{ "@id": "urn:uuid:08b1fa67-db7c-44fa-9e0c-1b157d70c81a", "role": "Document Creator", "author": "https://tuxcare.com", "version": 36, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T17:57:57.882059+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 7.21.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-13T23:59:00.074519+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.21.0 of undici. not_affected \u2014 Target undici 7.21.0 already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, httpRedirectFetch deletes authorization, proxy-authorization, cookie and host headers. Upstream fix commit e041de35 is an ancestor of HEAD, and HEAD's history has no TuxCare/CloudLinux-authored commits, so this is an upstream fix shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Target undici 7.21.0 already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, httpRedirectFetch deletes authorization, proxy-authorization, cookie and host headers. Upstream fix commit e041de35 is an ancestor of HEAD, and HEAD's history has no TuxCare/CloudLinux-authored commits, so this is an upstream fix shipped in the release." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 7.21.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-13T22:22:00.050269+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.21.0 of undici. not_affected \u2014 Target undici 7.21.0 already strips Proxy-Authorization on cross-origin redirects in both the fetch path (lib/web/fetch/index.js:1306-1311) and the dispatcher RedirectHandler path (lib/handler/redirect-handler.js:201-211). The fix is the upstream commit b9da3e40, which is an ancestor of HEAD and shipped in the upstream release. HEAD has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Target undici 7.21.0 already strips Proxy-Authorization on cross-origin redirects in both the fetch path (lib/web/fetch/index.js:1306-1311) and the dispatcher RedirectHandler path (lib/handler/redirect-handler.js:201-211). The fix is the upstream commit b9da3e40, which is an ancestor of HEAD and shipped in the upstream release. HEAD has no TuxCare-domain commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-14T00:30:26.670415+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.21.0 of undici. not_affected \u2014 Not affected. The target (undici 7.21.0) already contains the upstream fix for CVE-2024-30260. The redirect handler strips authorization, proxy-authorization and cookie headers on cross-origin redirects. Upstream commit 6805746680d2 (Matteo Collina) is an ancestor of HEAD and of the first TuxCare commit, so the fix shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 Not affected. The target (undici 7.21.0) already contains the upstream fix for CVE-2024-30260. The redirect handler strips authorization, proxy-authorization and cookie headers on cross-origin redirects. Upstream commit 6805746680d2 (Matteo Collina) is an ancestor of HEAD and of the first TuxCare commit, so the fix shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-13T23:33:57.977509+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.21.0 of undici. not_affected \u2014 undici 7.21.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). The vendor commits d542b8cd and 2b39440b are ancestors of HEAD. The SRI integrity code is the post-fix rewrite, and it rejects empty or mismatching digests.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 undici 7.21.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). The vendor commits d542b8cd and 2b39440b are ancestors of HEAD. The SRI integrity code is the post-fix rewrite, and it rejects empty or mismatching digests." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 7.21.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-13T21:30:44.648777+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.21.0 of undici. not_affected \u2014 undici 7.21.0 already contains the upstream fix for CVE-2025-22150. The multipart/form-data boundary in lib/web/fetch/body.js is generated with node:crypto randomInt, not Math.random. The fix shipped in the upstream release, so the case is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 undici 7.21.0 already contains the upstream fix for CVE-2025-22150. The multipart/form-data boundary in lib/web/fetch/body.js is generated with node:crypto randomInt, not Math.random. The fix shipped in the upstream release, so the case is not_affected rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-13T21:37:00.197268+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.21.0 of undici. not_affected \u2014 undici 7.21.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool removes failed clients from its client list on 'connectionError', so repeated failed connections no longer accumulate. The fix shipped in the upstream release and was not added by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 undici 7.21.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool removes failed clients from its client list on 'connectionError', so repeated failed connections no longer accumulate. The fix shipped in the upstream release and was not added by TuxCare." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-14T17:57:57.882059+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 7.21.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-14T02:57:29.427470+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.21.0 of undici. not_affected \u2014 Target is undici 7.21.0, not the affected 8.11.0/8.11.1 line. The H2 abort() guard (request.aborted || request.completed) exists, but the WebSocket-over-H2 stream is created with a permanent 'error' listener, so an orphaned stream cannot emit an unhandled error that kills the process. HTTP/2 is also off by default here (allowH2 defaults to false in lib/core/connect.js).", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 7.21.0, not the affected 8.11.0/8.11.1 line. The H2 abort() guard (request.aborted || request.completed) exists, but the WebSocket-over-H2 stream is created with a permanent 'error' listener, so an orphaned stream cannot emit an unhandled error that kills the process. HTTP/2 is also off by default here (allowH2 defaults to false in lib/core/connect.js)." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-14T17:57:57.882059+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-14T17:57:57.882059+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-14T17:57:57.882059+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-06T10:20:26.750713+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-14643 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-14643" }, "action_statement": "Vulnerability CVE-2026-14643 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1525 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-1525" }, "action_statement": "Vulnerability CVE-2026-1525 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1527 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-1527" }, "action_statement": "Vulnerability CVE-2026-1527 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1528 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-1528" }, "action_statement": "Vulnerability CVE-2026-1528 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-14T17:57:57.882059+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-14T17:57:57.882059+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-13T21:44:00.039648+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.21.0 of undici. not_affected \u2014 Target undici 7.21.0 already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses whose Content-Encoding lists more than 5 codings. The fix is upstream commit b04e3cbb (Matteo Collina). It is an ancestor of HEAD, and HEAD has no TuxCare commits, so this is an upstream fix shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 Target undici 7.21.0 already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses whose Content-Encoding lists more than 5 codings. The fix is upstream commit b04e3cbb (Matteo Collina). It is an ancestor of HEAD, and HEAD has no TuxCare commits, so this is an upstream fix shipped in the release." