{
  "@id": "urn:uuid:44f5a065-e366-4571-b779-0736ffba56f0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T02:59:19.400953+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-14T00:02:51.490136+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 7.27.2 of undici. not_affected \u2014 undici 7.27.2 already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, lib/web/fetch/index.js deletes authorization, proxy-authorization, cookie and host from the request headers before the redirected request is issued. The fix commit e041de35 is upstream-authored and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 undici 7.27.2 already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, lib/web/fetch/index.js deletes authorization, proxy-authorization, cookie and host from the request headers before the redirected request is issued. The fix commit e041de35 is upstream-authored and shipped in the upstream release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "action_statement": "Vulnerability CVE-2024-24750 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:21:34.173747+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 7.27.2 of undici. not_affected \u2014 Target undici 7.27.2 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The upstream fix (GHSA-3787-6prv-h9w3, commits b9da3e40 / d3aa574b) is an ancestor of HEAD and shipped in the upstream release. TuxCare did not author it.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.27.2 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The upstream fix (GHSA-3787-6prv-h9w3, commits b9da3e40 / d3aa574b) is an ancestor of HEAD and shipped in the upstream release. TuxCare did not author it."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-14T00:30:26.670415+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 does not affect version 7.27.2 of undici. not_affected \u2014 Not affected. The target is undici 7.27.2. Its redirect handler already strips Authorization, Proxy-Authorization and Cookie headers on cross-origin redirects. The upstream fix commit 6805746 is an ancestor of HEAD, and no TuxCare-domain commit exists in HEAD's history, so this is an upstream fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "impact_statement": "not_affected \u2014 Not affected. The target is undici 7.27.2. Its redirect handler already strips Authorization, Proxy-Authorization and Cookie headers on cross-origin redirects. The upstream fix commit 6805746 is an ancestor of HEAD, and no TuxCare-domain commit exists in HEAD's history, so this is an upstream fix."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T23:33:57.977509+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 7.27.2 of undici. not_affected \u2014 undici 7.27.2 is not affected by CVE-2024-30261. The vendor fix d542b8cd (GHSA-9qxr-qj54-h672) is an ancestor of HEAD. The SRI code was later rewritten to follow the current spec, and it drops unsupported algorithms, picks the strongest hash, and only accepts a body whose digest matches. HEAD has no TuxCare commits, so this is an upstream fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 undici 7.27.2 is not affected by CVE-2024-30261. The vendor fix d542b8cd (GHSA-9qxr-qj54-h672) is an ancestor of HEAD. The SRI code was later rewritten to follow the current spec, and it drops unsupported algorithms, picks the strongest hash, and only accepts a body whose digest matches. HEAD has no TuxCare commits, so this is an upstream fix."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:30:44.648777+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 does not affect version 7.27.2 of undici. not_affected \u2014 Target undici 7.27.2 already contains the upstream fix. The multipart/form-data boundary is generated with node:crypto randomInt (CSPRNG) at lib/web/fetch/body.js:22-24 and 110. Math.random is only a fallback when crypto is unavailable, as in the upstream 35f5d45e follow-up. The fix is upstream-authored and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.27.2 already contains the upstream fix. The multipart/form-data boundary is generated with node:crypto randomInt (CSPRNG) at lib/web/fetch/body.js:22-24 and 110. Math.random is only a fallback when crypto is unavailable, as in the upstream 35f5d45e follow-up. The fix is upstream-authored and shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:37:00.197268+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 does not affect version 7.27.2 of undici. not_affected \u2014 The target (undici 7.27.2) already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool's constructor has a 'connectionError' listener that removes failed clients from the pool's client list. The fix shipped in the upstream release, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "impact_statement": "not_affected \u2014 The target (undici 7.27.2) already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool's constructor has a 'connectionError' listener that removes failed clients from the pool's client list. The fix shipped in the upstream release, so the verdict is not_affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:44:00.132301+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:46:33.687871+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:46:33.687871+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "action_statement": "Vulnerability CVE-2026-109841 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:59:19.400953+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 does not affect version 7.27.2 of undici. not_affected \u2014 Target is undici 7.27.2; the CVE says the regression was introduced in 8.11.0 (8.11.0 and 8.11.1 affected). The target's HTTP/2 WebSocket path attaches a persistent 'error' listener to the ClientHttp2Stream, so a server-destroyed connection cannot produce an unhandled 'error' that kills the process. The listener has existed since the HTTP/2 WebSocket feature was added (commit 