{ "@id": "urn:uuid:b5cd35e7-318e-4d60-814a-8f0cce1dd9f3", "role": "Document Creator", "author": "https://tuxcare.com", "version": 42, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:58:00.113753+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 7.24.4 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 7.24.4 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 7.24.4 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 7.24.4 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 7.24.4 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 7.24.4 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 7.24.4 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-14T00:00:45.497883+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.24.4 of undici. not_affected \u2014 Not affected. Target undici 7.24.4 already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, fetch deletes authorization, proxy-authorization, cookie and host headers (lib/web/fetch/index.js:1312-1322). The dispatcher RedirectHandler also strips cookie on cross-origin redirects (lib/handler/redirect-handler.js:222-225). The fix commit e041de3 is an ancestor of HEAD and w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Not affected. Target undici 7.24.4 already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, fetch deletes authorization, proxy-authorization, cookie and host headers (lib/web/fetch/index.js:1312-1322). The dispatcher RedirectHandler also strips cookie on cross-origin redirects (lib/handler/redirect-handler.js:222-225). The fix commit e041de3 is an ancestor of HEAD and w..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 7.24.4 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-13T22:21:34.173747+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.24.4 of undici. not_affected \u2014 Target undici 7.24.4-tuxcare.8 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The fix came from upstream (b9da3e40, Matteo Collina) and is in the upstream release before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Target undici 7.24.4-tuxcare.8 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The fix came from upstream (b9da3e40, Matteo Collina) and is in the upstream release before the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-14T00:30:00.611450+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.24.4 of undici. not_affected \u2014 undici 7.24.4 already contains the CVE-2024-30260 fix. The redirect handler strips authorization, proxy-authorization and cookie headers when a redirect crosses origins. The upstream fix commit 6805746 is an ancestor of the first TuxCare commit, so this is an upstream fix that shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 undici 7.24.4 already contains the CVE-2024-30260 fix. The redirect handler strips authorization, proxy-authorization and cookie headers when a redirect crosses origins. The upstream fix commit 6805746 is an ancestor of the first TuxCare commit, so this is an upstream fix that shipped in the release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-13T23:33:57.977509+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.24.4 of undici. not_affected \u2014 undici 7.24.4 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). Fix commit d542b8cd (Matteo Collina, upstream) is an ancestor of HEAD and of the first TuxCare commit, so it shipped in the upstream release. The SRI code was later rewritten and still enforces strongest-algorithm-only matching, so the tampered-response acceptance flaw is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 undici 7.24.4 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). Fix commit d542b8cd (Matteo Collina, upstream) is an ancestor of HEAD and of the first TuxCare commit, so it shipped in the upstream release. The SRI code was later rewritten and still enforces strongest-algorithm-only matching, so the tampered-response acceptance flaw is not present." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 7.24.4 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-06T10:58:00.048321+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.24.4 of undici. not_affected \u2014 The upstream fix for CVE-2025-22150 is already in the shipped 7.24.4 release. lib/web/fetch/body.js builds the multipart FormData boundary with node:crypto randomInt. Math.random is only a fallback when the runtime has no crypto support, which is upstream commit 35f5d45e's behavior. The fix commits are upstream-authored and predate the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2025-22150 is already in the shipped 7.24.4 release. lib/web/fetch/body.js builds the multipart FormData boundary with node:crypto randomInt. Math.random is only a fallback when the runtime has no crypto support, which is upstream commit 35f5d45e's behavior. The fix commits are upstream-authored and predate the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-06T11:04:00.072598+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.24.4 of undici. not_affected \u2014 CVE-2025-47279 (memory leak when a pooled client keeps failing connections, e.g. on an invalid TLS certificate) is already fixed in this target. The upstream fix, nodejs/undici#4088 (f317618e, Matteo Collina), is in HEAD and was already part of the upstream 7.24.4 release before the first TuxCare commit. Pool and RoundRobinPool drop clients on 'connectionError', and Agent releases the per-origi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 CVE-2025-47279 (memory leak when a pooled client keeps failing connections, e.g. on an invalid TLS certificate) is already fixed in this target. The upstream fix, nodejs/undici#4088 (f317618e, Matteo Collina), is in HEAD and was already part of the upstream 7.24.4 release before the first TuxCare commit. Pool and RoundRobinPool drop clients on 'connectionError', and Agent releases the per-origi..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-02T14:58:56.128088+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.6.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-31T12:31:12.707783+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.5.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-27T11:12:44.654647+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.4.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-14T02:58:00.113753+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.24.4 of undici. not_affected \u2014 Target is undici 7.24.4-tuxcare.8, which predates the 8.11.0 regression. Its HTTP/2 WebSocket path always keeps an 'error' listener on the ClientHttp2Stream, and request.completed is not set on upgrade, so abort() is not a no-op. A failed handshake followed by a server connection drop cannot produce an unhandled stream error that crashes the process.", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 7.24.4-tuxcare.8, which predates the 8.11.0 regression. Its HTTP/2 WebSocket path always keeps an 'error' listener on the ClientHttp2Stream, and request.completed is not set on upgrade, so abort() is not a no-op. A failed handshake followed by a server connection drop cannot produce an unhandled stream error that crashes the process." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-27T11:12:44.654647+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.4.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-27T11:12:44.654647+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.4.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-02T14:58:56.128088+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.6.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-19T23:11:00.126701+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.1.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 7.24.4 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-06T10:20:26.750713+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 7.24.4 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 7.24.4 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 7.24.4 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 7.24.4 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 7.24.4 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-19T23:11:00.126701+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.1.