{ "@id": "urn:uuid:78cadcaf-af43-4896-8a97-9a7a727d22bd", "role": "Document Creator", "author": "https://tuxcare.com", "version": 55, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:59:44.828253+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 6.27.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 6.27.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 6.27.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 6.27.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 6.27.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 6.27.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 6.27.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-14T00:03:46.906673+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 6.27.0 of undici. not_affected \u2014 Not affected. Target is undici 6.27.0, which already ships the upstream fix e041de35 (GHSA-wqq4-5wpv-mx2g). On a cross-origin redirect, fetch deletes authorization, proxy-authorization, cookie and host headers. The dispatcher-level redirect handler also strips cookie on cross-origin redirects.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Not affected. Target is undici 6.27.0, which already ships the upstream fix e041de35 (GHSA-wqq4-5wpv-mx2g). On a cross-origin redirect, fetch deletes authorization, proxy-authorization, cookie and host headers. The dispatcher-level redirect handler also strips cookie on cross-origin redirects." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 6.27.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T22:21:40.164913+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 6.27.0 of undici. not_affected \u2014 Undici 6.27.0 already contains the upstream CVE-2024-24758 fix (shipped in 6.6.1). Both redirect paths strip proxy-authorization on cross-origin redirects, so the Proxy-Authorization leak is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Undici 6.27.0 already contains the upstream CVE-2024-24758 fix (shipped in 6.6.1). Both redirect paths strip proxy-authorization on cross-origin redirects, so the Proxy-Authorization leak is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-14T00:31:00.130291+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 6.27.0 of undici. not_affected \u2014 Not affected. The redirect handler in lib/handler/redirect-handler.js already strips Authorization, Proxy-Authorization and Cookie headers when a redirect goes to a different origin. This is the upstream fix for CVE-2024-30260 (GHSA-3787-6prv-h9w3, upstream merge b9da3e40). It is part of the upstream v6.27.0 release that TuxCare onboarded, so it is an upstream fix and not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 Not affected. The redirect handler in lib/handler/redirect-handler.js already strips Authorization, Proxy-Authorization and Cookie headers when a redirect goes to a different origin. This is the upstream fix for CVE-2024-30260 (GHSA-3787-6prv-h9w3, upstream merge b9da3e40). It is part of the upstream v6.27.0 release that TuxCare onboarded, so it is an upstream fix and not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T23:39:52.749609+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 6.27.0 of undici. not_affected \u2014 Target undici 6.27.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd, shipped in 6.11.1). The fix is part of the upstream release, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Target undici 6.27.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd, shipped in 6.11.1). The fix is part of the upstream release, so the target is not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 6.27.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T21:31:00.047911+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 already contains the upstream fix for CVE-2025-22150. The multipart/form-data boundary in lib/web/fetch/body.js uses crypto.randomInt() rather than Math.random(). The fix commit c3acc605 (Matteo Collina, \"Use crypto.randomInt()\", Jan 2025) is an ancestor of HEAD. HEAD's history has no TuxCare commit, so this is a plain upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 undici 6.27.0 already contains the upstream fix for CVE-2025-22150. The multipart/form-data boundary in lib/web/fetch/body.js uses crypto.randomInt() rather than Math.random(). The fix commit c3acc605 (Matteo Collina, \"Use crypto.randomInt()\", Jan 2025) is an ancestor of HEAD. HEAD's history has no TuxCare commit, so this is a plain upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T21:39:45.101508+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit 133387138c91). Pool registers a 'connectionError' listener that removes the failed client from the pool's client list, so failed connections no longer accumulate. The fix is an ancestor of HEAD and shipped in the upstream release. No TuxCare-domain commit exists in HEAD's history.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 undici 6.27.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit 133387138c91). Pool registers a 'connectionError' listener that removes the failed client from the pool's client list, so failed connections no longer accumulate. The fix is an ancestor of HEAD and shipped in the upstream release. No TuxCare-domain commit exists in HEAD's history." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 6.27.