92715645).",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.27.2; the CVE says the regression was introduced in 8.11.0 (8.11.0 and 8.11.1 affected). The target's HTTP/2 WebSocket path attaches a persistent 'error' listener to the ClientHttp2Stream, so a server-destroyed connection cannot produce an unhandled 'error' that kills the process. The listener has existed since the HTTP/2 WebSocket feature was added (commit 92715645)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:28:00.152357+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:34:00.250279+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "action_statement": "Vulnerability CVE-2026-109924 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "action_statement": "Vulnerability CVE-2026-11525 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:20:26.750713+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "action_statement": "Vulnerability CVE-2026-116630 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "action_statement": "Vulnerability CVE-2026-120222 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "action_statement": "Vulnerability CVE-2026-120415 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "action_statement": "Vulnerability CVE-2026-120423 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:06:35.912230+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "action_statement": "Vulnerability CVE-2026-120474 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "action_statement": "Vulnerability CVE-2026-12151 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "action_statement": "Vulnerability CVE-2026-13697 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "action_statement": "Vulnerability CVE-2026-14643 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "action_statement": "Vulnerability CVE-2026-15157 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:52:00.070588+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 does not affect version 7.27.2 of undici. not_affected \u2014 Target undici 7.27.2 already contains the upstream fix for CVE-2026-1525 (upstream commit 74495c63, \"reject duplicate content-length and host headers\"). Header names are lowercased in processHeader and a second content-length is rejected whichever way it is capitalised. The fix shipped in the upstream release TuxCare onboarded, so this is an upstream fix and not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.27.2 already contains the upstream fix for CVE-2026-1525 (upstream commit 74495c63, \"reject duplicate content-length and host headers\"). Header names are lowercased in processHeader and a second content-length is rejected whichever way it is capitalised. The fix shipped in the upstream release TuxCare onboarded, so this is an upstream fix and not a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:11:00.043442+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 does not affect version 7.27.2 of undici. not_affected \u2014 Target undici 7.27.2 already contains the upstream fix (77594f92, \"validate upgrade header to prevent CRLF injection\"). Request construction rejects non-string `upgrade` values and any value containing CR/LF or other invalid header characters, so CRLF cannot reach the serialized request head. The fix shipped in the upstream release and is not a TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.27.2 already contains the upstream fix (77594f92, \"validate upgrade header to prevent CRLF injection\"). Request construction rejects non-string `upgrade` values and any value containing CR/LF or other invalid header characters, so CRLF cannot reach the serialized request head. The fix shipped in the upstream release and is not a TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:01:22.274965+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 does not affect version 7.27.2 of undici. not_affected \u2014 undici 7.27.2 already contains the upstream fix for CVE-2026-1528 (commit 84235c62, Matteo Collina). In lib/web/websocket/receiver.js the 64-bit payload-length state rejects any frame with a non-zero upper 32 bits or a lower value above 2^31-1, and it fails the connection with code 1009. The vulnerable `(upper << 8) + lower` arithmetic is gone. The fix shipped in the upstream release before any...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "impact_statement": "not_affected \u2014 undici 7.27.2 already contains the upstream fix for CVE-2026-1528 (commit 84235c62, Matteo Collina). In lib/web/websocket/receiver.js the 64-bit payload-length state rejects any frame with a non-zero upper 32 bits or a lower value above 2^31-1, and it fails the connection with code 1009. The vulnerable `(upper << 8) + lower` arithmetic is gone. The fix shipped in the upstream release before any..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "action_statement": "Vulnerability CVE-2026-16728 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "action_statement": "Vulnerability CVE-2026-16729 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "action_statement": "Vulnerability CVE-2026-18149 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "action_statement": "Vulnerability CVE-2026-18540 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "action_statement": "Vulnerability CVE-2026-19534 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:44:00.039648+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 does not affect version 7.27.2 of undici. not_affected \u2014 Target undici 7.27.2 already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses with more than 5 content-codings. The fix commit b04e3cbb (author hello@matteocollina.com, committed via GitHub noreply) is an ancestor of HEAD and shipped in the upstream release. HEAD has no TuxCare-domain commits.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "impact_statement": "not_affected \u2014 Target undici 7.27.2 already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses with more than 5 content-codings. The fix commit b04e3cbb (author hello@matteocollina.com, committed via GitHub noreply) is an ancestor of HEAD and shipped in the upstream release. HEAD has no TuxCare-domain commits."