{ "@id": "urn:uuid:4654cd16-2330-4f5e-8eaf-3036fc73b318", "role": "Document Creator", "author": "https://tuxcare.com", "version": 56, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:49:00.032663+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 6.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 6.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 6.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 6.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 6.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 6.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 6.28.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-13T23:59:00.074519+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 6.28.0 of undici. not_affected \u2014 Target undici 6.28.0-tuxcare.6 already strips the cookie header on cross-origin redirects in the fetch redirect path. The fix is the upstream commit e041de35 (GHSA-wqq4-5wpv-mx2g), which is part of the upstream release TuxCare onboarded, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Target undici 6.28.0-tuxcare.6 already strips the cookie header on cross-origin redirects in the fetch redirect path. The fix is the upstream commit e041de35 (GHSA-wqq4-5wpv-mx2g), which is part of the upstream release TuxCare onboarded, so the target is not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 6.28.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-13T22:18:45.848472+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 6.28.0 of undici. not_affected \u2014 undici 6.28.0 already clears Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler path. The fix (GHSA-3787-6prv-h9w3, released in 6.6.1) is upstream-authored and is part of the upstream 6.28.0 release that TuxCare onboarded. The vulnerable pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 undici 6.28.0 already clears Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler path. The fix (GHSA-3787-6prv-h9w3, released in 6.6.1) is upstream-authored and is part of the upstream 6.28.0 release that TuxCare onboarded. The vulnerable pattern is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-14T00:24:00.146823+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 6.28.0 of undici. not_affected \u2014 Target undici 6.28.0 already contains the upstream fix for CVE-2024-30260. The redirect handler (lib/handler/redirect-handler.js) strips authorization, proxy-authorization and cookie headers when a redirect changes origin, and this applies to undici.request() as well as fetch(). The fix shipped in the upstream release that TuxCare onboarded, so the verdict is not_affected, not already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 Target undici 6.28.0 already contains the upstream fix for CVE-2024-30260. The redirect handler (lib/handler/redirect-handler.js) strips authorization, proxy-authorization and cookie headers when a redirect changes origin, and this applies to undici.request() as well as fetch(). The fix shipped in the upstream release that TuxCare onboarded, so the verdict is not_affected, not already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-13T23:33:00.074877+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 6.28.0 of undici. not_affected \u2014 The upstream fix for CVE-2024-30261 (d542b8cd, Matteo Collina, GHSA-9qxr-qj54-h672) is an ancestor of HEAD and was already in the upstream release TuxCare onboarded. bytesMatch in lib/web/fetch/util.js now compares digests with compareBase64Mixed, which requires equal length and exact characters. The target is not vulnerable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2024-30261 (d542b8cd, Matteo Collina, GHSA-9qxr-qj54-h672) is an ancestor of HEAD and was already in the upstream release TuxCare onboarded. bytesMatch in lib/web/fetch/util.js now compares digests with compareBase64Mixed, which requires equal length and exact characters. The target is not vulnerable." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 6.28.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T10:54:10.593628+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 6.28.0 of undici. not_affected \u2014 Not affected. The multipart boundary in lib/web/fetch/body.js is generated with crypto.randomInt(0, 1e11) via node:crypto. This is the upstream fix for CVE-2025-22150, commit c3acc605 by Matteo Collina. That commit is in the upstream release TuxCare onboarded, before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 Not affected. The multipart boundary in lib/web/fetch/body.js is generated with crypto.randomInt(0, 1e11) via node:crypto. This is the upstream fix for CVE-2025-22150, commit c3acc605 by Matteo Collina. That commit is in the upstream release TuxCare onboarded, before the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T11:02:55.739585+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 6.28.0 of undici. not_affected \u2014 The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit 13338713) is already in the 6.28.0 release this branch started from. The Pool removes clients from its list when a connection error such as an invalid certificate occurs, so failed clients are not retained and cannot leak. The fix author and committer are both hello@matteocollina.com, which is not a TuxCare identity.