{ "@id": "urn:uuid:a83a5190-debb-402e-ac76-95c116dcdc9f", "role": "Document Creator", "author": "https://tuxcare.com", "version": 28, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T03:05:08.846671+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 7.24.8 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-14T00:13:37.220054+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.24.8 of undici. not_affected \u2014 undici 7.24.8 already strips the cookie header (plus authorization, proxy-authorization and host) on cross-origin redirects in both fetch and the dispatcher RedirectHandler. The fix, upstream commit e041de35 (GHSA-wqq4-5wpv-mx2g), is part of the upstream release that TuxCare onboarded, so this is an upstream fix and not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 undici 7.24.8 already strips the cookie header (plus authorization, proxy-authorization and host) on cross-origin redirects in both fetch and the dispatcher RedirectHandler. The fix, upstream commit e041de35 (GHSA-wqq4-5wpv-mx2g), is part of the upstream release that TuxCare onboarded, so this is an upstream fix and not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 7.24.8 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-13T22:29:44.368955+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.24.8 of undici. not_affected \u2014 Not affected. The target (undici 7.24.8-tuxcare.2) already strips Proxy-Authorization on cross-origin redirects in both the fetch path (lib/web/fetch/index.js:1312-1317) and the dispatcher redirect handler (lib/handler/redirect-handler.js:222-224). The fix came from upstream, not TuxCare. Upstream commit b9da3e40 (Matteo Collina) is an ancestor of HEAD and of the first TuxCare commit, so it shi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Not affected. The target (undici 7.24.8-tuxcare.2) already strips Proxy-Authorization on cross-origin redirects in both the fetch path (lib/web/fetch/index.js:1312-1317) and the dispatcher redirect handler (lib/handler/redirect-handler.js:222-224). The fix came from upstream, not TuxCare. Upstream commit b9da3e40 (Matteo Collina) is an ancestor of HEAD and of the first TuxCare commit, so it shi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-14T00:41:00.067685+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.24.8 of undici. not_affected \u2014 undici 7.24.8 already strips Authorization, Cookie and Proxy-Authorization headers on cross-origin redirects in the shared redirect handler used by request(). The upstream fix commit 6805746 is an ancestor of the first TuxCare commit, so it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 undici 7.24.8 already strips Authorization, Cookie and Proxy-Authorization headers on cross-origin redirects in the shared redirect handler used by request(). The upstream fix commit 6805746 is an ancestor of the first TuxCare commit, so it shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-13T23:44:39.209195+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.24.8 of undici. not_affected \u2014 undici 7.24.8 already contains the upstream CVE-2024-30261 fix. The SRI code in lib/web/subresource-integrity/subresource-integrity.js picks the strongest algorithm correctly and compares base64 values with padding handled on both sides. The upstream fix commit d542b8cd is an ancestor of HEAD and was already in the upstream release TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 undici 7.24.8 already contains the upstream CVE-2024-30261 fix. The SRI code in lib/web/subresource-integrity/subresource-integrity.js picks the strongest algorithm correctly and compares base64 values with padding handled on both sides. The upstream fix commit d542b8cd is an ancestor of HEAD and was already in the upstream release TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 7.24.8 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-13T21:35:52.743365+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.24.8 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2025-22150 (nodejs/undici c2d78cd1, by Matteo Collina) is already in the target. In lib/web/fetch/body.js the FormData multipart boundary is generated with node:crypto randomInt, not Math.random(). The fix is in the upstream 7.24.8 release that TuxCare onboarded, so it is not TuxCare-attributed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2025-22150 (nodejs/undici c2d78cd1, by Matteo Collina) is already in the target. In lib/web/fetch/body.js the FormData multipart boundary is generated with node:crypto randomInt, not Math.random(). The fix is in the upstream 7.24.8 release that TuxCare onboarded, so it is not TuxCare-attributed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-13T21:42:00.051568+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.24.8 of undici. not_affected \u2014 The target (undici 7.24.8-tuxcare.2) already contains the upstream CVE-2025-47279 fix, upstream commit f317618ec28 (PR #4088). Pool registers a 'connectionError' handler that drops failed clients from its client list. The same handler is in round-robin-pool.js, and Agent closes unused per-origin pools on connectionError. The fix shipped in the upstream release that TuxCare onboarded, so it is a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 The target (undici 7.24.8-tuxcare.2) already contains the upstream CVE-2025-47279 fix, upstream commit f317618ec28 (PR #4088). Pool registers a 'connectionError' handler that drops failed clients from its client list. The same handler is in round-robin-pool.js, and Agent closes unused per-origin pools on connectionError. The fix shipped in the upstream release that TuxCare onboarded, so it is a..