{
  "@id": "urn:uuid:33c9d43a-731d-4d5a-a38f-256f225b8b21",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T02:59:44.828253+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 7.19.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-14T00:05:01.866674+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.19.2 of undici. not_affected \u2014 Target is undici 7.19.2, which is well past the 5.26.2 fix. The upstream release already deletes the cookie header (plus authorization, proxy-authorization and host) on cross-origin redirects in fetch (lib/web/fetch/index.js:1312-1322). The non-fetch redirect handler strips cookie too (lib/handler/redirect-handler.js:208-211). The fix shipped in the upstream release, so this is not_affected wit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.19.2, which is well past the 5.26.2 fix. The upstream release already deletes the cookie header (plus authorization, proxy-authorization and host) on cross-origin redirects in fetch (lib/web/fetch/index.js:1312-1322). The non-fetch redirect handler strips cookie too (lib/handler/redirect-handler.js:208-211). The fix shipped in the upstream release, so this is not_affected wit..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "action_statement": "Vulnerability CVE-2024-24750 affects version 7.19.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:22:00.050269+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.19.2 of undici. not_affected \u2014 undici 7.19.2 already strips proxy-authorization on cross-origin redirects in both the fetch redirect path and the RedirectHandler. The fix is upstream-authored and shipped in the upstream release that TuxCare onboarded, so the target is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 undici 7.19.2 already strips proxy-authorization on cross-origin redirects in both the fetch redirect path and the RedirectHandler. The fix is upstream-authored and shipped in the upstream release that TuxCare onboarded, so the target is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-14T00:33:00.117062+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.19.2 of undici. not_affected \u2014 Target undici 7.19.2 already contains the upstream CVE-2024-30260 fix. The redirect handler strips authorization, proxy-authorization and cookie headers on cross-origin redirects, and it is used by the request/dispatch path. The fix commit 6805746 is an ancestor of HEAD and shipped in the upstream release, before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.19.2 already contains the upstream CVE-2024-30260 fix. The redirect handler strips authorization, proxy-authorization and cookie headers on cross-origin redirects, and it is used by the request/dispatch path. The fix commit 6805746 is an ancestor of HEAD and shipped in the upstream release, before the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-13T23:34:04.416729+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.19.2 of undici. not_affected \u2014 Target undici 7.19.2 is not affected by CVE-2024-30261. The SRI check (bytesMatch -> caseSensitiveMatch) requires the expected digest to equal the full computed digest in length and content, so a prefix or truncated integrity value cannot validate tampered content. The upstream fix d542b8cd (GHSA-9qxr-qj54-h672, by hello@matteocollina.com) is an ancestor of HEAD and part of the upstream release...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.19.2 is not affected by CVE-2024-30261. The SRI check (bytesMatch -> caseSensitiveMatch) requires the expected digest to equal the full computed digest in length and content, so a prefix or truncated integrity value cannot validate tampered content. The upstream fix d542b8cd (GHSA-9qxr-qj54-h672, by hello@matteocollina.com) is an ancestor of HEAD and part of the upstream release..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 7.19.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:31:00.047911+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.19.2 of undici. not_affected \u2014 Target undici 7.19.2 already contains the upstream fix for CVE-2025-22150. The multipart boundary in lib/web/fetch/body.js is generated with node:crypto randomInt, not Math.random. The fix shipped in the upstream release before TuxCare onboarding.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.19.2 already contains the upstream fix for CVE-2025-22150. The multipart boundary in lib/web/fetch/body.js is generated with node:crypto randomInt, not Math.random. The fix shipped in the upstream release before TuxCare onboarding."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:37:00.197268+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.19.2 of undici. not_affected \u2014 Target undici 7.19.2 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). The fix shipped in the upstream release. Pool and RoundRobinPool drop a client from their client list on connectionError, so failed clients no longer accumulate.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.19.2 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). The fix shipped in the upstream release. Pool and RoundRobinPool drop a client from their client list on connectionError, so failed clients no longer accumulate."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:44:00.132301+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:46:33.687871+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:47:21.529900+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "action_statement": "Vulnerability CVE-2026-109841 affects version 7.19.