{ "@id": "urn:uuid:09d5664c-840e-48ad-ae09-97c1e378fb46", "role": "Document Creator", "author": "https://tuxcare.com", "version": 52, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:57:29.427470+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 6.24.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 6.24.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 6.24.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 6.24.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 6.24.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 6.24.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 6.24.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-14T00:03:17.546677+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 6.24.0 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2023-45143 (undici commit e041de35, GHSA-wqq4-5wpv-mx2g) is already present in the target (undici 6.24.0). On a cross-origin redirect, fetch now deletes cookie (and host, authorization, proxy-authorization). The upstream commit is authored by a non-TuxCare author and predates the first TuxCare commit, so it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2023-45143 (undici commit e041de35, GHSA-wqq4-5wpv-mx2g) is already present in the target (undici 6.24.0). On a cross-origin redirect, fetch now deletes cookie (and host, authorization, proxy-authorization). The upstream commit is authored by a non-TuxCare author and predates the first TuxCare commit, so it shipped in the upstream release." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 6.24.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T22:21:34.173747+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 6.24.0 of undici. not_affected \u2014 Target undici 6.24.0 already strips Proxy-Authorization on cross-origin redirects in both the fetch path and the dispatcher RedirectHandler. The fix shipped with the upstream release. HEAD has no commit by a @cloudlinux.com or @tuxcare.com author, so this is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Target undici 6.24.0 already strips Proxy-Authorization on cross-origin redirects in both the fetch path and the dispatcher RedirectHandler. The fix shipped with the upstream release. HEAD has no commit by a @cloudlinux.com or @tuxcare.com author, so this is not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-14T00:27:00.079854+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 already contains the upstream fix for CVE-2024-30260. lib/handler/redirect-handler.js strips authorization, cookie and proxy-authorization headers when the redirect target origin differs from the original. This applies to undici.request() as well as fetch(). The fix commit 6805746 is an ancestor of HEAD and was authored upstream by Matteo Collina. It shipped in the upstream releas...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 undici 6.24.0 already contains the upstream fix for CVE-2024-30260. lib/handler/redirect-handler.js strips authorization, cookie and proxy-authorization headers when the redirect target origin differs from the original. This applies to undici.request() as well as fetch(). The fix commit 6805746 is an ancestor of HEAD and was authored upstream by Matteo Collina. It shipped in the upstream releas..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T23:33:00.074877+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 6.24.0 of undici. not_affected \u2014 Target undici 6.24.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). Commit d542b8cd is an ancestor of HEAD, and lib/web/fetch/util.js has the fixed integrity logic. The fix shipped in the upstream release, so this is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Target undici 6.24.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). Commit d542b8cd is an ancestor of HEAD, and lib/web/fetch/util.js has the fixed integrity logic. The fix shipped in the upstream release, so this is not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 6.24.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T21:30:26.243563+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 already ships the upstream fix for CVE-2025-22150. The multipart boundary is generated via crypto.randomInt, not Math.random. The upstream fix commit c3acc605 (Matteo Collina) is in the upstream release that precedes all TuxCare commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 undici 6.24.0 already ships the upstream fix for CVE-2025-22150. The multipart boundary is generated via crypto.randomInt, not Math.random. The upstream fix commit c3acc605 (Matteo Collina) is in the upstream release that precedes all TuxCare commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T21:37:00.197268+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit 133387138c, \"Removed clients with unrecoverable errors from the Pool\"). Pool's constructor registers a 'connectionError' handler that splices failed clients out of this[kClients]. Failed-connection clients therefore no longer accumulate. The fix was authored upstream by Matteo Collina and is in th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 undici 6.24.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit 133387138c, \"Removed clients with unrecoverable errors from the Pool\"). Pool's constructor registers a 'connectionError' handler that splices failed clients out of this[kClients]. Failed-connection clients therefore no longer accumulate. The fix was authored upstream by Matteo Collina and is in th..