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit 13338713) is already in the 6.28.0 release this branch started from. The Pool removes clients from its list when a connection error such as an invalid certificate occurs, so failed clients are not retained and cannot leak. The fix author and committer are both hello@matteocollina.com, which is not a TuxCare identity." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:06:00.064776+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 6.28.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T13:30:25.835538+00:00", "status_notes": "Vulnerability CVE-2026-109841 does not affect version 6.28.0 of undici. not_affected \u2014 Target undici 6.28.0 uses the older pre-refactor SRI code in lib/web/fetch/util.js. parseMetadata matches the algorithm token with a case-insensitive regex and lowercases it before the supported-hash check. Uppercase or mixed-case tokens such as SHA256-... are therefore recognized and verified, not skipped. The regression described in the CVE (introduced in 7.15.0, in lib/web/subresource-integr...", "vulnerability": { "name": "CVE-2026-109841" }, "impact_statement": "not_affected \u2014 Target undici 6.28.0 uses the older pre-refactor SRI code in lib/web/fetch/util.js. parseMetadata matches the algorithm token with a case-insensitive regex and lowercases it before the supported-hash check. Uppercase or mixed-case tokens such as SHA256-... are therefore recognized and verified, not skipped. The regression described in the CVE (introduced in 7.15.0, in lib/web/subresource-integr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-14T02:49:00.032663+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 6.28.0 of undici. not_affected \u2014 Target is undici 6.28.0-tuxcare.6. The CVE is a regression introduced in 8.11.0, when WebSocket-over-HTTP/2 was added. This tree has no HTTP/2 upgrade path: writeH2 rejects any upgrade request, and allowH2 defaults to false. A malicious HTTP/2 response to a WebSocket upgrade can therefore never reach the orphaned-stream crash.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 6.28.0-tuxcare.6. The CVE is a regression introduced in 8.11.0, when WebSocket-over-HTTP/2 was added. This tree has no HTTP/2 upgrade path: writeH2 rejects any upgrade request, and allowH2 defaults to false. A malicious HTTP/2 response to a WebSocket upgrade can therefore never reach the orphaned-stream crash." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-04T17:20:00.050281+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.5.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-10-27T18:30:22.484599+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T11:48:00.024884+00:00", "status_notes": "Vulnerability CVE-2026-11525 does not affect version 6.28.0 of undici. not_affected \u2014 Not affected. The SameSite parser in lib/web/cookies/parse.js already uses exact, case-insensitive equality against none, strict and lax. Non-spec values such as NoneOfYourBusiness or StrictLax are ignored. The fix is upstream commit 25efa447 by Matteo Collina. It is part of the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-11525" }, "impact_statement": "not_affected \u2014 Not affected. The SameSite parser in lib/web/cookies/parse.js already uses exact, case-insensitive equality against none, strict and lax. Non-spec values such as NoneOfYourBusiness or StrictLax are ignored. The fix is upstream commit 25efa447 by Matteo Collina. It is part of the upstream release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 6.28.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T10:32:00.039627+00:00", "status_notes": "Vulnerability CVE-2026-116630 does not affect version 6.28.0 of undici. not_affected \u2014 Target is undici 6.28.0-tuxcare.5. The CVE only affects 7.x and 8.x, which ship the shared HTTP cache interceptor with conditional revalidation. This 6.x tree has no such interceptor, so the cross-origin 304 revalidation chain cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116630" }, "impact_statement": "not_affected \u2014 Target is undici 6.28.0-tuxcare.5. The CVE only affects 7.x and 8.x, which ship the shared HTTP cache interceptor with conditional revalidation. This 6.x tree has no such interceptor, so the cross-origin 304 revalidation chain cannot occur." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T10:16:59.893945+00:00", "status_notes": "Vulnerability CVE-2026-120222 does not affect version 6.28.0 of undici. not_affected \u2014 Target is undici 6.28.0-tuxcare.5. The vulnerable component, the HTTP cache interceptor that replays cached responses (7.x/8.x only), does not exist in this tree. The decompress interceptor is also absent. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120222" }, "impact_statement": "not_affected \u2014 Target is undici 6.28.0-tuxcare.5. The vulnerable component, the HTTP cache interceptor that replays cached responses (7.x/8.x only), does not exist in this tree. The decompress interceptor is also absent. Not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T10:17:31.948615+00:00", "status_notes": "Vulnerability CVE-2026-120415 does not affect version 6.28.0 of undici. not_affected \u2014 undici 6.28.0-tuxcare.5 is not affected. cleanRequestHeaders in the redirect handler does read headers as a flat list, but the tuple-array input is rejected by Request (core/request.js) before any request is sent. This tree also has no cache or deduplicate interceptor to serialize retained headers. The CVE lists only 7.x and 8.x as affected, and the fix commits for this CVE are not in HEAD.