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:59:44.828253+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.19.2 of undici. not_affected \u2014 Target is undici 7.19.2; the CVE affects only 8.11.0 and 8.11.1 (regression introduced in 8.11.0). WebSocket-over-HTTP/2 exists in the target, but the ClientHttp2Stream for the websocket upgrade has a permanent 'error' listener attached at creation (lib/dispatcher/client-h2.js:506). A failed handshake followed by the server destroying the connection therefore cannot produce an unhandled 'error'...",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.19.2; the CVE affects only 8.11.0 and 8.11.1 (regression introduced in 8.11.0). WebSocket-over-HTTP/2 exists in the target, but the ClientHttp2Stream for the websocket upgrade has a permanent 'error' listener attached at creation (lib/dispatcher/client-h2.js:506). A failed handshake followed by the server destroying the connection therefore cannot produce an unhandled 'error'..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:29:00.261196+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:34:00.250279+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "action_statement": "Vulnerability CVE-2026-109924 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "action_statement": "Vulnerability CVE-2026-11525 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:20:26.750713+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "action_statement": "Vulnerability CVE-2026-116630 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "action_statement": "Vulnerability CVE-2026-120222 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "action_statement": "Vulnerability CVE-2026-120415 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "action_statement": "Vulnerability CVE-2026-120423 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:06:35.912230+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "action_statement": "Vulnerability CVE-2026-120474 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "action_statement": "Vulnerability CVE-2026-12151 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "action_statement": "Vulnerability CVE-2026-13697 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "action_statement": "Vulnerability CVE-2026-14643 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "action_statement": "Vulnerability CVE-2026-15157 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "action_statement": "Vulnerability CVE-2026-1525 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "action_statement": "Vulnerability CVE-2026-1527 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "action_statement": "Vulnerability CVE-2026-1528 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "action_statement": "Vulnerability CVE-2026-16728 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "action_statement": "Vulnerability CVE-2026-16729 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "action_statement": "Vulnerability CVE-2026-18149 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "action_statement": "Vulnerability CVE-2026-18540 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "action_statement": "Vulnerability CVE-2026-19534 affects version 7.19.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:44:27.229058+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.19.2 of undici. not_affected \u2014 The target (undici 7.19.2) already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses with more than 5 Content-Encoding values. The fix commit b04e3cbb is upstream-authored and was part of the upstream release TuxCare onboarded, so it is not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.19.2) already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses with more than 5 Content-Encoding values. The fix commit b04e3cbb is upstream-authored and was part of the upstream release TuxCare onboarded, so it is not a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "action_statement": "Vulnerability CVE-2026-2581 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "action_statement": "Vulnerability CVE-2026-6733 affects version 7.19.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:09:39.760132+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 does not affect version 7.19.2 of undici. not_affected \u2014 Target is undici 7.19.2. Socks5ProxyAgent, the SOCKS5 proxy support added in 7.23.0, does not exist in this tree. The cross-origin pool reuse flaw therefore cannot occur. The fix commits (3805b8f8, a516f870) are not ancestors of HEAD, and nothing in HEAD needs them.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.19.2. Socks5ProxyAgent, the SOCKS5 proxy support added in 7.23.0, does not exist in this tree. The cross-origin pool reuse flaw therefore cannot occur. The fix commits (3805b8f8, a516f870) are not ancestors of HEAD, and nothing in HEAD needs them."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "action_statement": "Vulnerability CVE-2026-84890 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "action_statement": "Vulnerability CVE-2026-84933 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "action_statement": "Vulnerability CVE-2026-84947 affects version 7.19.