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T21:14:00.047255+00:00", "status_notes": "Vulnerability CVE-2026-109829 does not affect version 6.27.0 of undici. not_affected \u2014 Target is undici 6.27.0. The HTTP cache interceptor and the MemoryCacheStore/SqliteCacheStore were introduced in undici 7.0.0 and do not exist in this tree. The CVE needs compose(redirect(), cache()) with a shared cache store, so the vulnerable component is absent. The redirect interceptor is present but has no cache to poison.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109829" }, "impact_statement": "not_affected \u2014 Target is undici 6.27.0. The HTTP cache interceptor and the MemoryCacheStore/SqliteCacheStore were introduced in undici 7.0.0 and do not exist in this tree. The CVE needs compose(redirect(), cache()) with a shared cache store, so the vulnerable component is absent. The redirect interceptor is present but has no cache to poison." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T21:17:00.039866+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 is not affected. The regression in CVE-2026-109841 was introduced in 7.15.0 and does not exist in this branch. parseMetadata() in lib/web/fetch/util.js matches the algorithm token case-insensitively and lowercases it (line 658) before checking it against supportedHashes (line 662). A token such as SHA256-... is therefore recognized and verified rather than skipped, and a non-match...", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 undici 6.27.0 is not affected. The regression in CVE-2026-109841 was introduced in 7.15.0 and does not exist in this branch. parseMetadata() in lib/web/fetch/util.js matches the algorithm token case-insensitively and lowercases it (line 658) before checking it against supportedHashes (line 662). A token such as SHA256-... is therefore recognized and verified rather than skipped, and a non-match..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-14T02:59:44.828253+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 6.27.0 of undici. not_affected \u2014 Not affected. CVE-2026-109855 is a regression introduced in undici 8.11.0, where a WebSocket handshake over HTTP/2 that fails validation leaves a ClientHttp2Stream open with no error listener. This target is undici 6.27.0. Its WebSocket handshake goes through fetch as an HTTP/1.1 upgrade, and the H2 dispatcher rejects upgrade requests before it creates any stream. The orphaned-stream state the ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Not affected. CVE-2026-109855 is a regression introduced in undici 8.11.0, where a WebSocket handshake over HTTP/2 that fails validation leaves a ClientHttp2Stream open with no error listener. This target is undici 6.27.0. Its WebSocket handshake goes through fetch as an HTTP/1.1 upgrade, and the H2 dispatcher rejects upgrade requests before it creates any stream. The orphaned-stream state the ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-10-15T18:29:00.261196+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 6.27.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-10-15T18:34:00.250279+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 6.27.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-10-15T21:36:16.074202+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 6.27.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T20:00:10.152210+00:00", "status_notes": "Vulnerability CVE-2026-11525 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 is the upstream release that fixes CVE-2026-11525. lib/web/cookies/parse.js parses SameSite with exact, case-insensitive equality against none/strict/lax. The substring-match pattern is absent. The fix commit 25efa447 is upstream-authored and is an ancestor of HEAD. HEAD's history has no TuxCare commit, so the fix shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-11525" }, "impact_statement": "not_affected \u2014 undici 6.27.0 is the upstream release that fixes CVE-2026-11525. lib/web/cookies/parse.js parses SameSite with exact, case-insensitive equality against none/strict/lax. The substring-match pattern is absent. The fix commit 25efa447 is upstream-authored and is an ancestor of HEAD. HEAD's history has no TuxCare commit, so the fix shipped in the upstream release." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 6.27.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T21:26:00.042227+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 6.27.0 of undici. not_affected \u2014 Target is undici 6.27.0. The CVE affects only 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3, which ship the shared cache interceptor (interceptors.cache with a cache store) that generates If-None-Match/If-Modified-Since revalidation requests. This 6.x tree has no such interceptor or store, so the cross-origin 304 revalidation chain cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 Target is undici 6.27.0. The CVE affects only 7.0.0\u20137.30.1 and 8.0.0\u20138.12.3, which ship the shared cache interceptor (interceptors.cache with a cache store) that generates If-None-Match/If-Modified-Since revalidation requests. This 6.x tree has no such interceptor or store, so the cross-origin 304 revalidation chain cannot occur." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T21:22:00.453604+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 is not affected. CVE-2026-120222 concerns the HTTP cache interceptor in the 7.x and 8.x lines (7.0.0 to 7.30.1, 8.0.0 to 8.12.3). This 6.x tree has no cache interceptor, no cache store and no decompress interceptor, so there is no replay path where a throwing downstream handler could escape. The fix commits could not be fetched and no diff was supplied, so this rests on the CVE te...