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2581 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-2581" }, "action_statement": "Vulnerability CVE-2026-2581 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 7.21.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-13T20:09:39.760132+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 7.21.0 of undici. not_affected \u2014 Target is undici 7.21.0. CVE-2026-6734 affects only Socks5ProxyAgent, which was added in 7.23.0 (PR #4385). The target has no SOCKS5 code at all: no Socks5ProxyAgent, no socks5 files, and no 'socks' string in any JS/TS/JSON file outside node_modules. The vulnerable component is absent, so the target is not affected. The advisory product is undici, the same product as the target, so this is not ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Target is undici 7.21.0. CVE-2026-6734 affects only Socks5ProxyAgent, which was added in 7.23.0 (PR #4385). The target has no SOCKS5 code at all: no Socks5ProxyAgent, no socks5 files, and no 'socks' string in any JS/TS/JSON file outside node_modules. The vulnerable component is absent, so the target is not affected. The advisory product is undici, the same product as the target, so this is not ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 7.21.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-13T20:39:18.586805+00:00", "status_notes": "Vulnerability CVE-2026-84961 does not affect version 7.21.0 of undici. not_affected \u2014 undici 7.21.0 BalancedPool does not JSON-deep-clone its constructor options. It stores them as-is and gives each per-upstream Pool a shallow copy, so function-valued connect/tls options such as checkServerIdentity reach the Pool and the TLS connector intact. The flaw described in the CVE is not present in this version.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-84961" }, "impact_statement": "not_affected \u2014 undici 7.21.0 BalancedPool does not JSON-deep-clone its constructor options. It stores them as-is and gives each per-upstream Pool a shallow copy, so function-valued connect/tls options such as checkServerIdentity reach the Pool and the TLS connector intact. The flaw described in the CVE is not present in this version." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-14T17:57:57.882059+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-14T02:15:39.406188+00:00", "status_notes": "Vulnerability CVE-2026-85024 does not affect version 7.21.0 of undici. not_affected \u2014 undici 7.21.0 does not contain the vulnerable pattern. lib/web/websocket/permessage-deflate.js has no decompressed-size-limit cleanup and no removeAllListeners() call. The InflateRaw 'error' listener is attached at creation and never removed, so a malformed DEFLATE block cannot produce an unhandled stream error. Type A2 (chain absent). This version has no decompressed-size cap at all, which is ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-85024" }, "impact_statement": "not_affected \u2014 undici 7.21.0 does not contain the vulnerable pattern. lib/web/websocket/permessage-deflate.js has no decompressed-size-limit cleanup and no removeAllListeners() call. The InflateRaw 'error' listener is attached at creation and never removed, so a malformed DEFLATE block cannot produce an unhandled stream error. Type A2 (chain absent). This version has no decompressed-size cap at all, which is ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-14T02:33:45.545808+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.21.0 of undici. not_affected \u2014 Target is undici 7.21.0. The flaw was introduced in 8.10.0, when the cache and deduplicate interceptors began taking the origin from the dispatcher instead of from per-request options. Here both interceptors skip any request without opts.origin, so they never build a key without the destination origin. Every key includes the origin: makeCacheKey, makeDeduplicationKey, and the memory and sqlite ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 7.21.0. The flaw was introduced in 8.10.0, when the cache and deduplicate interceptors began taking the origin from the dispatcher instead of from per-request options. Here both interceptors skip any request without opts.origin, so they never build a key without the destination origin. Every key includes the origin: makeCacheKey, makeDeduplicationKey, and the memory and sqlite ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-14T17:57:57.882059+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 7.21.0 of undici, and is fixed in 7.21.0-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-14T01:54:00.066706+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 7.21.0 of undici. not_affected \u2014 undici 7.21.0 does not contain the maxPayloadSize feature. CVE-2026-9675 is a regression in the 8.1.0 line, whose cumulative fragment check was missing. The CVE states that 7.x never had this feature and is unaffected. Searches of the target confirm no maxPayloadSize option or size-limit code exists in lib/web/websocket, types or docs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 undici 7.21.0 does not contain the maxPayloadSize feature. CVE-2026-9675 is a regression in the 8.1.0 line, whose cumulative fragment check was missing. The CVE states that 7.x never had this feature and is unaffected. Searches of the target confirm no maxPayloadSize option or size-limit code exists in lib/web/websocket, types or docs." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9678 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-9678" }, "action_statement": "Vulnerability CVE-2026-9678 affects version 7.21.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9679 affects version 7.21.0 of undici.", "vulnerability": { "name": "CVE-2026-9679" }, "action_statement": "Vulnerability CVE-2026-9679 affects version 7.21.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.21.0", "identifiers": { "purl": "pkg:npm/undici@7.21.0" } } ], "timestamp": "2026-11-13T20:11:57.953874+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 7.21.0 of undici. not_affected \u2014 Target undici 7.21.0 predates SOCKS5 support (added in 7.23.0). The vulnerable Socks5ProxyAgent and ProxyAgent SOCKS5 branch do not exist, so requestTls cannot be dropped on a SOCKS5 path. The flawed pattern is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 Target undici 7.21.0 predates SOCKS5 support (added in 7.23.0). The vulnerable Socks5ProxyAgent and ProxyAgent SOCKS5 branch do not exist, so requestTls cannot be dropped on a SOCKS5 path. The flawed pattern is absent." } ] }