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-10T12:38:00.039095+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-10T12:38:00.039095+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-10T12:38:00.039095+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-14T03:05:08.846671+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.24.8 of undici. not_affected \u2014 Target undici 7.24.8-tuxcare.2 has the H2 WebSocket path, and abort() is a no-op once request.completed is set. However, the WebSocket H2 stream has a permanent 'error' listener, so a server-induced stream error is handled and no unhandled 'error' event can crash the process. The CVE says the 8.11.0 regression left the stream with no error listener.", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target undici 7.24.8-tuxcare.2 has the H2 WebSocket path, and abort() is a no-op once request.completed is set. However, the WebSocket H2 stream has a permanent 'error' listener, so a server-induced stream error is handled and no unhandled 'error' event can crash the process. The CVE says the 8.11.0 regression left the stream with no error listener." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-10T12:38:00.039095+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-10T12:38:00.039095+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-10T12:38:00.039095+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-10-15T17:22:00.150268+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-06T10:20:57.098620+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-10-15T17:22:00.150268+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-10-15T17:22:00.150268+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-10-15T17:22:00.150268+00:00", "status_notes": "Vulnerability CVE-2026-14643 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-14643" }, "action_statement": "Vulnerability CVE-2026-14643 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-10-15T17:22:00.150268+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 7.24.8 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-13T21:55:34.449898+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 7.24.8 of undici. not_affected \u2014 The target (undici 7.24.8) already contains the upstream CVE-2026-1525 fix. processHeader in lib/core/request.js lowercases the header name and throws on a second content-length or host header, whatever the casing. The fix commit 74495c63 is by Matteo Collina and was part of the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 The target (undici 7.24.8) already contains the upstream CVE-2026-1525 fix. processHeader in lib/core/request.js lowercases the header name and throws on a second content-length or host header, whatever the casing. The fix commit 74495c63 is by Matteo Collina and was part of the upstream release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 7.24.8 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-13T22:12:00.040260+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 7.24.8 of undici. not_affected \u2014 undici 7.24.8 already contains the upstream fix for CVE-2026-1527. Request's constructor rejects any `upgrade` option containing CR/LF or other invalid header characters before it reaches the socket write in client-h1.js. The fix shipped in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 undici 7.24.8 already contains the upstream fix for CVE-2026-1527. Request's constructor rejects any `upgrade` option containing CR/LF or other invalid header characters before it reaches the socket write in client-h1.js. The fix shipped in the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-13T22:04:00.056825+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 7.24.8 of undici. not_affected \u2014 Target undici 7.24.8 already contains the upstream fix for CVE-2026-1528 (upstream commit 84235c62, \"Fix websocket 64-bit length overflow\"). It shipped in the upstream release that TuxCare onboarded, so it is not a TuxCare backport. ByteParser's PAYLOADLENGTH_64 state now reads upper and lower 32-bit halves and fails the connection with close code 1009 when upper !== 0 or lower > 2^31-1. The ov...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 Target undici 7.24.8 already contains the upstream fix for CVE-2026-1528 (upstream commit 84235c62, \"Fix websocket 64-bit length overflow\"). It shipped in the upstream release that TuxCare onboarded, so it is not a TuxCare backport. ByteParser's PAYLOADLENGTH_64 state now reads upper and lower 32-bit halves and fails the connection with close code 1009 when upper !== 0 or lower > 2^31-1. The ov..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-10-15T17:22:00.150268+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-10-15T17:22:00.150268+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-10T12:38:00.039095+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-13T16:50:00.667493+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.2.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-10T12:38:00.039095+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-13T21:47:00.051716+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.24.8 of undici. not_affected \u2014 Both vulnerable paths already cap the Content-Encoding chain at 5 entries: the fetch() response decoder and the decompress interceptor. The cap is the upstream fix (nodejs/undici b04e3cbb, PR #4729). It shipped in the upstream 7.24.8 release that TuxCare onboarded, so this is an upstream fix and the pattern is not present in HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 Both vulnerable paths already cap the Content-Encoding chain at 5 entries: the fetch() response decoder and the decompress interceptor. The cap is the upstream fix (nodejs/undici b04e3cbb, PR #4729). It shipped in the upstream 7.24.8 release that TuxCare onboarded, so this is an upstream fix and the pattern is not present in HEAD." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 7.24.8 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-14T01:45:00.097042+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 7.24.8 of undici. not_affected \u2014 The upstream fix for CVE-2026-2581 (undici commit 5890c7b, \"stream response chunks to waiting handlers\") is already in this target. The target's DeduplicationHandler streams chunks to waiting handlers and refuses late attachment once body data has started. That commit predates the first TuxCare commit (onboarding), so it shipped in the upstream release and the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-2581 (undici commit 5890c7b, \"stream response chunks to waiting handlers\") is already in this target. The target's DeduplicationHandler streams chunks to waiting handlers and refuses late attachment once body data has started. That commit predates the first TuxCare commit (onboarding), so it shipped in the upstream release and the verdict is not_affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-10-15T17:22:00.150268+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-10-15T17:22:00.150268+00:00", "status_notes": "Vulnerability CVE-2026-6734 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-6734" }, "action_statement": "Vulnerability CVE-2026-6734 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-10T12:38:00.039095+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-10T12:38:00.039095+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-13T16:50:00.667493+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.2.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-10T12:38:00.039095+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-13T16:50:00.667493+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.2.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-10T12:38:00.039095+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-05T09:05:03.785272+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 7.24.8 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-14T02:43:00.077402+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.24.8 of undici. not_affected \u2014 CVE-2026-85152 was introduced in undici 8.10.0, which reworked how the cache and deduplicate interceptors obtain the origin for their keys. This target is 7.24.8-tuxcare.2 and still has the older design. Both interceptors skip any request that has no opts.origin, and every cache or dedup key is built from that origin. The origin-less keying that causes the cross-origin collision cannot occur here.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 CVE-2026-85152 was introduced in undici 8.10.0, which reworked how the cache and deduplicate interceptors obtain the origin for their keys. This target is 7.24.8-tuxcare.2 and still has the older design. Both interceptors skip any request that has no opts.origin, and every cache or dedup key is built from that origin. The origin-less keying that causes the cross-origin collision cannot occur here." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-10T12:38:00.039095+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-10T12:38:00.039095+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 7.24.8 of undici, and is fixed in 7.24.8-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-11-14T02:06:45.296491+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 7.24.8 of undici. not_affected \u2014 CVE-2026-9675 is a regression in undici 8.1.0's `maxPayloadSize` feature: the limit was checked per frame but not cumulatively across fragments of one message. The 7.24.8 target has no `maxPayloadSize` option and no per-frame payload limit that could be bypassed, so the regression pattern is absent. The CVE states that 7.x never had this feature and is unaffected. Fragments are still buffered w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 CVE-2026-9675 is a regression in undici 8.1.0's `maxPayloadSize` feature: the limit was checked per frame but not cumulatively across fragments of one message. The 7.24.8 target has no `maxPayloadSize` option and no per-frame payload limit that could be bypassed, so the regression pattern is absent. The CVE states that 7.x never had this feature and is unaffected. Fragments are still buffered w..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-10-15T17:22:00.150268+00:00", "status_notes": "Vulnerability CVE-2026-9678 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-9678" }, "action_statement": "Vulnerability CVE-2026-9678 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-10-15T17:22:00.150268+00:00", "status_notes": "Vulnerability CVE-2026-9679 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-9679" }, "action_statement": "Vulnerability CVE-2026-9679 affects version 7.24.8 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@7.24.8", "identifiers": { "purl": "pkg:npm/undici@7.24.8" } } ], "timestamp": "2026-10-15T17:22:00.150268+00:00", "status_notes": "Vulnerability CVE-2026-9697 affects version 7.24.8 of undici.", "vulnerability": { "name": "CVE-2026-9697" }, "action_statement": "Vulnerability CVE-2026-9697 affects version 7.24.8 of undici." } ] }