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-120415" }, "impact_statement": "not_affected \u2014 undici 6.28.0-tuxcare.5 is not affected. cleanRequestHeaders in the redirect handler does read headers as a flat list, but the tuple-array input is rejected by Request (core/request.js) before any request is sent. This tree also has no cache or deduplicate interceptor to serialize retained headers. The CVE lists only 7.x and 8.x as affected, and the fix commits for this CVE are not in HEAD." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T10:18:00.081064+00:00", "status_notes": "Vulnerability CVE-2026-120423 does not affect version 6.28.0 of undici. not_affected \u2014 Target undici 6.28.0-tuxcare.5 uses the same metadata.split(' ') as the affected 7.x/8.x code. Its token regex is unanchored, though, so a token with leading or trailing tab/newline whitespace still parses to a recognized sha256/384/512 entry. The mismatched body is therefore rejected, not accepted. Tested: bytesMatch(evil, \"\\tsha256-\") returns false.", "vulnerability": { "name": "CVE-2026-120423" }, "impact_statement": "not_affected \u2014 Target undici 6.28.0-tuxcare.5 uses the same metadata.split(' ') as the affected 7.x/8.x code. Its token regex is unanchored, though, so a token with leading or trailing tab/newline whitespace still parses to a recognized sha256/384/512 entry. The mismatched body is therefore rejected, not accepted. Tested: bytesMatch(evil, \"\\tsha256-\") returns false." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T10:14:52.132940+00:00", "status_notes": "Vulnerability CVE-2026-120474 does not affect version 6.28.0 of undici. not_affected \u2014 Target is undici 6.28.0-tuxcare.5. The vulnerable component, the HTTP cache interceptor with shared cache stores (introduced in undici 7.x), does not exist in this tree. The redirect interceptor is present, but there is no shared response cache to poison, so cross-user disclosure via a mis-keyed cache entry cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-120474" }, "impact_statement": "not_affected \u2014 Target is undici 6.28.0-tuxcare.5. The vulnerable component, the HTTP cache interceptor with shared cache stores (introduced in undici 7.x), does not exist in this tree. The redirect interceptor is present, but there is no shared response cache to poison, so cross-user disclosure via a mis-keyed cache entry cannot occur." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-04T03:43:37.320617+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 6.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 6.28.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T12:14:00.044444+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 6.28.0 of undici. not_affected \u2014 Target is undici 6.28.0-tuxcare.5. It has no HTTP cache interceptor (interceptors.cache()), no shared-cache store and no Cache-Control directive parser. The CVE-2026-14643 flaw (OWS around '=' in qualified no-cache/private directives) lives in a component that does not exist in this version. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 Target is undici 6.28.0-tuxcare.5. It has no HTTP cache interceptor (interceptors.cache()), no shared-cache store and no Cache-Control directive parser. The CVE-2026-14643 flaw (OWS around '=' in qualified no-cache/private directives) lives in a component that does not exist in this version. Not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T12:09:00.049774+00:00", "status_notes": "Vulnerability CVE-2026-15157 does not affect version 6.28.0 of undici. not_affected \u2014 Target undici 6.28.0-tuxcare.5 already contains the upstream fix. The blob-like body branch in lib/dispatcher/client-h1.js (lines 997-1007) stringifies body.type, checks it with util.isValidHeaderValue(), and rejects the request with InvalidArgumentError if it is invalid, before pushing it to headers. The fix is upstream commit 740a0b7c (\"fix: validate blob body content type\", Matteo Collina). ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-15157" }, "impact_statement": "not_affected \u2014 Target undici 6.28.0-tuxcare.5 already contains the upstream fix. The blob-like body branch in lib/dispatcher/client-h1.js (lines 997-1007) stringifies body.type, checks it with util.isValidHeaderValue(), and rejects the request with InvalidArgumentError if it is invalid, before pushing it to headers. The fix is upstream commit 740a0b7c (\"fix: validate blob body content type\", Matteo Collina). ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T11:14:00.035776+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 6.28.0 of undici. not_affected \u2014 The target already contains the upstream fix for CVE-2026-1525. processHeader in lib/core/request.js lowercases the header name and throws 'duplicate content-length header' if a content-length was already seen. The fix commit 4e0179ae is upstream (author Matteo Collina). It is an ancestor of HEAD and predates the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 The target already contains the upstream fix for CVE-2026-1525. processHeader in lib/core/request.js lowercases the header name and throws 'duplicate content-length header' if a content-length was already seen. The fix commit 4e0179ae is upstream (author Matteo Collina). It is an ancestor of HEAD and predates the first TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 6.28.