:00.051505+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 6.21.3 of undici. not_affected \u2014 Target is undici 6.21.3. The CVE affects 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3, where the HTTP cache interceptor replays cached responses into downstream handlers. That interceptor does not exist in the 6.x tree. The target has no cache interceptor, no cache store or cache handler, and no decompress interceptor. Its only interceptors are redirect, retry, dump and dns. The remaining cache code is the fe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 Target is undici 6.21.3. The CVE affects 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3, where the HTTP cache interceptor replays cached responses into downstream handlers. That interceptor does not exist in the 6.x tree. The target has no cache interceptor, no cache store or cache handler, and no decompress interceptor. Its only interceptors are redirect, retry, dump and dns. The remaining cache code is the fe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T21:23:00.051505+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 6.21.3 of undici. not_affected \u2014 undici 6.21.3 contains the same naive flat-array iteration in cleanRequestHeaders (lib/handler/redirect-handler.js:212-230) that CVE-2026-120415 describes, but the tuple-array header input cannot reach it. Request construction (lib/core/request.js:159-165) treats any array as a flat list and throws a TypeError on a tuple entry, so the dispatch fails before any redirect happens. The cross-origin...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 undici 6.21.3 contains the same naive flat-array iteration in cleanRequestHeaders (lib/handler/redirect-handler.js:212-230) that CVE-2026-120415 describes, but the tuple-array header input cannot reach it. Request construction (lib/core/request.js:159-165) treats any array as a flat list and throws a TypeError on a tuple entry, so the dispatch fails before any redirect happens. The cross-origin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T21:24:42.697192+00:00", "status_notes": "Vulnerability CVE-2026-120423 does not affect version 6.21.3 of undici. not_affected \u2014 The target (undici 6.21.3) has the split(' ') flaw in parseMetadata, but the CVE's bypass does not work here. Its token regex is unanchored, so a digest preceded or followed by a tab or other ASCII whitespace is still recognised. The integrity list never becomes empty, and a mismatching body is rejected. I confirmed this by running the code.", "vulnerability": { "name": "CVE-2026-120423" }, "impact_statement": "not_affected \u2014 The target (undici 6.21.3) has the split(' ') flaw in parseMetadata, but the CVE's bypass does not work here. Its token regex is unanchored, so a digest preceded or followed by a tab or other ASCII whitespace is still recognised. The integrity list never becomes empty, and a mismatching body is rejected. I confirmed this by running the code." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T21:20:59.401455+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 6.21.3 of undici. not_affected \u2014 Target is undici 6.21.3. CVE-2026-120474 affects only 7.0.0-7.30.1 and 8.0.0-8.12.3, where a response-cache interceptor and store combine with the redirect interceptor. The 6.x tree contains no HTTP response-cache interceptor, cache handler or cache store, so no chain from a credentialed redirected request to a shared cache entry served to another requester exists. The patch commits could not b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 Target is undici 6.21.3. CVE-2026-120474 affects only 7.0.0-7.30.1 and 8.0.0-8.12.3, where a response-cache interceptor and store combine with the redirect interceptor. The 6.x tree contains no HTTP response-cache interceptor, cache handler or cache store, so no chain from a credentialed redirected request to a shared cache entry served to another requester exists. The patch commits could not b..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 6.21.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T20:08:00.042663+00:00", "status_notes": "Vulnerability CVE-2026-13697 does not affect version 6.21.3 of undici. not_affected \u2014 undici 6.21.3 has no cache interceptor and no lib/util/cache.js. The vulnerable Cache-Control response parser and shared-cache store, which only exist in the 7.x cache interceptor, are absent. The repo is the same product (undici), so this is not a false positive.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-13697" }, "impact_statement": "not_affected \u2014 undici 6.21.3 has no cache interceptor and no lib/util/cache.js. The vulnerable Cache-Control response parser and shared-cache store, which only exist in the 7.x cache interceptor, are absent. The repo is the same product (undici), so this is not a false positive." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T20:07:00.106745+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 6.21.3 of undici. not_affected \u2014 undici 6.21.3 has no HTTP cache interceptor (interceptors.cache()), no cache store, and no Cache-Control response-directive parser. CVE-2026-14643 concerns the cache interceptor's parsing of qualified no-cache/private directives, which was introduced in the 7.x line. That component is absent from this target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 undici 6.21.3 has no HTTP cache interceptor (interceptors.cache()), no cache store, and no Cache-Control response-directive parser. CVE-2026-14643 concerns the cache interceptor's parsing of qualified no-cache/private directives, which was introduced in the 7.x line. That component is absent from this target." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1525 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-1525" }, "action_statement": "Vulnerability CVE-2026-1525 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1527 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-1527" }, "action_statement": "Vulnerability CVE-2026-1527 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1528 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-1528" }, "action_statement": "Vulnerability CVE-2026-1528 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-05T09:05:18.396710+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-09-29T18:46:58.638266+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-09-29T18:46:58.638266+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22036 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-22036" }, "action_statement": "Vulnerability CVE-2026-22036 affects version 6.21.3 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 6.21.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-14T01:31:31.434294+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 6.21.3 of undici. not_affected \u2014 Target is undici 6.21.3. It has no deduplicate interceptor, so the code CVE-2026-2581 describes does not exist here. The shipped interceptors are redirect, retry, dump and dns. Nothing in lib/ shares one upstream response across concurrent identical requests, so the Brief's Input cannot reach the Goal (unbounded memory growth). The patch was supplied only as a URL and could not be fetched, so t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 Target is undici 6.21.3. It has no deduplicate interceptor, so the code CVE-2026-2581 describes does not exist here. The shipped interceptors are redirect, retry, dump and dns. Nothing in lib/ shares one upstream response across concurrent identical requests, so the Brief's Input cannot reach the Goal (unbounded memory growth). The patch was supplied only as a URL and could not be fetched, so t..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 6.21.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T20:09:00.046186+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 6.21.3 of undici. not_affected \u2014 Target is undici 6.21.3. It has no Socks5ProxyAgent and no SOCKS code at all. The CVE says the flawed agent was introduced in undici 7.23.0 (PR #4385), so the vulnerable pool-reuse code is absent. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Target is undici 6.21.3. It has no Socks5ProxyAgent and no SOCKS code at all. The CVE says the flawed agent was introduced in undici 7.23.0 (PR #4385), so the vulnerable pool-reuse code is absent. Not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T20:49:00.046850+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 6.21.3 of undici. not_affected \u2014 Target undici 6.21.3 has no `interceptors.decompress()` interceptor, so the vulnerable component of CVE-2026-84890 does not exist. index.js exports only redirect, retry, dump and dns interceptors. The decompress interceptor was added in the 7.x line, and the vendor fix (7.29.1 / 8.10.2) adds `maxSize` to it. The fetch() response decoder in 6.21.3 is a separate, spec-mandated code path that the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 Target undici 6.21.3 has no `interceptors.decompress()` interceptor, so the vulnerable component of CVE-2026-84890 does not exist. index.js exports only redirect, retry, dump and dns interceptors. The decompress interceptor was added in the 7.x line, and the vendor fix (7.29.1 / 8.10.2) adds `maxSize` to it. The fetch() response decoder in 6.21.3 is a separate, spec-mandated code path that the ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T20:42:47.265621+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 6.21.3 of undici. not_affected \u2014 undici 6.21.3 has no HTTP cache interceptor (interceptors.cache(), cache handler, or cache store such as MemoryCacheStore). The vulnerable shared-cache code that stores and re-serves Set-Cookie responses was added in later 7.x/8.x lines and is absent here. Not affected (Type A1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 undici 6.21.3 has no HTTP cache interceptor (interceptors.cache(), cache handler, or cache store such as MemoryCacheStore). The vulnerable shared-cache code that stores and re-serves Set-Cookie responses was added in later 7.x/8.x lines and is absent here. Not affected (Type A1)." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 6.21.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T20:37:00.086722+00:00", "status_notes": "Vulnerability CVE-2026-84961 does not affect version 6.21.3 of undici. not_affected \u2014 undici 6.21.3 BalancedPool does not JSON-clone its constructor options. It copies them with a shallow Object.assign, so function-valued connect/tls options (e.g. checkServerIdentity) reach each per-upstream Pool intact. The lossy JSON clone that the CVE describes is absent from BalancedPool in this 6.x line.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-84961" }, "impact_statement": "not_affected \u2014 undici 6.21.3 BalancedPool does not JSON-clone its constructor options. It copies them with a shallow Object.assign, so function-valued connect/tls options (e.g. checkServerIdentity) reach each per-upstream Pool intact. The lossy JSON clone that the CVE describes is absent from BalancedPool in this 6.x line." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T20:33:15.400563+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 6.21.3 of undici. not_affected \u2014 Target is undici 6.21.3, which has no HTTP cache interceptor (interceptors.cache), no CacheStore/cache handler and no canCacheResponse. The vulnerable component, introduced in the 7.x line, is absent, so the unsafe-method caching flaw cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 Target is undici 6.21.3, which has no HTTP cache interceptor (interceptors.cache), no CacheStore/cache handler and no canCacheResponse. The vulnerable component, introduced in the 7.x line, is absent, so the unsafe-method caching flaw cannot occur." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T20:19:00.066324+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 6.21.3 of undici. not_affected \u2014 undici 6.21.3 does not implement WebSocketStream, which was introduced in 7.0.0. The vulnerable close handler that calls abort() on a locked writable stream is absent from the target, so CVE-2026-85014 does not apply.