{ "@id": "urn:uuid:7a73a070-cdb4-4089-a845-3f8fc41850d1", "role": "Document Creator", "author": "https://tuxcare.com", "version": 35, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:59:19.400953+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 7.18.2 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-14T00:03:28.204349+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.18.2 of undici. not_affected \u2014 Not affected. undici 7.18.2 already contains the upstream fix for CVE-2023-45143 (commit e041de35, released in 5.26.2). On a cross-origin redirect, httpRedirectFetch deletes the cookie header along with authorization, proxy-authorization and host.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Not affected. undici 7.18.2 already contains the upstream fix for CVE-2023-45143 (commit e041de35, released in 5.26.2). On a cross-origin redirect, httpRedirectFetch deletes the cookie header along with authorization, proxy-authorization and host." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 7.18.2 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-13T22:21:40.164913+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.18.2 of undici. not_affected \u2014 Not affected. Both redirect-handling paths in undici 7.18.2 already strip Proxy-Authorization on cross-origin redirects. The upstream fix for GHSA-wqq4-5wpv-mx2g (commit 6805746) shipped in the upstream release before any TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Not affected. Both redirect-handling paths in undici 7.18.2 already strip Proxy-Authorization on cross-origin redirects. The upstream fix for GHSA-wqq4-5wpv-mx2g (commit 6805746) shipped in the upstream release before any TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-14T00:31:00.130291+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.18.2 of undici. not_affected \u2014 undici 7.18.2 already strips Authorization, Cookie and Proxy-Authorization on cross-origin redirects in the shared redirect handler. undici.request() with maxRedirections goes through this handler. The fix shipped in the upstream release and is authored by upstream, not TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 undici 7.18.2 already strips Authorization, Cookie and Proxy-Authorization on cross-origin redirects in the shared redirect handler. undici.request() with maxRedirections goes through this handler. The fix shipped in the upstream release and is authored by upstream, not TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-13T23:34:04.416729+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.18.2 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2024-30261 (d542b8cd, GHSA-9qxr-qj54-h672) is an ancestor of HEAD and shipped in the upstream undici release that TuxCare onboarded. Its author is Matteo Collina and its committer is GitHub. The integrity check in 7.18.2 has been rewritten into a spec-compliant module that does not contain the pre-fix flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2024-30261 (d542b8cd, GHSA-9qxr-qj54-h672) is an ancestor of HEAD and shipped in the upstream undici release that TuxCare onboarded. Its author is Matteo Collina and its committer is GitHub. The integrity check in 7.18.2 has been rewritten into a spec-compliant module that does not contain the pre-fix flaw." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 7.18.2 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-13T21:31:00.047911+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.18.2 of undici. not_affected \u2014 undici 7.18.2 already contains the upstream CVE-2025-22150 fix. The multipart boundary in lib/web/fetch/body.js is generated with node:crypto randomInt whenever crypto is available. Math.random is only a fallback for builds without crypto, the same as upstream. The fix is upstream commit c2d78cd1 (Matteo Collina), shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 undici 7.18.2 already contains the upstream CVE-2025-22150 fix. The multipart boundary in lib/web/fetch/body.js is generated with node:crypto randomInt whenever crypto is available. Math.random is only a fallback for builds without crypto, the same as upstream. The fix is upstream commit c2d78cd1 (Matteo Collina), shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-13T21:37:00.197268+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.18.2 of undici. not_affected \u2014 undici 7.18.2 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool now removes clients that hit a connectionError from its kClients list, so failed-TLS clients are not retained. The fix shipped in the upstream release, so this is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 undici 7.18.2 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool now removes clients that hit a connectionError from its kClients list, so failed-TLS clients are not retained. The fix shipped in the upstream release, so this is not_affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-10-15T18:47:21.529900+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 7.18.2 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-14T02:59:19.400953+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.18.2 of undici. not_affected \u2014 Target is undici 7.18.2. The CVE says the bug was introduced in 8.11.0 and affects 8.11.0/8.11.1. The H2 WebSocket stream in this target has a permanent 'error' listener, so a server-destroyed connection cannot produce an unhandled stream error that kills the process. The vendor patch diff was not available (URL only, no remote access), so this rests on the CVE text and the target code.", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 7.18.2. The CVE says the bug was introduced in 8.11.0 and affects 8.11.0/8.11.1. The H2 WebSocket stream in this target has a permanent 'error' listener, so a server-destroyed connection cannot produce an unhandled stream error that kills the process. The vendor patch diff was not available (URL only, no remote access), so this rests on the CVE text and the target code." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-10-15T18:29:00.261196+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-10-15T18:34:00.250279+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-06T10:20:26.750713+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-14643 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-14643" }, "action_statement": "Vulnerability CVE-2026-14643 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1525 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-1525" }, "action_statement": "Vulnerability CVE-2026-1525 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1527 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-1527" }, "action_statement": "Vulnerability CVE-2026-1527 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1528 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-1528" }, "action_statement": "Vulnerability CVE-2026-1528 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 7.18.2 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-13T21:44:00.039648+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.18.2 of undici. not_affected \u2014 Target undici 7.18.2 already contains the upstream fix. Both fetch() and the decompress interceptor reject a Content-Encoding chain longer than 5 entries before any decoder stream is built. The fix commit b04e3cbb is authored by Matteo Collina (upstream) and was part of the upstream 7.18.2 release before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 Target undici 7.18.2 already contains the upstream fix. Both fetch() and the decompress interceptor reject a Content-Encoding chain longer than 5 entries before any decoder stream is built. The fix commit b04e3cbb is authored by Matteo Collina (upstream) and was part of the upstream 7.18.2 release before the first TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2581 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-2581" }, "action_statement": "Vulnerability CVE-2026-2581 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 7.18.2 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-13T20:09:39.760132+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 7.18.2 of undici. not_affected \u2014 Target is undici 7.18.2. Socks5ProxyAgent was introduced in 7.23.0 (PR #4385), so it does not exist here. No SOCKS code is present anywhere in the tree at HEAD, so there is no code path for the cross-origin pool reuse flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Target is undici 7.18.2. Socks5ProxyAgent was introduced in 7.23.0 (PR #4385), so it does not exist here. No SOCKS code is present anywhere in the tree at HEAD, so there is no code path for the cross-origin pool reuse flaw." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 7.18.2 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-13T20:41:41.011558+00:00", "status_notes": "Vulnerability CVE-2026-84961 does not affect version 7.18.2 of undici. not_affected \u2014 undici 7.18.2 BalancedPool never JSON-clones its constructor options, so function-valued connect/tls options (checkServerIdentity, custom connector) reach each per-upstream Pool intact. The vulnerable pattern from CVE-2026-84961 is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84961" }, "impact_statement": "not_affected \u2014 undici 7.18.2 BalancedPool never JSON-clones its constructor options, so function-valued connect/tls options (checkServerIdentity, custom connector) reach each per-upstream Pool intact. The vulnerable pattern from CVE-2026-84961 is absent." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-29T18:27:17.765346+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 7.18.2 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-14T02:19:53.022319+00:00", "status_notes": "Vulnerability CVE-2026-85024 does not affect version 7.18.2 of undici. not_affected \u2014 undici 7.18.2 has no decompressed-size limit in lib/web/websocket/permessage-deflate.js and never calls removeAllListeners() on its InflateRaw stream. The permanent 'error' listener stays attached, so a malformed DEFLATE block cannot produce an unhandled 'error' event that kills the process. The vulnerable cleanup path is absent from this version.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-85024" }, "impact_statement": "not_affected \u2014 undici 7.18.2 has no decompressed-size limit in lib/web/websocket/permessage-deflate.js and never calls removeAllListeners() on its InflateRaw stream. The permanent 'error' listener stays attached, so a malformed DEFLATE block cannot produce an unhandled 'error' event that kills the process. The vulnerable cleanup path is absent from this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-14T02:34:25.371358+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.18.2 of undici. not_affected \u2014 Target is undici 7.18.2. The CVE affects only 8.10.0 and 8.10.1, where cache and dedup keys were built without the real destination origin. In this tree, both interceptors skip any request without opts.origin, and every key includes opts.origin. The origin-less key pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 7.18.2. The CVE affects only 8.10.0 and 8.10.1, where cache and dedup keys were built without the real destination origin. In this tree, both interceptors skip any request without opts.origin, and every key includes opts.origin. The origin-less key pattern is not present." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 7.18.2 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-14T01:58:18.621399+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 7.18.2 of undici. not_affected \u2014 Target is undici 7.18.2. CVE-2026-9675 is a regression in the maxPayloadSize feature introduced in undici 8.1.0, where per-frame limits were enforced but cumulative fragmented-message size was not. The maxPayloadSize option and its enforcement code do not exist anywhere in this 7.x tree, so the regression code is absent. The CVE itself states the 7.x line is unaffected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 Target is undici 7.18.2. CVE-2026-9675 is a regression in the maxPayloadSize feature introduced in undici 8.1.0, where per-frame limits were enforced but cumulative fragmented-message size was not. The maxPayloadSize option and its enforcement code do not exist anywhere in this 7.x tree, so the regression code is absent. The CVE itself states the 7.x line is unaffected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9678 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-9678" }, "action_statement": "Vulnerability CVE-2026-9678 affects version 7.18.2 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9679 affects version 7.18.2 of undici.", "vulnerability": { "name": "CVE-2026-9679" }, "action_statement": "Vulnerability CVE-2026-9679 affects version 7.18.2 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.18.2", "identifiers": { "purl": "pkg:npm/undici@7.18.2" } } ], "timestamp": "2026-11-13T20:14:58.005670+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 7.18.2 of undici. not_affected \u2014 undici 7.18.2 has no SOCKS5 support. The CVE says the bug was introduced in 7.23.0 together with Socks5ProxyAgent and the SOCKS5 branch of ProxyAgent. Neither exists here. The only ProxyAgent in this tree is the HTTP CONNECT one, and it honors requestTls on the tunneled TLS handshake. The fixed pattern is therefore not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 undici 7.18.2 has no SOCKS5 support. The CVE says the bug was introduced in 7.23.0 together with Socks5ProxyAgent and the SOCKS5 branch of ProxyAgent. Neither exists here. The only ProxyAgent in this tree is the HTTP CONNECT one, and it honors requestTls on the tunneled TLS handshake. The fixed pattern is therefore not present." } ] }