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T11:17:00.102202+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 6.28.0 of undici. not_affected \u2014 Not affected. The upstream fix (e43e8986, \"validate upgrade header to prevent CRLF injection\", by Matteo Collina) is already in the 6.28.0 base release. Request's constructor in lib/core/request.js rejects any `upgrade` value containing CR/LF or other invalid header characters, before the value reaches the serialization in client-h1.js.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix (e43e8986, \"validate upgrade header to prevent CRLF injection\", by Matteo Collina) is already in the 6.28.0 base release. Request's constructor in lib/core/request.js rejects any `upgrade` value containing CR/LF or other invalid header characters, before the value reaches the serialization in client-h1.js." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-13T21:59:00.039965+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 6.28.0 of undici. not_affected \u2014 The target (undici 6.28.0) already contains the upstream fix for CVE-2026-1528. In lib/web/websocket/receiver.js, the PAYLOADLENGTH_64 state rejects any 64-bit length with a non-zero upper word or a lower word above 2^31-1. It fails the connection before the value is used. The fix commit 5a97f089 (\"Fix websocket 64-bit length overflow\", Matteo Collina) is an ancestor of HEAD and of the first Tu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 The target (undici 6.28.0) already contains the upstream fix for CVE-2026-1528. In lib/web/websocket/receiver.js, the PAYLOADLENGTH_64 state rejects any 64-bit length with a non-zero upper word or a lower word above 2^31-1. It fails the connection before the value is used. The fix commit 5a97f089 (\"Fix websocket 64-bit length overflow\", Matteo Collina) is an ancestor of HEAD and of the first Tu..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T12:02:00.043216+00:00", "status_notes": "Vulnerability CVE-2026-16728 does not affect version 6.28.0 of undici. not_affected \u2014 The upstream fix (cba3a52, \"reject partial content length mismatch\") is already in the target's retry handler. It shipped in the upstream 6.28.0 release that TuxCare onboarded, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16728" }, "impact_statement": "not_affected \u2014 The upstream fix (cba3a52, \"reject partial content length mismatch\") is already in the target's retry handler. It shipped in the upstream 6.28.0 release that TuxCare onboarded, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T12:12:00.052723+00:00", "status_notes": "Vulnerability CVE-2026-16729 does not affect version 6.28.0 of undici. not_affected \u2014 The target (undici 6.28.0-tuxcare.5) already contains the upstream fix af748404 (\"fix: harden cookie domain, path, and unparsed attribute validation\"). That fix shipped in the upstream 6.28.0 release, before the first TuxCare commit. validateCookieDomain is a strict RFC 1034 letter-digit-hyphen validator that rejects ';'. Each unparsed entry's key and value go through validateCookieName and val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16729" }, "impact_statement": "not_affected \u2014 The target (undici 6.28.0-tuxcare.5) already contains the upstream fix af748404 (\"fix: harden cookie domain, path, and unparsed attribute validation\"). That fix shipped in the upstream 6.28.0 release, before the first TuxCare commit. validateCookieDomain is a strict RFC 1034 letter-digit-hyphen validator that rejects ';'. Each unparsed entry's key and value go through validateCookieName and val..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:05:18.396710+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 6.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-10-13T11:11:00.104521+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-10-01T11:11:44.028700+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T11:11:00.038105+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 6.28.0 of undici. not_affected \u2014 Target undici 6.28.0 already includes the upstream fix for CVE-2026-22036. fetch() rejects responses with more than 5 Content-Encoding values before building decoders. The fix shipped in the upstream release that TuxCare onboarded, so this is an upstream fix. No decompress interceptor exists in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 Target undici 6.28.0 already includes the upstream fix for CVE-2026-22036. fetch() rejects responses with more than 5 Content-Encoding values before building decoders. The fix shipped in the upstream release that TuxCare onboarded, so this is an upstream fix. No decompress interceptor exists in this version." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 6.28.