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 undici 6.27.0 is not affected. CVE-2026-120222 concerns the HTTP cache interceptor in the 7.x and 8.x lines (7.0.0 to 7.30.1, 8.0.0 to 8.12.3). This 6.x tree has no cache interceptor, no cache store and no decompress interceptor, so there is no replay path where a throwing downstream handler could escape. The fix commits could not be fetched and no diff was supplied, so this rests on the CVE te..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T21:23:30.480922+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 is not exploitable via CVE-2026-120415. lib/handler/redirect-handler.js cleanRequestHeaders does treat arrays as flat lists, which is the same flaw the patch fixes. But in 6.x an array of [name, value] tuples is not an accepted header input. Request construction (lib/core/request.js) rejects it before any redirect happens. The cache and deduplicate interceptors named in the CVE do...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 undici 6.27.0 is not exploitable via CVE-2026-120415. lib/handler/redirect-handler.js cleanRequestHeaders does treat arrays as flat lists, which is the same flaw the patch fixes. But in 6.x an array of [name, value] tuples is not an accepted header input. Request construction (lib/core/request.js) rejects it before any redirect happens. The cache and deduplicate interceptors named in the CVE do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T21:24:57.220250+00:00", "status_notes": "Vulnerability CVE-2026-120423 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 still splits SRI metadata on a single space (lib/web/fetch/util.js:637), but the token regex is unanchored, so a digest preceded or followed by a tab, newline or other whitespace is still recognized and enforced. I found no input that lets a mismatched body pass. The CVE's affected range is 7.15.0+, and this is 6.27.0.", "vulnerability": { "name": "CVE-2026-120423" }, "impact_statement": "not_affected \u2014 undici 6.27.0 still splits SRI metadata on a single space (lib/web/fetch/util.js:637), but the token regex is unanchored, so a digest preceded or followed by a tab, newline or other whitespace is still recognized and enforced. I found no input that lets a mismatched body pass. The CVE's affected range is 7.15.0+, and this is 6.27.0." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T21:20:59.401455+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 6.27.0 of undici. not_affected \u2014 Target is undici 6.27.0. CVE-2026-120474 needs the HTTP cache interceptor and cache store, which only exist in undici 7.x/8.x, to be combined with the redirect interceptor. Neither exists in this v6 tree, so the vulnerable chain is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 Target is undici 6.27.0. CVE-2026-120474 needs the HTTP cache interceptor and cache store, which only exist in undici 7.x/8.x, to be combined with the redirect interceptor. Neither exists in this v6 tree, so the vulnerable chain is absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T20:03:00.065439+00:00", "status_notes": "Vulnerability CVE-2026-12151 does not affect version 6.27.0 of undici. not_affected \u2014 The target (undici 6.27.0) already caps the number of fragments buffered per WebSocket message, so CVE-2026-12151 does not apply. The cap was added by upstream commit b7f252e7 (Matteo Collina). That commit is part of the upstream 6.27.0 release, which is the release TuxCare onboarded. It is not a TuxCare fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-12151" }, "impact_statement": "not_affected \u2014 The target (undici 6.27.0) already caps the number of fragments buffered per WebSocket message, so CVE-2026-12151 does not apply. The cap was added by upstream commit b7f252e7 (Matteo Collina). That commit is part of the upstream 6.27.0 release, which is the release TuxCare onboarded. It is not a TuxCare fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T20:09:00.046186+00:00", "status_notes": "Vulnerability CVE-2026-13697 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 has no cache interceptor, no lib/util/cache.js, and no Cache-Control parser. The patched code (shared-cache storage guard and qualified `private` directive parsing) does not exist in this version, so neither the disclosure nor the parser crash can occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-13697" }, "impact_statement": "not_affected \u2014 undici 6.27.0 has no cache interceptor, no lib/util/cache.js, and no Cache-Control parser. The patched code (shared-cache storage guard and qualified `private` directive parsing) does not exist in this version, so neither the disclosure nor the parser crash can occur." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T20:08:00.042663+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 has no HTTP cache interceptor, no shared-cache mode and no Cache-Control response-directive parser. Only the WHATWG Cache API (CacheStorage) exists, and it does not parse no-cache/private qualified directives. The vulnerable chain from CVE-2026-14643 does not exist in this version, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 undici 6.27.0 has no HTTP cache interceptor, no shared-cache mode and no Cache-Control response-directive parser. Only the WHATWG Cache API (CacheStorage) exists, and it does not parse no-cache/private qualified directives. The vulnerable chain from CVE-2026-14643 does not exist in this version, so the target is not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 6.27.