{ "@id": "urn:uuid:7c7a8d65-58bf-4794-9aa2-67257156a559", "role": "Document Creator", "author": "https://tuxcare.com", "version": 51, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:57:29.427470+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 6.26.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 6.26.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 6.26.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 6.26.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 6.26.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 6.26.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 6.26.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T23:59:37.286671+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 already contains the upstream fix for CVE-2023-45143 (commit e041de35, GHSA-wqq4-5wpv-mx2g). The fetch redirect path deletes the cookie header on cross-origin redirects. The dispatcher redirect handler strips cookie the same way. The fix is part of the upstream release, so the case is not_affected, not already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 undici 6.26.0 already contains the upstream fix for CVE-2023-45143 (commit e041de35, GHSA-wqq4-5wpv-mx2g). The fetch redirect path deletes the cookie header on cross-origin redirects. The dispatcher redirect handler strips cookie the same way. The fix is part of the upstream release, so the case is not_affected, not already_fixed." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 6.26.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T22:22:00.050269+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 6.26.0 of undici. not_affected \u2014 Target undici 6.26.0 already strips Proxy-Authorization on cross-origin redirects, both in the dispatcher RedirectHandler and in the fetch redirect path. The fix shipped in the upstream release. HEAD has no TuxCare commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Target undici 6.26.0 already strips Proxy-Authorization on cross-origin redirects, both in the dispatcher RedirectHandler and in the fetch redirect path. The fix shipped in the upstream release. HEAD has no TuxCare commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-14T00:27:00.079854+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 6.26.0 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2024-30260 (commit 6805746) is already in undici 6.26.0. cleanRequestHeaders in lib/handler/redirect-handler.js strips authorization, cookie and proxy-authorization when a redirect crosses origin. The fix shipped in the upstream release, and HEAD has no TuxCare commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2024-30260 (commit 6805746) is already in undici 6.26.0. cleanRequestHeaders in lib/handler/redirect-handler.js strips authorization, cookie and proxy-authorization when a redirect crosses origin. The fix shipped in the upstream release, and HEAD has no TuxCare commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T23:33:28.852339+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd, released in 6.11.1). It shipped in the upstream release, so the target is not affected. The SRI check in lib/web/fetch/util.js uses the fixed implementation: strict hash-with-options parsing, strongest-algorithm selection, algorithm filtering, and an exact digest comparison.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 undici 6.26.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd, released in 6.11.1). It shipped in the upstream release, so the target is not affected. The SRI check in lib/web/fetch/util.js uses the fixed implementation: strict hash-with-options parsing, strongest-algorithm selection, algorithm filtering, and an exact digest comparison." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 6.26.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T21:30:26.243563+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 6.26.0 of undici. not_affected \u2014 Not affected. The multipart boundary in lib/web/fetch/body.js is generated with crypto.randomInt (CSPRNG), which is the upstream fix for CVE-2025-22150. The fix (nodejs/undici c3acc6050b78, Matteo Collina) shipped in the upstream v6.26.0 release, so the vulnerable Math.random() boundary generation is not present in HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 Not affected. The multipart boundary in lib/web/fetch/body.js is generated with crypto.randomInt (CSPRNG), which is the upstream fix for CVE-2025-22150. The fix (nodejs/undici c3acc6050b78, Matteo Collina) shipped in the upstream v6.26.0 release, so the vulnerable Math.random() boundary generation is not present in HEAD." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2025-47279 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2025-47279" }, "action_statement": "Vulnerability CVE-2025-47279 affects version 6.26.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 6.26.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T21:14:55.144640+00:00", "status_notes": "Vulnerability CVE-2026-109829 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 has no HTTP cache interceptor and no MemoryCacheStore or SqliteCacheStore. The cache interceptor was introduced in undici 7.0.0, and the CVE affects only 7.x and 8.x. The vulnerable compose(redirect(), cache()) key-confusion path does not exist in this tree. The repo is the same product lineage (undici), so this is not a false_positive.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109829" }, "impact_statement": "not_affected \u2014 undici 6.26.0 has no HTTP cache interceptor and no MemoryCacheStore or SqliteCacheStore. The cache interceptor was introduced in undici 7.0.0, and the CVE affects only 7.x and 8.x. The vulnerable compose(redirect(), cache()) key-confusion path does not exist in this tree. The repo is the same product lineage (undici), so this is not a false_positive." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T21:17:27.820564+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 is not affected. The CVE describes a regression introduced in 7.15.0, where the SRI algorithm token was looked up case-sensitively. In this 6.x tree, parseMetadata() in lib/web/fetch/util.js lowercases the algorithm token before checking it against the supported hashes. Uppercase and mixed-case tokens such as SHA256-... are therefore recognized and verified. A runtime check confir...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 undici 6.26.0 is not affected. The CVE describes a regression introduced in 7.15.0, where the SRI algorithm token was looked up case-sensitively. In this 6.x tree, parseMetadata() in lib/web/fetch/util.js lowercases the algorithm token before checking it against the supported hashes. Uppercase and mixed-case tokens such as SHA256-... are therefore recognized and verified. A runtime check confir..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-14T02:57:29.427470+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 6.26.0 of undici. not_affected \u2014 Target is undici 6.26.0. The CVE concerns WebSocket-over-HTTP/2 support introduced in 8.11.0 (8.11.0 and 8.11.1 affected). This tree has no such support: an upgrade request over an H2 session is rejected before any stream is created, and allowH2 defaults to false. No orphaned ClientHttp2Stream can result from a failed WebSocket handshake.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 6.26.0. The CVE concerns WebSocket-over-HTTP/2 support introduced in 8.11.0 (8.11.0 and 8.11.1 affected). This tree has no such support: an upgrade request over an H2 session is rejected before any stream is created, and allowH2 defaults to false. No orphaned ClientHttp2Stream can result from a failed WebSocket handshake." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-10-15T18:28:00.152357+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 6.26.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-10-15T18:33:00.174668+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 6.26.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 6.26.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 6.26.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 6.26.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T21:25:37.080118+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 6.26.0 of undici. not_affected \u2014 Target is undici 6.26.0. The CVE concerns the shared HTTP cache interceptor (interceptors.cache, cache stores) introduced in undici 7.x, composed with the redirect interceptor. This tree has no such interceptor or cache store, so the vulnerable chain (cache-generated If-None-Match/If-Modified-Since validators surviving a cross-origin redirect and being validated by a foreign 304) cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 Target is undici 6.26.0. The CVE concerns the shared HTTP cache interceptor (interceptors.cache, cache stores) introduced in undici 7.x, composed with the redirect interceptor. This tree has no such interceptor or cache store, so the vulnerable chain (cache-generated If-None-Match/If-Modified-Since validators surviving a cross-origin redirect and being validated by a foreign 304) cannot occur." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T21:23:00.051505+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 6.26.0 of undici. not_affected \u2014 Target is undici 6.26.0. The cache interceptor and the decompress interceptor that CVE-2026-120222 concerns were introduced in undici 7.0.0 and do not exist in this tree. The only 'cache' code is the WHATWG Cache API in lib/web/cache, which is a different component and never replays responses through dispatch handlers. The fix commits are not ancestors of HEAD, and there is nothing for them to ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 Target is undici 6.26.0. The cache interceptor and the decompress interceptor that CVE-2026-120222 concerns were introduced in undici 7.0.0 and do not exist in this tree. The only 'cache' code is the WHATWG Cache API in lib/web/cache, which is a different component and never replays responses through dispatch handlers. The fix commits are not ancestors of HEAD, and there is nothing for them to ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T21:23:19.613002+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 is not affected. The redirect handler's cleanRequestHeaders does treat arrays as flat lists, so tuple arrays would not be stripped. But the 6.x Request constructor rejects tuple-array headers before any redirect can happen. The v6 tree also has no cache or deduplicate interceptor to re-serialize retained headers. Tuple input therefore cannot reach the credential-disclosure goal.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 undici 6.26.0 is not affected. The redirect handler's cleanRequestHeaders does treat arrays as flat lists, so tuple arrays would not be stripped. But the 6.x Request constructor rejects tuple-array headers before any redirect can happen. The v6 tree also has no cache or deduplicate interceptor to re-serialize retained headers. Tuple input therefore cannot reach the credential-disclosure goal." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T21:24:42.697192+00:00", "status_notes": "Vulnerability CVE-2026-120423 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 still splits integrity metadata on a single space (lib/web/fetch/util.js:637), so the CVE's split pattern is present. The CVE's outcome does not occur, though. The per-token regex at line 622 is unanchored, so a tab, newline, FF, CR or VT next to a digest still yields a recognized sha256/384/512 entry. The list never becomes empty, and a mismatching body is rejected. I confirmed t...", "vulnerability": { "name": "CVE-2026-120423" }, "impact_statement": "not_affected \u2014 undici 6.26.0 still splits integrity metadata on a single space (lib/web/fetch/util.js:637), so the CVE's split pattern is present. The CVE's outcome does not occur, though. The per-token regex at line 622 is unanchored, so a tab, newline, FF, CR or VT next to a digest still yields a recognized sha256/384/512 entry. The list never becomes empty, and a mismatching body is rejected. I confirmed t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T21:20:59.401455+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 6.26.0 of undici. not_affected \u2014 Target is undici 6.26.0. The CVE concerns the HTTP response-cache interceptor and cache stores added in the 7.x line, combined with the redirect interceptor. The 6.x tree has no such cache interceptor or cache store, so a redirected credentialed response can't be stored in a shared cache by this code. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 Target is undici 6.26.0. The CVE concerns the HTTP response-cache interceptor and cache stores added in the 7.x line, combined with the redirect interceptor. The 6.x tree has no such cache interceptor or cache store, so a redirected credentialed response can't be stored in a shared cache by this code. Not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 6.26.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T20:09:00.046186+00:00", "status_notes": "Vulnerability CVE-2026-13697 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 has no HTTP cache interceptor and no lib/util/cache.js. The Cache-Control parser and shared-cache store that CVE-2026-13697 patches were added in later undici lines (7.x/8.x). The target has no code that parses `private` or `private=\"...\"` directives or stores responses in a shared cache, so neither the disclosure nor the parser crash can occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-13697" }, "impact_statement": "not_affected \u2014 undici 6.26.0 has no HTTP cache interceptor and no lib/util/cache.js. The Cache-Control parser and shared-cache store that CVE-2026-13697 patches were added in later undici lines (7.x/8.x). The target has no code that parses `private` or `private=\"...\"` directives or stores responses in a shared cache, so neither the disclosure nor the parser crash can occur." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T20:08:00.042663+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 has no HTTP cache interceptor (interceptors.cache()), no Cache-Control directive parser, and no shared-cache store. The vulnerable code introduced in 7.x is absent, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 undici 6.26.0 has no HTTP cache interceptor (interceptors.cache()), no Cache-Control directive parser, and no shared-cache store. The vulnerable code introduced in 7.x is absent, so the target is not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 6.26.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T21:51:00.156457+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 already contains the upstream fix for CVE-2026-1525. processHeader in lib/core/request.js throws on a second content-length header, and the check runs after the header name is lowercased, so case variants are caught. The fix commit 4e0179ae is authored by upstream (Matteo Collina) and is already in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 undici 6.26.0 already contains the upstream fix for CVE-2026-1525. processHeader in lib/core/request.js throws on a second content-length header, and the check runs after the header name is lowercased, so case variants are caught. The fix commit 4e0179ae is authored by upstream (Matteo Collina) and is already in the upstream release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 6.26.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T22:11:00.043442+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 6.26.0 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2026-1527 (nodejs/undici commit e43e898603dd, \"validate upgrade header to prevent CRLF injection\") is already in undici 6.26.0. Request construction in lib/core/request.js rejects any `upgrade` value containing CR, LF or other invalid header characters before the value reaches the h1 writer. The fix is upstream-authored and shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2026-1527 (nodejs/undici commit e43e898603dd, \"validate upgrade header to prevent CRLF injection\") is already in undici 6.26.0. Request construction in lib/core/request.js rejects any `upgrade` value containing CR, LF or other invalid header characters before the value reaches the h1 writer. The fix is upstream-authored and shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T22:00:48.612672+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 already contains the upstream fix for CVE-2026-1528. In the 64-bit payload-length state, ByteParser rejects any length with a non-zero upper 32 bits, or a lower 32 bits above 2^31-1. It then fails the WebSocket connection gracefully, so no overflow or fatal TypeError occurs. The fix is upstream commit 5a97f0893 by Matteo Collina. It is part of the upstream v6.26.0 release, and HEA...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 undici 6.26.0 already contains the upstream fix for CVE-2026-1528. In the 64-bit payload-length state, ByteParser rejects any length with a non-zero upper 32 bits, or a lower 32 bits above 2^31-1. It then fails the WebSocket connection gracefully, so no overflow or fatal TypeError occurs. The fix is upstream commit 5a97f0893 by Matteo Collina. It is part of the upstream v6.26.0 release, and HEA..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 6.26.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 6.26.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-05T09:05:18.396710+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 6.26.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-09-29T18:46:58.638266+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 6.26.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-09-29T18:46:58.638266+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 6.26.