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:39:18.586805+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 does not affect version 7.19.2 of undici. not_affected \u2014 undici 7.19.2 BalancedPool has no JSON clone of its options. It stores the options object and passes a shallow copy (Object.assign) to each per-upstream Pool, so function-valued connect/tls options such as checkServerIdentity or a custom connector are forwarded intact. The CVE's data flaw (function options silently dropped) does not occur in this version.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "impact_statement": "not_affected \u2014 undici 7.19.2 BalancedPool has no JSON clone of its options. It stores the options object and passes a shallow copy (Object.assign) to each per-upstream Pool, so function-valued connect/tls options such as checkServerIdentity or a custom connector are forwarded intact. The CVE's data flaw (function options silently dropped) does not occur in this version."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "action_statement": "Vulnerability CVE-2026-85008 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:27:17.765346+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "action_statement": "Vulnerability CVE-2026-85014 affects version 7.19.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:15:39.406188+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 does not affect version 7.19.2 of undici. not_affected \u2014 Not affected. This undici 7.19.2 tree's permessage-deflate.js has no decompressed-size-limit cleanup, and nothing calls removeAllListeners() on the InflateRaw. The 'error' listener stays attached for the stream's whole life, so a malformed DEFLATE block is turned into a 1007 WebSocket failure instead of an uncaught exception. The target does lack any decompressed-size limit, but that is a separ...",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "impact_statement": "not_affected \u2014 Not affected. This undici 7.19.2 tree's permessage-deflate.js has no decompressed-size-limit cleanup, and nothing calls removeAllListeners() on the InflateRaw. The 'error' listener stays attached for the stream's whole life, so a malformed DEFLATE block is turned into a 1007 WebSocket failure instead of an uncaught exception. The target does lack any decompressed-size limit, but that is a separ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:34:53.666741+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.19.2 of undici. not_affected \u2014 Not affected. The regression was introduced in undici 8.10.0 (affects 8.10.0 and 8.10.1); this target is 7.19.2. In this version, the cache and deduplicate interceptors build keys only from the dispatch opts' origin. Requests with no opts.origin bypass caching and dedup entirely, so no origin-less key is ever built.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "impact_statement": "not_affected \u2014 Not affected. The regression was introduced in undici 8.10.0 (affects 8.10.0 and 8.10.1); this target is 7.19.2. In this version, the cache and deduplicate interceptors build keys only from the dispatch opts' origin. Requests with no opts.origin bypass caching and dedup entirely, so no origin-less key is ever built."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:48:04.069265+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "action_statement": "Vulnerability CVE-2026-87029 affects version 7.19.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-14T01:59:04.413808+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 does not affect version 7.19.2 of undici. not_affected \u2014 Target undici 7.19.2 has no maxPayloadSize feature in its WebSocket client. CVE-2026-9675 is a regression in 8.1.0: a configured limit enforced per frame but not cumulatively across fragments. The code that regressed does not exist in the 7.x line, and the CVE states 7.x is unaffected. I confirmed this by searching the code.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.19.2 has no maxPayloadSize feature in its WebSocket client. CVE-2026-9675 is a regression in 8.1.0: a configured limit enforced per frame but not cumulatively across fragments. The code that regressed does not exist in the 7.x line, and the CVE states 7.x is unaffected. I confirmed this by searching the code."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "action_statement": "Vulnerability CVE-2026-9678 affects version 7.19.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 affects version 7.19.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "action_statement": "Vulnerability CVE-2026-9679 affects version 7.19.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.19.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.19.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:13:00.036418+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 does not affect version 7.19.2 of undici. not_affected \u2014 Not affected. The target is undici 7.19.2. SOCKS5 support for ProxyAgent was added in 7.23.0, and this repo has no SOCKS code at all. The vulnerable path, where requestTls is dropped for socks5:// URIs, does not exist. The HTTP(S) proxy path in proxy-agent.js passes requestTls to the destination connector.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "impact_statement": "not_affected \u2014 Not affected. The target is undici 7.19.2. SOCKS5 support for ProxyAgent was added in 7.23.0, and this repo has no SOCKS code at all. The vulnerable path, where requestTls is dropped for socks5:// URIs, does not exist. The HTTP(S) proxy path in proxy-agent.js passes requestTls to the destination connector."
    }
  ]
}