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 6.24.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T21:14:00.047255+00:00", "status_notes": "Vulnerability CVE-2026-109829 does not affect version 6.24.0 of undici. not_affected \u2014 Target is undici 6.24.0. The CVE concerns the HTTP cache interceptor (interceptors.cache(), MemoryCacheStore, SqliteCacheStore) composed after the redirect interceptor. That interceptor was introduced in undici 7.0.0 and does not exist in the 6.x tree. The target has no component that stores dispatcher responses in a shared cache, so a redirected response cannot be stored under the original URL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109829" }, "impact_statement": "not_affected \u2014 Target is undici 6.24.0. The CVE concerns the HTTP cache interceptor (interceptors.cache(), MemoryCacheStore, SqliteCacheStore) composed after the redirect interceptor. That interceptor was introduced in undici 7.0.0 and does not exist in the 6.x tree. The target has no component that stores dispatcher responses in a shared cache, so a redirected response cannot be stored under the original URL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T21:17:00.039866+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 is not affected. parseMetadata() in lib/web/fetch/util.js ASCII-lowercases the SRI algorithm token (line 658) before the supportedHashes lookup (line 662), so SHA256-/Sha256- tokens are recognized and verified. The regression described (7.15.0) is not present in this 6.x tree. The one mixed-case edge I found fails closed, so it is not a bypass.", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 undici 6.24.0 is not affected. parseMetadata() in lib/web/fetch/util.js ASCII-lowercases the SRI algorithm token (line 658) before the supportedHashes lookup (line 662), so SHA256-/Sha256- tokens are recognized and verified. The regression described (7.15.0) is not present in this 6.x tree. The one mixed-case edge I found fails closed, so it is not a bypass." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-14T02:57:29.427470+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 6.24.0 of undici. not_affected \u2014 The target is undici 6.24.0. The CVE says the bug was introduced in 8.11.0, when WebSocket-over-HTTP/2 support was added. This 6.x tree has no such support. WebSocket upgrades over H2 are rejected before any stream is created, and allowH2 defaults to false. So the orphaned-stream crash cannot occur. I could not read the vendor patch (only a URL was provided), so the brief is built from the CVE ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 The target is undici 6.24.0. The CVE says the bug was introduced in 8.11.0, when WebSocket-over-HTTP/2 support was added. This 6.x tree has no such support. WebSocket upgrades over H2 are rejected before any stream is created, and allowH2 defaults to false. So the orphaned-stream crash cannot occur. I could not read the vendor patch (only a URL was provided), so the brief is built from the CVE ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-10-15T18:28:00.152357+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 6.24.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-10-15T18:33:00.174668+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 6.24.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 6.24.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 6.24.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 6.24.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T21:26:00.042227+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 6.24.0 of undici. not_affected \u2014 Target is undici 6.24.0, which has no shared HTTP cache interceptor or cache store. Those arrived in 7.0, and the CVE affects 7.0.0-7.30.1 and 8.0.0-8.12.3. Nothing in 6.24.0 generates If-None-Match or If-Modified-Since validators from a stored response, and nothing accepts a 304 as revalidation of one. The redirect-then-cache chain therefore cannot occur. The patch content was not supplied, on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 Target is undici 6.24.0, which has no shared HTTP cache interceptor or cache store. Those arrived in 7.0, and the CVE affects 7.0.0-7.30.1 and 8.0.0-8.12.3. Nothing in 6.24.0 generates If-None-Match or If-Modified-Since validators from a stored response, and nothing accepts a 304 as revalidation of one. The redirect-then-cache chain therefore cannot occur. The patch content was not supplied, on..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T21:21:48.734291+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 has no HTTP cache interceptor and no decompress interceptor. CVE-2026-120222 concerns the cache interceptor, which was added in the 7.x line and affects 7.0.0-7.30.1 and 8.0.0-8.12.3. The affected component is absent from this 6.x tree, so there is no replay path where a downstream handler's throw could escape as an uncaught error.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 undici 6.24.0 has no HTTP cache interceptor and no decompress interceptor. CVE-2026-120222 concerns the cache interceptor, which was added in the 7.x line and affects 7.0.0-7.30.1 and 8.0.0-8.12.3. The affected component is absent from this 6.x tree, so there is no replay path where a downstream handler's throw could escape as an uncaught error." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T21:23:30.480922+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 is not exploitable by CVE-2026-120415. The redirect handler's cleanRequestHeaders only understands flat arrays and plain objects, which is the same blind spot as upstream. But a tuple array (e.g. from Object.entries) never reaches the redirect handler's stripping step. The core Request constructor (lib/core/request.js:163-169) treats every array as a flat list and rejects tuple ar...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 undici 6.24.0 is not exploitable by CVE-2026-120415. The redirect handler's cleanRequestHeaders only understands flat arrays and plain objects, which is the same blind spot as upstream. But a tuple array (e.g. from Object.entries) never reaches the redirect handler's stripping step. The core Request constructor (lib/core/request.js:163-169) treats every array as a flat list and rejects tuple ar..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T21:24:42.697192+00:00", "status_notes": "Vulnerability CVE-2026-120423 does not affect version 6.24.0 of undici. not_affected \u2014 The target is undici 6.24.0, which is outside the CVE's affected ranges (7.15.0-7.30.1 and 8.0.0-8.12.3). I did not rely on the version alone. lib/web/fetch/util.js parseMetadata still tokenizes with split(' '), but the token regex parseHashWithOptions is unanchored, so a digest preceded by a tab or other ASCII whitespace is still recognized and enforced. A wrong body is rejected, so the CVE's ...", "vulnerability": { "name": "CVE-2026-120423" }, "impact_statement": "not_affected \u2014 The target is undici 6.24.0, which is outside the CVE's affected ranges (7.15.0-7.30.1 and 8.0.0-8.12.3). I did not rely on the version alone. lib/web/fetch/util.js parseMetadata still tokenizes with split(' '), but the token regex parseHashWithOptions is unanchored, so a digest preceded by a tab or other ASCII whitespace is still recognized and enforced. A wrong body is rejected, so the CVE's ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T21:20:59.401455+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 6.24.0 of undici. not_affected \u2014 Target is undici 6.24.0 (same product lineage as the CVE, so not a false positive). The CVE needs the redirect interceptor combined with the shared HTTP response cache interceptor/store, which exist only in the 7.x/8.x lines. This 6.x tree has no HTTP cache interceptor, cache store, or cache-key logic, so a redirected authenticated response cannot be stored under a credential-less key and serve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 Target is undici 6.24.0 (same product lineage as the CVE, so not a false positive). The CVE needs the redirect interceptor combined with the shared HTTP response cache interceptor/store, which exist only in the 7.x/8.x lines. This 6.x tree has no HTTP cache interceptor, cache store, or cache-key logic, so a redirected authenticated response cannot be stored under a credential-less key and serve..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 6.24.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T20:09:00.046186+00:00", "status_notes": "Vulnerability CVE-2026-13697 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 has no cache interceptor and no lib/util/cache.js. It has no response Cache-Control parser, so neither the shared-cache disclosure nor the parser crash from CVE-2026-13697 can occur. The cache interceptor and its parser were added in 7.x, which is where the CVE is fixed (7.29.0 and 8.9.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-13697" }, "impact_statement": "not_affected \u2014 undici 6.24.0 has no cache interceptor and no lib/util/cache.js. It has no response Cache-Control parser, so neither the shared-cache disclosure nor the parser crash from CVE-2026-13697 can occur. The cache interceptor and its parser were added in 7.x, which is where the CVE is fixed (7.29.0 and 8.9.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T20:07:00.106745+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 does not contain the HTTP cache interceptor (interceptors.cache(), lib/interceptor/cache.js, cache handler/store, Cache-Control parser). The CVE concerns that interceptor's Cache-Control directive parsing, which was added in undici 7.x. The code the fix touches is absent, so the vulnerability cannot occur in this target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 undici 6.24.0 does not contain the HTTP cache interceptor (interceptors.cache(), lib/interceptor/cache.js, cache handler/store, Cache-Control parser). The CVE concerns that interceptor's Cache-Control directive parsing, which was added in undici 7.x. The code the fix touches is absent, so the vulnerability cannot occur in this target." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 6.24.