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-14T01:25:13.546710+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 6.28.0 of undici. not_affected \u2014 The target is undici 6.28.0-tuxcare.6. CVE-2026-2581 concerns the interceptors.deduplicate() interceptor, which buffers response bodies for deduplicated requests. That interceptor does not exist in this tree: no deduplication code is present, and it is not exported from index.js. The vulnerable code path is therefore absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 The target is undici 6.28.0-tuxcare.6. CVE-2026-2581 concerns the interceptors.deduplicate() interceptor, which buffers response bodies for deduplicated requests. That interceptor does not exist in this tree: no deduplication code is present, and it is not exported from index.js. The vulnerable code path is therefore absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T11:55:00.123511+00:00", "status_notes": "Vulnerability CVE-2026-6733 does not affect version 6.28.0 of undici. not_affected \u2014 undici 6.28.0-tuxcare.5 already contains the upstream CVE-2026-6733 fix (nodejs/undici f4c31d60, GHSA-35p6-xmwp-9g52). The parser now destroys the socket when response bytes arrive with no request in flight, and a reused idle socket is checked for unsolicited data before the next request is dispatched. The fix is part of the upstream release that TuxCare onboarded, so it is an upstream fix and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6733" }, "impact_statement": "not_affected \u2014 undici 6.28.0-tuxcare.5 already contains the upstream CVE-2026-6733 fix (nodejs/undici f4c31d60, GHSA-35p6-xmwp-9g52). The parser now destroys the socket when response bytes arrive with no request in flight, and a reused idle socket is checked for unsolicited data before the next request is dispatched. The fix is part of the upstream release that TuxCare onboarded, so it is an upstream fix and ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-6734 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2026-6734" }, "action_statement": "Vulnerability CVE-2026-6734 affects version 6.28.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T13:05:00.204353+00:00", "status_notes": "Vulnerability CVE-2026-84890 does not affect version 6.28.0 of undici. not_affected \u2014 undici 6.28.0-tuxcare.5 has no `interceptors.decompress()` interceptor. That interceptor is the only component CVE-2026-84890 and its patch concern, and it was added in the 7.x line. The 6.x `interceptors` export has only redirect, retry, dump and dns. The target is therefore not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84890" }, "impact_statement": "not_affected \u2014 undici 6.28.0-tuxcare.5 has no `interceptors.decompress()` interceptor. That interceptor is the only component CVE-2026-84890 and its patch concern, and it was added in the 7.x line. The 6.x `interceptors` export has only redirect, retry, dump and dns. The target is therefore not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T13:02:00.039785+00:00", "status_notes": "Vulnerability CVE-2026-84933 does not affect version 6.28.0 of undici. not_affected \u2014 undici 6.28.0-tuxcare.5 has no HTTP cache interceptor at all. interceptors.cache(), the cache handler and the cache stores were added in the 7.x line. The tree exposes only the redirect, retry, dump and dns interceptors. The only caching code is the WHATWG Cache API (caches / CacheStorage), a separate component that the CVE and patch do not concern. The component with the flaw, a shared HTTP ca...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84933" }, "impact_statement": "not_affected \u2014 undici 6.28.0-tuxcare.5 has no HTTP cache interceptor at all. interceptors.cache(), the cache handler and the cache stores were added in the 7.x line. The tree exposes only the redirect, retry, dump and dns interceptors. The only caching code is the WHATWG Cache API (caches / CacheStorage), a separate component that the CVE and patch do not concern. The component with the flaw, a shared HTTP ca..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 6.28.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 6.28.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T12:58:00.042642+00:00", "status_notes": "Vulnerability CVE-2026-85008 does not affect version 6.28.0 of undici. not_affected \u2014 undici 6.28.0-tuxcare.5 has no HTTP cache interceptor. The `interceptors` export is only redirect, retry, dump and dns, so the flaw in CVE-2026-85008 (the cache interceptor skip-list and `canCacheResponse` not rejecting unsafe methods) cannot occur. The only cache code is the explicit Cache API (CacheStorage), which already rejects non-GET methods. The fetch implementation has no HTTP cache and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85008" }, "impact_statement": "not_affected \u2014 undici 6.28.0-tuxcare.5 has no HTTP cache interceptor. The `interceptors` export is only redirect, retry, dump and dns, so the flaw in CVE-2026-85008 (the cache interceptor skip-list and `canCacheResponse` not rejecting unsafe methods) cannot occur. The only cache code is the explicit Cache API (CacheStorage), which already rejects non-GET methods. The fetch implementation has no HTTP cache and..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T12:45:22.374815+00:00", "status_notes": "Vulnerability CVE-2026-85014 does not affect version 6.28.0 of undici. not_affected \u2014 Target is undici 6.28.0-tuxcare.5. The WebSocketStream API, where the flaw lives, was introduced in undici 7.0.0 and does not exist in this tree, so the bug cannot occur here. The target still has the classic WebSocket class, which has no writable-stream abort on socket close.