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T21:52:00.070588+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 6.27.0 of undici. not_affected \u2014 Target undici 6.27.0 already contains the upstream fix for CVE-2026-1525. lib/core/request.js lower-cases every header name and rejects a second content-length or host header, so case-variant duplicates in array headers throw instead of reaching the wire. The fix is upstream commit 4e0179ae (Matteo Collina), part of the 6.27.0 release. HEAD has no TuxCare-domain commits, so this is an upstream ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 Target undici 6.27.0 already contains the upstream fix for CVE-2026-1525. lib/core/request.js lower-cases every header name and rejects a second content-length or host header, so case-variant duplicates in array headers throw instead of reaching the wire. The fix is upstream commit 4e0179ae (Matteo Collina), part of the 6.27.0 release. HEAD has no TuxCare-domain commits, so this is an upstream ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 6.27.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T22:11:00.043442+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 already contains the upstream fix for CVE-2026-1527. The Request constructor rejects any `upgrade` value containing CR, LF or other control characters, before the value reaches the serialization code in client-h1.js. The fix commit is upstream commit e43e8986 (Matteo Collina), which is an ancestor of HEAD. HEAD has no TuxCare commit, so the fix shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 undici 6.27.0 already contains the upstream fix for CVE-2026-1527. The Request constructor rejects any `upgrade` value containing CR, LF or other control characters, before the value reaches the serialization code in client-h1.js. The fix commit is upstream commit e43e8986 (Matteo Collina), which is an ancestor of HEAD. HEAD has no TuxCare commit, so the fix shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T22:02:00.042261+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 6.27.0 of undici. not_affected \u2014 The upstream fix for CVE-2026-1528 (nodejs/undici 5a97f0893, by Matteo Collina) is already in the target. The 64-bit payload-length branch of ByteParser in lib/web/websocket/receiver.js rejects any length with a non-zero upper 32 bits or a lower half above 2^31-1, and fails the connection cleanly. The commit is in the upstream v6.27.0 release (551138cb) that TuxCare onboarded, so this is an ups...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-1528 (nodejs/undici 5a97f0893, by Matteo Collina) is already in the target. The 64-bit payload-length branch of ByteParser in lib/web/websocket/receiver.js rejects any length with a non-zero upper 32 bits or a lower half above 2^31-1, and fails the connection cleanly. The commit is in the upstream v6.27.0 release (551138cb) that TuxCare onboarded, so this is an ups..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 6.27.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 6.27.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-05T09:05:18.396710+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 6.27.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-09-29T18:46:58.638266+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 6.27.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-09-29T18:46:58.638266+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 6.27.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T21:47:00.051716+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 6.27.0 of undici. not_affected \u2014 Target undici 6.27.0 already contains the upstream fix for CVE-2026-22036. The fetch() response path rejects any response whose Content-Encoding lists more than 5 codings, before any decoder is created. The fix commit d3aafea7 is authored by upstream (Matteo Collina) and shipped in the upstream release (551138cb, v6.27.0). This version has no decompress interceptor, so the second affected surfa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 Target undici 6.27.0 already contains the upstream fix for CVE-2026-22036. The fetch() response path rejects any response whose Content-Encoding lists more than 5 codings, before any decoder is created. The fix commit d3aafea7 is authored by upstream (Matteo Collina) and shipped in the upstream release (551138cb, v6.27.0). This version has no decompress interceptor, so the second affected surfa..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 6.27.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-14T01:40:03.504280+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 6.27.0 of undici. not_affected \u2014 Undici 6.27.0 has no deduplicate interceptor, so the vulnerable component is absent. The CVE is about buffering response bodies in interceptors.deduplicate(). That interceptor only exists in newer undici lines and is not in HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 Undici 6.27.0 has no deduplicate interceptor, so the vulnerable component is absent. The CVE is about buffering response bodies in interceptors.deduplicate(). That interceptor only exists in newer undici lines and is not in HEAD." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T19:58:35.243229+00:00", "status_notes": "Vulnerability CVE-2026-6733 does not affect version 6.27.0 of undici. not_affected \u2014 Target is undici 6.27.0, the release the advisory names as patched for CVE-2026-6733. The upstream fix (f4c31d60, \"guard idle socket validation to skip fresh sockets\", by Matteo Collina) is present in lib/dispatcher/client-h1.js. It was shipped in the upstream release, not added by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6733" }, "impact_statement": "not_affected \u2014 Target is undici 6.27.0, the release the advisory names as patched for CVE-2026-6733. The upstream fix (f4c31d60, \"guard idle socket validation to skip fresh sockets\", by Matteo Collina) is present in lib/dispatcher/client-h1.js. It was shipped in the upstream release, not added by TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T20:09:39.760132+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 6.27.0 of undici. not_affected \u2014 Target is undici 6.27.0. The CVE concerns Socks5ProxyAgent, which was added in undici 7.23.0 (PR #4385), and no SOCKS code exists anywhere in this tree. The flawed pool reuse across origins cannot occur here, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Target is undici 6.27.0. The CVE concerns Socks5ProxyAgent, which was added in undici 7.23.0 (PR #4385), and no SOCKS code exists anywhere in this tree. The flawed pool reuse across origins cannot occur here, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T20:49:07.060769+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 has no decompress interceptor. The CVE and its patch (adding maxSize to interceptors.decompress()) concern that interceptor only. lib/interceptor contains only dns, dump, redirect, retry and response-error. index.js exports interceptors redirect, retry, dump and dns, with no decompress. The same product lineage applies, so this is not a false positive. The vulnerable code is not p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 undici 6.27.0 has no decompress interceptor. The CVE and its patch (adding maxSize to interceptors.decompress()) concern that interceptor only. lib/interceptor contains only dns, dump, redirect, retry and response-error. index.js exports interceptors redirect, retry, dump and dns, with no decompress. The same product lineage applies, so this is not a false positive. The vulnerable code is not p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T20:43:37.800265+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 does not contain the HTTP caching interceptor (interceptors.cache, CacheHandler, cache stores) that CVE-2026-84933 concerns. The interceptors export only has redirect, retry, dump and dns. No shared-cache code stores or replays Set-Cookie, so the vulnerable chain does not exist in this tree.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 undici 6.27.0 does not contain the HTTP caching interceptor (interceptors.cache, CacheHandler, cache stores) that CVE-2026-84933 concerns. The interceptors export only has redirect, retry, dump and dns. No shared-cache code stores or replays Set-Cookie, so the vulnerable chain does not exist in this tree." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 6.27.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T20:37:00.086722+00:00", "status_notes": "Vulnerability CVE-2026-84961 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 BalancedPool does not JSON-clone its constructor options. It keeps them in a plain object and hands each upstream Pool a shallow copy via Object.assign, so function-valued connect/tls options (checkServerIdentity, custom connectors) reach the Pool intact. The Pool then builds the connector from them. The CVE's lossy-clone step is absent from this version, so the target is not affe...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-84961" }, "impact_statement": "not_affected \u2014 undici 6.27.0 BalancedPool does not JSON-clone its constructor options. It keeps them in a plain object and hands each upstream Pool a shallow copy via Object.assign, so function-valued connect/tls options (checkServerIdentity, custom connectors) reach the Pool intact. The Pool then builds the connector from them. The CVE's lossy-clone step is absent from this version, so the target is not affe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T20:30:18.013446+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 has no HTTP cache interceptor (`interceptors.cache()`), no cache store, and no `canCacheResponse`. The flaw lives in that 7.x-era component, so the target is not affected. The same repo's 7.24.8 branch carries a TuxCare patch for this CVE, which confirms the component exists only on 7.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 undici 6.27.0 has no HTTP cache interceptor (`interceptors.cache()`), no cache store, and no `canCacheResponse`. The flaw lives in that 7.x-era component, so the target is not affected. The same repo's 7.24.8 branch carries a TuxCare patch for this CVE, which confirms the component exists only on 7.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T20:19:00.066324+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 6.27.0 of undici. not_affected \u2014 Target is undici 6.27.0. The vulnerable component, the WebSocketStream API, was introduced in undici 7.0.0 and does not exist in this v6 tree. The only WebSocket export is the classic WebSocket class, which has no writable-stream abort path. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 Target is undici 6.27.0. The vulnerable component, the WebSocketStream API, was introduced in undici 7.0.0 and does not exist in this v6 tree. The only WebSocket export is the classic WebSocket class, which has no writable-stream abort path. Not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-10-15T12:23:19.034848+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 6.27.