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 undici 6.21.3 does not implement WebSocketStream, which was introduced in 7.0.0. The vulnerable close handler that calls abort() on a locked writable stream is absent from the target, so CVE-2026-85014 does not apply." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-14T02:13:19.192215+00:00", "status_notes": "Vulnerability CVE-2026-85024 does not affect version 6.21.3 of undici. not_affected \u2014 Not affected. The crash needs a decompressed-size-limit cleanup that calls removeAllListeners() on the InflateRaw stream. This 6.21.3 target has no such limit or cleanup. Its 'error' listener stays attached for the stream's whole life, so a malformed DEFLATE block is routed to the receiver callback, which closes the socket with code 1007. The patch diffs were not provided (URLs only), so this r...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-85024" }, "impact_statement": "not_affected \u2014 Not affected. The crash needs a decompressed-size-limit cleanup that calls removeAllListeners() on the InflateRaw stream. This 6.21.3 target has no such limit or cleanup. Its 'error' listener stays attached for the stream's whole life, so a malformed DEFLATE block is routed to the receiver callback, which closes the socket with code 1007. The patch diffs were not provided (URLs only), so this r..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-14T02:32:59.548927+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 6.21.3 of undici. not_affected \u2014 Target is undici 6.21.3. The cache and deduplicate interceptors that CVE-2026-85152 concerns (added in 8.10.0) do not exist here, so the cross-origin key collision cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 6.21.3. The cache and deduplicate interceptors that CVE-2026-85152 concerns (added in 8.10.0) do not exist here, so the cross-origin key collision cannot occur." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 6.21.3 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 6.21.3 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T21:20:05.659204+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 6.21.3 of undici. not_affected \u2014 undici 6.21.3 has no `decompress` interceptor, so the vulnerable component is absent. The advisory targets that interceptor in the 7.x and 8.x lines (fixed in 7.30.1 and 8.12.2). Here `interceptors` exports only redirect, retry, dump and dns. The one place that decompresses, the fetch path, uses a different structure and does not have the flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 undici 6.21.3 has no `decompress` interceptor, so the vulnerable component is absent. The advisory targets that interceptor in the 7.x and 8.x lines (fixed in 7.30.1 and 8.12.2). Here `interceptors` exports only redirect, retry, dump and dns. The one place that decompresses, the fetch path, uses a different structure and does not have the flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-14T01:51:00.048861+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 6.21.3 of undici. not_affected \u2014 Not affected. CVE-2026-9675 is a regression in undici 8.1.0, where the per-frame maxPayloadSize check was added without a cumulative check across fragments. This target is undici 6.21.3. It has no maxPayloadSize option, no per-frame limit and no cumulative limit, so the flawed limit-enforcement code is absent. The advisory itself says 7.x, which also lacks the feature, is unaffected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 Not affected. CVE-2026-9675 is a regression in undici 8.1.0, where the per-frame maxPayloadSize check was added without a cumulative check across fragments. This target is undici 6.21.3. It has no maxPayloadSize option, no per-frame limit and no cumulative limit, so the flawed limit-enforcement code is absent. The advisory itself says 7.x, which also lacks the feature, is unaffected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T20:10:29.841377+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 6.21.3 of undici. not_affected \u2014 Target undici 6.21.3 has no cache interceptor, no Cache-Control response parser and no shared-cache mode. The vulnerable code from CVE-2026-9678 (interceptors.cache() in 7.x/8.x) does not exist here, so it is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Target undici 6.21.3 has no cache interceptor, no Cache-Control response parser and no shared-cache mode. The vulnerable code from CVE-2026-9678 (interceptors.cache() in 7.x/8.x) does not exist here, so it is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T20:01:00.036985+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 6.21.3 of undici. not_affected \u2014 undici 6.21.3 is not affected. Its cookie parser (lib/web/cookies/parse.js) never percent-decodes cookie values. The qsUnescape call that CVE-2026-9679 describes was added in 7.0.0 by PR #3789 and does not exist in this 6.x branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 undici 6.21.3 is not affected. Its cookie parser (lib/web/cookies/parse.js) never percent-decodes cookie values. The qsUnescape call that CVE-2026-9679 describes was added in 7.0.0 by PR #3789 and does not exist in this 6.x branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.21.3", "identifiers": { "purl": "pkg:npm/undici@6.21.3" } } ], "timestamp": "2026-11-13T20:11:39.195113+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 6.21.3 of undici. not_affected \u2014 undici 6.21.3 has no SOCKS5 support. The bug was introduced in 7.23.0 when Socks5ProxyAgent and socks:// handling in ProxyAgent were added. This tree has no such code, and ProxyAgent forwards requestTls to the target TLS upgrade (HTTP CONNECT path).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 undici 6.21.3 has no SOCKS5 support. The bug was introduced in 7.23.0 when Socks5ProxyAgent and socks:// handling in ProxyAgent were added. This tree has no such code, and ProxyAgent forwards requestTls to the target TLS upgrade (HTTP CONNECT path)." } ] }