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-19T23:11:00.126701+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.1.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-14643 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-14643" }, "action_statement": "Vulnerability CVE-2026-14643 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-19T23:11:00.126701+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.1.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-06T11:11:00.038105+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 7.24.4 of undici. not_affected \u2014 The upstream fix for CVE-2026-1525 (undici commit 74495c63, \"reject duplicate content-length and host headers\", by Matteo Collina) is already in HEAD. It shipped in the upstream 7.24.4 release, which is later than the patched 7.24.0, before any TuxCare commit. lib/core/request.js lowercases header names and rejects a second content-length header whatever its case.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-1525 (undici commit 74495c63, \"reject duplicate content-length and host headers\", by Matteo Collina) is already in HEAD. It shipped in the upstream 7.24.4 release, which is later than the patched 7.24.0, before any TuxCare commit. lib/core/request.js lowercases header names and rejects a second content-length header whatever its case." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 7.24.4 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-06T11:17:54.818653+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 7.24.4 of undici. not_affected \u2014 The target (undici 7.24.4) already contains the upstream fix. Request construction rejects any `upgrade` value containing CR/LF or other invalid header characters before it can reach the socket write. The fix is upstream commit 77594f92 by Matteo Collina and shipped in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 The target (undici 7.24.4) already contains the upstream fix. Request construction rejects any `upgrade` value containing CR/LF or other invalid header characters before it can reach the socket write. The fix is upstream commit 77594f92 by Matteo Collina and shipped in the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-13T22:00:03.479197+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 7.24.4 of undici. not_affected \u2014 The 64-bit WebSocket payload-length overflow (CVE-2026-1528) is already fixed in this target. lib/web/websocket/receiver.js rejects any frame whose upper 32 bits are non-zero, or whose lower 32 bits exceed 2^31-1, and fails the connection with code 1009. The fix is upstream commit 84235c62 by Matteo Collina. It shipped in the upstream 7.24.x release, before the first TuxCare commit in this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 The 64-bit WebSocket payload-length overflow (CVE-2026-1528) is already fixed in this target. lib/web/websocket/receiver.js rejects any frame whose upper 32 bits are non-zero, or whose lower 32 bits exceed 2^31-1, and fails the connection with code 1009. The fix is upstream commit 84235c62 by Matteo Collina. It shipped in the upstream 7.24.x release, before the first TuxCare commit in this branch." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-19T23:11:00.126701+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.1.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-06T11:02:55.739585+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.24.4 of undici. not_affected \u2014 Target undici 7.24.4 already contains the upstream fix (b04e3cbb) limiting Content-Encoding chains to 5 in both fetch() and the decompress interceptor. The fix shipped in the upstream release and was authored by upstream, not TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 Target undici 7.24.4 already contains the upstream fix (b04e3cbb) limiting Content-Encoding chains to 5 in both fetch() and the decompress interceptor. The fix shipped in the upstream release and was authored by upstream, not TuxCare." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 7.24.4 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-14T01:37:47.119617+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 7.24.4 of undici. not_affected \u2014 Not affected. The upstream fix commit 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\", by Matteo Collina) is already in HEAD and shipped in the upstream release that TuxCare onboarded. The deduplication handler now streams chunks and refuses late attachment once body data has started. Any per-waiter buffering is capped by maxBufferSize.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix commit 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\", by Matteo Collina) is already in HEAD and shipped in the upstream release that TuxCare onboarded. The deduplication handler now streams chunks and refuses late attachment once body data has started. Any per-waiter buffering is capped by maxBufferSize." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-6734 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-6734" }, "action_statement": "Vulnerability CVE-2026-6734 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-05T09:32:26.454745+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.7.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 7.24.4 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-14T02:34:22.669842+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.24.4 of undici. not_affected \u2014 Not affected. The target is undici 7.24.4-tuxcare.8. The CVE says the flaw was introduced in 8.10.0, and this tree does not have it. Cache and dedup keys here always include opts.origin. Requests with no origin bypass both interceptors, so no origin-less key is ever built.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Not affected. The target is undici 7.24.4-tuxcare.8. The CVE says the flaw was introduced in 8.10.0, and this tree does not have it. Cache and dedup keys here always include opts.origin. Requests with no origin bypass both interceptors, so no origin-less key is ever built." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-09T19:56:00.099356+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.8.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-31T12:31:12.707783+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.5.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-9675 affects version 7.24.4 of undici.", "vulnerability": { "name": "CVE-2026-9675" }, "action_statement": "Vulnerability CVE-2026-9675 affects version 7.24.4 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-9678 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.3.", "vulnerability": { "name": "CVE-2026-9678" }, "action_statement": "Vulnerability CVE-2026-9678 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-9679 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.3.", "vulnerability": { "name": "CVE-2026-9679" }, "action_statement": "Vulnerability CVE-2026-9679 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-9697 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-9697" }, "action_statement": "Vulnerability CVE-2026-9697 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability GHSA-jr45-8vmc-qm54 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2.", "vulnerability": { "name": "GHSA-jr45-8vmc-qm54" }, "action_statement": "Vulnerability GHSA-jr45-8vmc-qm54 affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.4", "identifiers": { "purl": "pkg:npm/undici@7.24.4" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability GHSA-vmh5-mc38-953g affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2.", "vulnerability": { "name": "GHSA-vmh5-mc38-953g" }, "action_statement": "Vulnerability GHSA-vmh5-mc38-953g affects version 7.24.4 of undici, and is fixed in 7.24.4-tuxcare.2." } ] }