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T21:50:46.910418+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 6.24.0 of undici. not_affected \u2014 Target undici 6.24.0 already contains the upstream fix (commit 4e0179ae, a cherry-pick of 74495c63 by Matteo Collina). lib/core/request.js processHeader now throws on a duplicate content-length or host header regardless of case. The fix shipped in the upstream 6.24.0 release, and HEAD's history has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 Target undici 6.24.0 already contains the upstream fix (commit 4e0179ae, a cherry-pick of 74495c63 by Matteo Collina). lib/core/request.js processHeader now throws on a duplicate content-length or host header regardless of case. The fix shipped in the upstream 6.24.0 release, and HEAD's history has no TuxCare-domain commits." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 6.24.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T22:10:03.026859+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 already contains the upstream fix for CVE-2026-1527. The upgrade option is type-checked and validated with isValidHeaderValue in the Request constructor, so CR/LF values are rejected before they reach the header serialization in client-h1.js. The fix is upstream commit e43e8986 by Matteo Collina, which is part of the 6.24.0 release. It is not a TuxCare-authored backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 undici 6.24.0 already contains the upstream fix for CVE-2026-1527. The upgrade option is type-checked and validated with isValidHeaderValue in the Request constructor, so CR/LF values are rejected before they reach the header serialization in client-h1.js. The fix is upstream commit e43e8986 by Matteo Collina, which is part of the 6.24.0 release. It is not a TuxCare-authored backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T22:00:03.479197+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 already contains the upstream fix for CVE-2026-1528. In lib/web/websocket/receiver.js the PAYLOADLENGTH_64 state now rejects any 64-bit length with a non-zero upper word or a lower word above 2^31-1, and fails the connection instead of computing an overflowed length. The fix is upstream commit 5a97f089 (cherry-pick of 84235c62) by Matteo Collina. It is in the 6.24.0 release, and H...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 undici 6.24.0 already contains the upstream fix for CVE-2026-1528. In lib/web/websocket/receiver.js the PAYLOADLENGTH_64 state now rejects any 64-bit length with a non-zero upper word or a lower word above 2^31-1, and fails the connection instead of computing an overflowed length. The fix is upstream commit 5a97f089 (cherry-pick of 84235c62) by Matteo Collina. It is in the 6.24.0 release, and H..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 6.24.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 6.24.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-05T09:05:18.396710+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 6.24.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-09-29T18:46:58.638266+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 6.24.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-09-29T18:46:58.638266+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 6.24.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T21:43:00.063150+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 already contains the upstream fix for CVE-2026-22036. In lib/web/fetch/index.js, a response whose Content-Encoding lists more than 5 codings is rejected before any decoder is built. The fix commit d3aafea7 was authored upstream by Matteo Collina and shipped in the upstream 6.23.0 release. The repo has no TuxCare-domain commit, so the fix is upstream-attributed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 undici 6.24.0 already contains the upstream fix for CVE-2026-22036. In lib/web/fetch/index.js, a response whose Content-Encoding lists more than 5 codings is rejected before any decoder is built. The fix commit d3aafea7 was authored upstream by Matteo Collina and shipped in the upstream 6.23.0 release. The repo has no TuxCare-domain commit, so the fix is upstream-attributed." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 6.24.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-14T01:25:58.286686+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 in this repo has no deduplicate interceptor, so the buffering flaw in CVE-2026-2581 cannot occur. The `interceptors` export in index.js offers only redirect, retry, dump and dns.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 undici 6.24.0 in this repo has no deduplicate interceptor, so the buffering flaw in CVE-2026-2581 cannot occur. The `interceptors` export in index.js offers only redirect, retry, dump and dns." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 6.24.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T20:09:39.760132+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 6.24.0 of undici. not_affected \u2014 Target is undici 6.24.0, the same product lineage as the CVE. It has no Socks5ProxyAgent and no SOCKS support at all. The CVE says the flaw was introduced in undici 7.23.0 (PR #4385), which adds Socks5ProxyAgent. The cross-origin pool reuse cannot occur here (Type A1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Target is undici 6.24.0, the same product lineage as the CVE. It has no Socks5ProxyAgent and no SOCKS support at all. The CVE says the flaw was introduced in undici 7.23.0 (PR #4385), which adds Socks5ProxyAgent. The cross-origin pool reuse cannot occur here (Type A1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T20:49:50.518578+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 