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T21:43:00.063150+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 already contains the upstream fix for CVE-2026-22036. fetch() rejects any response whose Content-Encoding lists more than 5 codings before it builds the decoder pipeline. The fix commit d3aafea7 is by Matteo Collina (upstream). It is an ancestor of HEAD and is part of the upstream 6.x release line. HEAD has no TuxCare-domain commits. The 6.x tree has no decompress interceptor, so ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 undici 6.26.0 already contains the upstream fix for CVE-2026-22036. fetch() rejects any response whose Content-Encoding lists more than 5 codings before it builds the decoder pipeline. The fix commit d3aafea7 is by Matteo Collina (upstream). It is an ancestor of HEAD and is part of the upstream 6.x release line. HEAD has no TuxCare-domain commits. The 6.x tree has no decompress interceptor, so ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 6.26.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-14T01:31:05.709934+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 6.26.0 of undici. not_affected \u2014 The target is undici 6.26.0, the same product as the advisory. It has no deduplicate interceptor, so the vulnerable accumulation logic does not exist in this tree. lib/interceptor/ contains only dns, dump, redirect, redirect-interceptor, response-error and retry. index.js exports only redirect, retry, dump and dns under `interceptors`. A case-insensitive search for \"dedup\" across the repo, excl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 The target is undici 6.26.0, the same product as the advisory. It has no deduplicate interceptor, so the vulnerable accumulation logic does not exist in this tree. lib/interceptor/ contains only dns, dump, redirect, redirect-interceptor, response-error and retry. index.js exports only redirect, retry, dump and dns under `interceptors`. A case-insensitive search for \"dedup\" across the repo, excl..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 6.26.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T20:09:39.760132+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 6.26.0 of undici. not_affected \u2014 Target is undici 6.26.0, which has no Socks5ProxyAgent or any SOCKS5 code. The vulnerable cross-origin pool reuse (introduced in 7.23.0 via #4385) does not exist in this tree. The fix commit 3805b8f8 is not an ancestor of HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Target is undici 6.26.0, which has no Socks5ProxyAgent or any SOCKS5 code. The vulnerable cross-origin pool reuse (introduced in 7.23.0 via #4385) does not exist in this tree. The fix commit 3805b8f8 is not an ancestor of HEAD." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T20:49:50.518578+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 does not contain interceptors.decompress(), the component this CVE is about. The interceptor was added in a later release line, and the only commits mentioning it are not ancestors of HEAD. The interceptors export lists only redirect, retry, dump and dns. The fix adds a maxSize option to that interceptor, so there is no vulnerable code in this tree to patch. Fetch's own response d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 undici 6.26.0 does not contain interceptors.decompress(), the component this CVE is about. The interceptor was added in a later release line, and the only commits mentioning it are not ancestors of HEAD. The interceptors export lists only redirect, retry, dump and dns. The fix adds a maxSize option to that interceptor, so there is no vulnerable code in this tree to patch. Fetch's own response d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T20:42:47.265621+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 does not ship the HTTP cache interceptor (interceptors.cache() / shared cache store) that CVE-2026-84933 concerns. The component was introduced in 7.x, so the vulnerable code is absent from this tree.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 undici 6.26.0 does not ship the HTTP cache interceptor (interceptors.cache() / shared cache store) that CVE-2026-84933 concerns. The component was introduced in 7.x, so the vulnerable code is absent from this tree." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 6.26.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T20:37:00.086722+00:00", "status_notes": "Vulnerability CVE-2026-84961 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 BalancedPool does not JSON-deep-clone its options. addUpstream() passes a shallow Object.assign copy to each per-upstream Pool, so function-valued connect/tls (checkServerIdentity, custom connector) are preserved. The vulnerable pattern is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84961" }, "impact_statement": "not_affected \u2014 undici 6.26.0 BalancedPool does not JSON-deep-clone its options. addUpstream() passes a shallow Object.assign copy to each per-upstream Pool, so function-valued connect/tls (checkServerIdentity, custom connector) are preserved. The vulnerable pattern is absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T20:30:18.013446+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 does not ship `interceptors.cache()` or any HTTP response-caching dispatcher component. The CVE's vulnerable code (the cache interceptor's skip-list and `canCacheResponse`, in the 7.x/8.x lines) is absent, so the unsafe-method replay flaw cannot occur. The Web Cache API (`lib/web/cache`) is a different component and restricts caching to GET.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 undici 6.26.0 does not ship `interceptors.cache()` or any HTTP response-caching dispatcher component. The CVE's vulnerable code (the cache interceptor's skip-list and `canCacheResponse`, in the 7.x/8.x lines) is absent, so the unsafe-method replay flaw cannot occur. The Web Cache API (`lib/web/cache`) is a different component and restricts caching to GET." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T20:19:00.066324+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 6.26.0 of undici. not_affected \u2014 Target is undici 6.26.0. The WebSocketStream API was introduced in undici 7.0.0 and does not exist in this tree. The vulnerable socket-close handler that aborts a locked writable stream is therefore absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 Target is undici 6.26.0. The WebSocketStream API was introduced in undici 7.0.0 and does not exist in this tree. The vulnerable socket-close handler that aborts a locked writable stream is therefore absent." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-10-15T12:23:19.034848+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 6.26.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-14T02:33:14.008550+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 6.26.0 of undici. not_affected \u2014 The target is undici 6.26.0. The CVE concerns interceptors.cache() and interceptors.deduplicate(), which were introduced in undici 8.10.0 and are absent here. The vulnerable cache/dedup key-building code does not exist in this repo, so it is not affected. The patch was only a URL and could not be fetched, so the fix itself was not inspected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 The target is undici 6.26.0. The CVE concerns interceptors.cache() and interceptors.deduplicate(), which were introduced in undici 8.10.0 and are absent here. The vulnerable cache/dedup key-building code does not exist in this repo, so it is not affected. The patch was only a URL and could not be fetched, so the fix itself was not inspected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 6.26.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 6.26.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T21:20:05.659204+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 has no `decompress` interceptor. The vulnerable code from the 7.x/8.x line, which forwards decompressed zlib output to the downstream handler from stream event callbacks, is absent. The only HTTP response decompression is in the fetch implementation, and it uses a stream pipeline with error handlers. The target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 undici 6.26.0 has no `decompress` interceptor. The vulnerable code from the 7.x/8.x line, which forwards decompressed zlib output to the downstream handler from stream event callbacks, is absent. The only HTTP response decompression is in the fetch implementation, and it uses a stream pipeline with error handlers. The target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-14T01:57:00.064318+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 is not affected. The CVE is a regression in undici 8.1.0, and the 6.x line shipped the cumulative fragment-size check from the start. The receiver tracks the running total of buffered fragment bytes and fails the connection once it exceeds maxPayloadSize. The check came in with upstream commit d7a1e55f (Matteo Collina), which is in the upstream 6.25.0 release, before any TuxCare c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 undici 6.26.0 is not affected. The CVE is a regression in undici 8.1.0, and the 6.x line shipped the cumulative fragment-size check from the start. The receiver tracks the running total of buffered fragment bytes and fails the connection once it exceeds maxPayloadSize. The check came in with upstream commit d7a1e55f (Matteo Collina), which is in the upstream 6.25.0 release, before any TuxCare c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T20:10:42.607674+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 has no HTTP cache interceptor, cache stores, or Cache-Control response parser. The vulnerable code (qualified private/no-cache field-name parsing in the shared-cache interceptor) does not exist in this tree, so the CVE does not apply.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 undici 6.26.0 has no HTTP cache interceptor, cache stores, or Cache-Control response parser. The vulnerable code (qualified private/no-cache field-name parsing in the shared-cache interceptor) does not exist in this tree, so the CVE does not apply." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T20:01:00.036985+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 6.26.0 of undici. not_affected \u2014 undici 6.26.0 is not affected by CVE-2026-9679. The vulnerable percent-decoding (qsUnescape) of cookie values, added in 7.0.0 via #3789, does not exist in this 6.x tree. parseSetCookie and getCookies return cookie values verbatim, so %0D%0A, %00, %3B and %3D are never turned into literal bytes.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 undici 6.26.0 is not affected by CVE-2026-9679. The vulnerable percent-decoding (qsUnescape) of cookie values, added in 7.0.0 via #3789, does not exist in this 6.x tree. parseSetCookie and getCookies return cookie values verbatim, so %0D%0A, %00, %3B and %3D are never turned into literal bytes." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.26.0", "identifiers": { "purl": "pkg:npm/undici@6.26.0" } } ], "timestamp": "2026-11-13T20:14:00.045604+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 6.26.0 of undici. not_affected \u2014 Target is undici 6.26.0. The CVE concerns the SOCKS5 proxy support (Socks5ProxyAgent / ProxyAgent with socks5:// URIs), added in undici 7.23.0. That code does not exist in this tree, so the SOCKS5 path that drops requestTls cannot be reached. The fix commit 04201f89 is not an ancestor of HEAD; it only appears on other refs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 Target is undici 6.26.0. The CVE concerns the SOCKS5 proxy support (Socks5ProxyAgent / ProxyAgent with socks5:// URIs), added in undici 7.23.0. That code does not exist in this tree, so the SOCKS5 path that drops requestTls cannot be reached. The fix commit 04201f89 is not an ancestor of HEAD; it only appears on other refs." } ] }