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-14T02:34:53.666741+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 6.27.0 of undici. not_affected \u2014 Target is undici 6.27.0. The CVE affects only undici 8.10.0 and 8.10.1, where interceptors.cache() and interceptors.deduplicate() build keys without the destination origin. This tree has neither interceptor. index.js exports only redirect, retry, dump and dns, and lib/interceptor has no cache or deduplicate files. The vulnerable code is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 6.27.0. The CVE affects only undici 8.10.0 and 8.10.1, where interceptors.cache() and interceptors.deduplicate() build keys without the destination origin. This tree has neither interceptor. index.js exports only redirect, retry, dump and dns, and lib/interceptor has no cache or deduplicate files. The vulnerable code is absent." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 6.27.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 6.27.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T21:20:05.659204+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 has no `decompress` interceptor. The CVE (fixed in 7.30.1 / 8.12.2) concerns that interceptor calling a downstream handler from zlib callbacks without a try/catch. The v6 `interceptors` export has only redirect, retry, dump and dns. The only zlib use on the HTTP response path is in fetch, where decoder output goes into a Readable stream and not into a handler that can throw from a...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 undici 6.27.0 has no `decompress` interceptor. The CVE (fixed in 7.30.1 / 8.12.2) concerns that interceptor calling a downstream handler from zlib callbacks without a try/catch. The v6 `interceptors` export has only redirect, retry, dump and dns. The only zlib use on the HTTP response path is in fetch, where decoder output goes into a Readable stream and not into a handler that can throw from a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-14T02:06:45.296491+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 6.27.0 of undici. not_affected \u2014 Not affected. undici 6.27.0 already enforces the cumulative fragmented-message size limit in lib/web/websocket/receiver.js. That check shipped upstream with the maxPayloadSize feature in v6.25.0 (commit d7a1e55f, author hello@matteocollina.com). The CVE says the same: the 6.25.0 line is unaffected and the regression is specific to 8.1.0.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 Not affected. undici 6.27.0 already enforces the cumulative fragmented-message size limit in lib/web/websocket/receiver.js. That check shipped upstream with the maxPayloadSize feature in v6.25.0 (commit d7a1e55f, author hello@matteocollina.com). The CVE says the same: the 6.25.0 line is unaffected and the regression is specific to 8.1.0." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T20:11:00.069805+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 6.27.0 of undici. not_affected \u2014 undici 6.27.0 has no HTTP cache interceptor, no shared-cache mode and no response Cache-Control directive parser. CVE-2026-9678 lives in that code, which was added in undici 7.x, so this version does not contain the vulnerable code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 undici 6.27.0 has no HTTP cache interceptor, no shared-cache mode and no response Cache-Control directive parser. CVE-2026-9678 lives in that code, which was added in undici 7.x, so this version does not contain the vulnerable code." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T20:02:00.043521+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 6.27.0 of undici. not_affected \u2014 Target (undici 6.27.0) has no percent-decoding of cookie values. parseSetCookie in lib/web/cookies/parse.js returns the trimmed raw value, and nothing in lib/web/cookies/ calls qsUnescape, decodeURIComponent or unescape. The fix (cherry-pick 25efa447 of 5655ea43, author Matteo Collina) is in the upstream v6.27.0 release commit 551138cb, so this is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 Target (undici 6.27.0) has no percent-decoding of cookie values. parseSetCookie in lib/web/cookies/parse.js returns the trimmed raw value, and nothing in lib/web/cookies/ calls qsUnescape, decodeURIComponent or unescape. The fix (cherry-pick 25efa447 of 5655ea43, author Matteo Collina) is in the upstream v6.27.0 release commit 551138cb, so this is an upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.27.0", "identifiers": { "purl": "pkg:npm/undici@6.27.0" } } ], "timestamp": "2026-11-13T20:14:00.045604+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 6.27.0 of undici. not_affected \u2014 Target is undici 6.27.0. SOCKS5 support (Socks5ProxyAgent and the socks5:// branch of ProxyAgent) was added in 7.23.0 and does not exist in this tree. The ProxyAgent in this tree handles only HTTP(S) proxies, and its CONNECT path passes requestTls to the origin TLS connector, so the flaw is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 Target is undici 6.27.0. SOCKS5 support (Socks5ProxyAgent and the socks5:// branch of ProxyAgent) was added in 7.23.0 and does not exist in this tree. The ProxyAgent in this tree handles only HTTP(S) proxies, and its CONNECT path passes requestTls to the origin TLS connector, so the flaw is not present." } ] }