does not contain the `interceptors.decompress()` interceptor that CVE-2026-84890 concerns. The decompress interceptor was added in the 7.x/8.x lines, and the fix adds a `maxSize` option to it. The target's `interceptors` export has only redirect, retry, dump and dns. No decompress interceptor source exists in the HEAD tree, so the vulnerable component is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 undici 6.24.0 does not contain the `interceptors.decompress()` interceptor that CVE-2026-84890 concerns. The decompress interceptor was added in the 7.x/8.x lines, and the fix adds a `maxSize` option to it. The target's `interceptors` export has only redirect, retry, dump and dns. No decompress interceptor source exists in the HEAD tree, so the vulnerable component is absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T20:42:47.265621+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 has no HTTP response cache interceptor (interceptors.cache(), cache handler or cache store). CVE-2026-84933 concerns that interceptor in the 7.x/8.x lines, so the vulnerable component is absent from this tree.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 undici 6.24.0 has no HTTP response cache interceptor (interceptors.cache(), cache handler or cache store). CVE-2026-84933 concerns that interceptor in the 7.x/8.x lines, so the vulnerable component is absent from this tree." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 6.24.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T20:37:00.086722+00:00", "status_notes": "Vulnerability CVE-2026-84961 does not affect version 6.24.0 of undici. not_affected \u2014 Not affected. In undici 6.24.0, BalancedPool does not JSON-clone its options. It stores them as-is and gives each upstream pool a shallow Object.assign copy, so function-valued connect/tls options reach the per-upstream Pool unchanged. Pool destructures connect/tls before its own deepClone, so custom checkServerIdentity callbacks and connectors are preserved.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-84961" }, "impact_statement": "not_affected \u2014 Not affected. In undici 6.24.0, BalancedPool does not JSON-clone its options. It stores them as-is and gives each upstream pool a shallow Object.assign copy, so function-valued connect/tls options reach the per-upstream Pool unchanged. Pool destructures connect/tls before its own deepClone, so custom checkServerIdentity callbacks and connectors are preserved." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T20:30:47.394503+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 does not ship interceptors.cache(), the HTTP cache interceptor, cache handler, or cache stores that CVE-2026-85008 concerns. The only interceptors exported are redirect, retry, dump and dns. The cache interceptor was added in the 7.x line, so this 6.x branch lacks the vulnerable code. The web Cache API in lib/web/cache is a different component and is not the code the CVE or its fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 undici 6.24.0 does not ship interceptors.cache(), the HTTP cache interceptor, cache handler, or cache stores that CVE-2026-85008 concerns. The only interceptors exported are redirect, retry, dump and dns. The cache interceptor was added in the 7.x line, so this 6.x branch lacks the vulnerable code. The web Cache API in lib/web/cache is a different component and is not the code the CVE or its fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T20:18:06.138042+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 6.24.0 of undici. not_affected \u2014 The target is undici 6.24.0. It has no WebSocketStream implementation, which was introduced in 7.0.0, so the vulnerable code (a socket-close handler calling abort() on a locked writable stream) does not exist. The classic WebSocket class uses event callbacks and an AbortController, not streams.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 The target is undici 6.24.0. It has no WebSocketStream implementation, which was introduced in 7.0.0, so the vulnerable code (a socket-close handler calling abort() on a locked writable stream) does not exist. The classic WebSocket class uses event callbacks and an AbortController, not streams." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-14T02:19:14.296675+00:00", "status_notes": "Vulnerability CVE-2026-85024 does not affect version 6.24.0 of undici. not_affected \u2014 The size-limit cleanup in lib/web/websocket/permessage-deflate.js calls removeAllListeners(), the pattern the CVE describes. In this target it is immediately followed by inflate.destroy(), and the reference is nulled. I ran a Node 20.20.2 reproduction against the target module: a valid deflate stream expanding past the limit, followed by malformed deflate data. The process did not crash. In 12 ...", "vulnerability": { "name": "CVE-2026-85024" }, "impact_statement": "not_affected \u2014 The size-limit cleanup in lib/web/websocket/permessage-deflate.js calls removeAllListeners(), the pattern the CVE describes. In this target it is immediately followed by inflate.destroy(), and the reference is nulled. I ran a Node 20.20.2 reproduction against the target module: a valid deflate stream expanding past the limit, followed by malformed deflate data. The process did not crash. In 12 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-14T02:32:59.548927+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 6.24.0 of undici. not_affected \u2014 Target is undici 6.24.0, same product as the advisory. The cache and deduplicate interceptors were introduced in undici 8.10.0 and are absent here. The interceptors export only redirect, retry, dump and dns, so no request-key builder exists that could omit the destination origin.