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-14T01:37:00.143095+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 does not affect version 7.27.2 of undici. not_affected \u2014 undici 7.27.2 already contains the upstream fix 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\"). Chunks are forwarded to waiting handlers as they arrive. Late deduplication is refused once body data has started. Any per-waiter buffering is capped by maxBufferSize. The fix shipped in the upstream release, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "impact_statement": "not_affected \u2014 undici 7.27.2 already contains the upstream fix 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\"). Chunks are forwarded to waiting handlers as they arrive. Late deduplication is refused once body data has started. Any per-waiter buffering is capped by maxBufferSize. The fix shipped in the upstream release, so the verdict is not_affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "action_statement": "Vulnerability CVE-2026-6733 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "action_statement": "Vulnerability CVE-2026-6734 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "action_statement": "Vulnerability CVE-2026-84890 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:42:25.726548+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "action_statement": "Vulnerability CVE-2026-84933 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "action_statement": "Vulnerability CVE-2026-84947 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:33:13.066425+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "action_statement": "Vulnerability CVE-2026-84961 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:38:31.258833+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "action_statement": "Vulnerability CVE-2026-85008 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-29T18:27:17.765346+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "action_statement": "Vulnerability CVE-2026-85014 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:34:22.669842+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 does not affect version 7.27.2 of undici. not_affected \u2014 The target's size-limit cleanup in lib/web/websocket/permessage-deflate.js calls removeAllListeners() and then immediately destroy() on the InflateRaw. Destroying the stream means it cannot emit a later Z_DATA_ERROR, so the process-crashing unhandled 'error' event does not occur. I reproduced the attack against this code on Node 20.20.2 and the process survived. The same test crashed once I rem...",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "impact_statement": "not_affected \u2014 The target's size-limit cleanup in lib/web/websocket/permessage-deflate.js calls removeAllListeners() and then immediately destroy() on the InflateRaw. Destroying the stream means it cannot emit a later Z_DATA_ERROR, so the process-crashing unhandled 'error' event does not occur. I reproduced the attack against this code on Node 20.20.2 and the process survived. The same test crashed once I rem..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:33:45.545808+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 does not affect version 7.27.2 of undici. not_affected \u2014 Target is undici 7.27.2. The CVE says the flaw was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In this tree the cache and dedup keys always include opts.origin, and requests with no origin are skipped, so keys cannot collapse across origins.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "impact_statement": "not_affected \u2014 Target is undici 7.27.2. The CVE says the flaw was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In this tree the cache and dedup keys always include opts.origin, and requests with no origin are skipped, so keys cannot collapse across origins."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:48:04.069265+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-10-15T21:34:00.093587+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "action_statement": "Vulnerability CVE-2026-87029 affects version 7.27.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-11-14T01:58:03.198614+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 does not affect version 7.27.2 of undici. not_affected \u2014 CVE-2026-9675 is a regression in undici 8.1.0: the newly added `maxPayloadSize` option was enforced per frame but not cumulatively across fragments. Target undici 7.27.2 has no `maxPayloadSize` feature (zero occurrences repo-wide). The vulnerable limit-enforcement code is absent, so there is no configured limit to bypass. The CVE states 7.x is unaffected, and the code is consistent with that. U...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-9675 is a regression in undici 8.1.0: the newly added `maxPayloadSize` option was enforced per frame but not cumulatively across fragments. Target undici 7.27.2 has no `maxPayloadSize` feature (zero occurrences repo-wide). The vulnerable limit-enforcement code is absent, so there is no configured limit to bypass. The CVE states 7.x is unaffected, and the code is consistent with that. U..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "action_statement": "Vulnerability CVE-2026-9678 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "action_statement": "Vulnerability CVE-2026-9679 affects version 7.27.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@7.27.2",
          "identifiers": {
            "purl": "pkg:npm/undici@7.27.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 affects version 7.27.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "action_statement": "Vulnerability CVE-2026-9697 affects version 7.27.2 of undici."
    }
  ]
}