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85014" }, "impact_statement": "not_affected \u2014 Target is undici 6.28.0-tuxcare.5. The WebSocketStream API, where the flaw lives, was introduced in undici 7.0.0 and does not exist in this tree, so the bug cannot occur here. The target still has the classic WebSocket class, which has no writable-stream abort on socket close." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-10-13T11:11:00.104521+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-14T02:23:50.619874+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 6.28.0 of undici. not_affected \u2014 Target is undici 6.28.0-tuxcare.6. The cache and deduplicate interceptors, which were introduced in undici 8.10.0, do not exist in this tree, so the origin-less key construction cannot occur. Only the redirect, retry, dump and dns interceptors are exported.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 6.28.0-tuxcare.6. The cache and deduplicate interceptors, which were introduced in undici 8.10.0, do not exist in this tree, so the origin-less key construction cannot occur. Only the redirect, retry, dump and dns interceptors are exported." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-09T13:38:22.715372+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.6.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 6.28.0 of undici, and is fixed in 6.28.0-tuxcare.6." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T13:31:00.032154+00:00", "status_notes": "Vulnerability CVE-2026-87029 does not affect version 6.28.0 of undici. not_affected \u2014 undici 6.28.0-tuxcare.5 has no `decompress` dispatcher interceptor. The shipped interceptors are redirect, retry, dump and dns, and no lib/interceptor/decompress.js exists. The CVE chain needs zlib stream callbacks that forward decompressed data to a downstream dispatch handler (for example `dump`) which throws asynchronously. That chain is absent here. The only response decompression is in fet...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-87029" }, "impact_statement": "not_affected \u2014 undici 6.28.0-tuxcare.5 has no `decompress` dispatcher interceptor. The shipped interceptors are redirect, retry, dump and dns, and no lib/interceptor/decompress.js exists. The CVE chain needs zlib stream callbacks that forward decompressed data to a downstream dispatch handler (for example `dump`) which throws asynchronously. That chain is absent here. The only response decompression is in fet..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-14T01:54:00.066706+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 6.28.0 of undici. not_affected \u2014 Not affected. The target (undici 6.28.0-tuxcare.6) already enforces a cumulative size limit across fragmented uncompressed WebSocket messages, matching what the CVE says the 6.25.0 line shipped. The cumulative check came from the upstream release (commit b7f252e7, upstream author), before any TuxCare commit, so this is an upstream-shipped fix. The 8.1.0 regression described in the CVE is not pr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 Not affected. The target (undici 6.28.0-tuxcare.6) already enforces a cumulative size limit across fragmented uncompressed WebSocket messages, matching what the CVE says the 6.25.0 line shipped. The cumulative check came from the upstream release (commit b7f252e7, upstream author), before any TuxCare commit, so this is an upstream-shipped fix. The 8.1.0 regression described in the CVE is not pr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T12:31:33.338681+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 6.28.0 of undici. not_affected \u2014 Target is undici 6.28.0-tuxcare.5. It has no HTTP cache interceptor, so the code that parses response Cache-Control private/no-cache qualified field names and stores responses does not exist here. CVE-2026-9678 affects undici's interceptors.cache() in v7/v8 only. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Target is undici 6.28.0-tuxcare.5. It has no HTTP cache interceptor, so the code that parses response Cache-Control private/no-cache qualified field names and stores responses does not exist here. CVE-2026-9678 affects undici's interceptors.cache() in v7/v8 only. Not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-06T11:48:00.024884+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 6.28.0 of undici. not_affected \u2014 Target is undici 6.28.0-tuxcare.5. Its cookie parser (lib/web/cookies/parse.js) never percent-decodes cookie values, so the CVE-2026-9679 flaw (qsUnescape in parseSetCookie, introduced in 7.0.0 via PR #3789) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 Target is undici 6.28.0-tuxcare.5. Its cookie parser (lib/web/cookies/parse.js) never percent-decodes cookie values, so the CVE-2026-9679 flaw (qsUnescape in parseSetCookie, introduced in 7.0.0 via PR #3789) is not present." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@6.28.0", "identifiers": { "purl": "pkg:npm/undici@6.28.0" } } ], "timestamp": "2026-11-05T09:04:00.091712+00:00", "status_notes": "Vulnerability CVE-2026-9697 affects version 6.28.0 of undici.", "vulnerability": { "name": "CVE-2026-9697" }, "action_statement": "Vulnerability CVE-2026-9697 affects version 6.28.0 of undici." } ] }