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 6.24.0, same product as the advisory. The cache and deduplicate interceptors were introduced in undici 8.10.0 and are absent here. The interceptors export only redirect, retry, dump and dns, so no request-key builder exists that could omit the destination origin." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 6.24.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 6.24.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T21:20:05.659204+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 has no `decompress` interceptor, so the flaw in CVE-2026-87029 cannot occur here. Exported interceptors are redirect, retry, dump and dns. The only HTTP response decompression is in fetch, which pipes the body through zlib streams with error handlers and does not forward decoded data to a user-supplied dispatch handler from zlib callbacks. Only the commit URLs were provided, not a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 undici 6.24.0 has no `decompress` interceptor, so the flaw in CVE-2026-87029 cannot occur here. Exported interceptors are redirect, retry, dump and dns. The only HTTP response decompression is in fetch, which pipes the body through zlib streams with error handlers and does not forward decoded data to a user-supplied dispatch handler from zlib callbacks. Only the commit URLs were provided, not a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-14T01:51:00.048861+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 6.24.0 of undici. not_affected \u2014 CVE-2026-9675 is a regression in undici 8.1.0's `maxPayloadSize` feature: the per-frame limit was enforced but the cumulative size of fragmented messages was not. The target is undici 6.24.0, which has no `maxPayloadSize` option or code, so the regressed code is absent. The advisory says the 7.x line, which also lacks the feature, is unaffected. Fragmented uncompressed messages are still buffer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 CVE-2026-9675 is a regression in undici 8.1.0's `maxPayloadSize` feature: the per-frame limit was enforced but the cumulative size of fragmented messages was not. The target is undici 6.24.0, which has no `maxPayloadSize` option or code, so the regressed code is absent. The advisory says the 7.x line, which also lacks the feature, is unaffected. Fragmented uncompressed messages are still buffer..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T20:11:00.069805+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 6.24.0 of undici. not_affected \u2014 Target is undici 6.24.0 (same product as the advisory). It has no cache interceptor (interceptors.cache()), no cache handler, and no code that parses a Cache-Control response header or its private/no-cache qualified field names. The vulnerable parser and the shared-cache storage path do not exist, so the CVE chain cannot be reached. Type A1.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Target is undici 6.24.0 (same product as the advisory). It has no cache interceptor (interceptors.cache()), no cache handler, and no code that parses a Cache-Control response header or its private/no-cache qualified field names. The vulnerable parser and the shared-cache storage path do not exist, so the CVE chain cannot be reached. Type A1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T20:01:00.036985+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 6.24.0 of undici. not_affected \u2014 undici 6.24.0 does not percent-decode cookie values. The percent-decoding step (qsUnescape in parseSetCookie) was introduced in undici 7.0.0 (PR #3789) and does not exist in this 6.x tree. The cookie parser returns the value verbatim, so encoded sequences never become raw CR/LF/NUL/;/= bytes.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 undici 6.24.0 does not percent-decode cookie values. The percent-decoding step (qsUnescape in parseSetCookie) was introduced in undici 7.0.0 (PR #3789) and does not exist in this 6.x tree. The cookie parser returns the value verbatim, so encoded sequences never become raw CR/LF/NUL/;/= bytes." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.24.0", "identifiers": { "purl": "pkg:npm/undici@6.24.0" } } ], "timestamp": "2026-11-13T20:11:39.195113+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 6.24.0 of undici. not_affected \u2014 Target is undici 6.24.0. SOCKS5 proxy support (Socks5ProxyAgent, socks:// and socks5:// handling in ProxyAgent) was added in 7.23.0 and does not exist in this tree, so the requestTls-dropped-on-SOCKS5 flaw cannot occur. The fix commit 04201f89 is not an ancestor of HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 Target is undici 6.24.0. SOCKS5 proxy support (Socks5ProxyAgent, socks:// and socks5:// handling in ProxyAgent) was added in 7.23.0 and does not exist in this tree, so the requestTls-dropped-on-SOCKS5 flaw cannot occur. The fix commit 04201f89 is not an ancestor of HEAD." } ] }