{
  "@id": "urn:uuid:a310230c-6d0d-4d47-90f4-2ccd0e5e7fd9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 51,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T03:10:00.496456+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 8.10.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-14T00:07:00.231663+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 8.10.2 of undici. not_affected \u2014 Undici 8.10.2 already contains the upstream CVE-2023-45143 fix. In lib/web/fetch/index.js, httpRedirectFetch deletes the Cookie header (plus Host, Authorization and Proxy-Authorization) when a redirect target is cross-origin. The fix commit e041de35 is an ancestor of HEAD. It was authored upstream by maitken033380023@gmail.com and shipped in the upstream release, and no TuxCare-domain commit ex...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 Undici 8.10.2 already contains the upstream CVE-2023-45143 fix. In lib/web/fetch/index.js, httpRedirectFetch deletes the Cookie header (plus Host, Authorization and Proxy-Authorization) when a redirect target is cross-origin. The fix commit e041de35 is an ancestor of HEAD. It was authored upstream by maitken033380023@gmail.com and shipped in the upstream release, and no TuxCare-domain commit ex..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "action_statement": "Vulnerability CVE-2024-24750 affects version 8.10.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:22:49.594925+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 8.10.2 of undici. not_affected \u2014 Target undici 8.10.2 already clears Proxy-Authorization on cross-origin redirects, in both the fetch redirect path and the dispatcher RedirectHandler. The fix is the upstream commit b9da3e40, which is in the upstream release before the first TuxCare commit. It is an upstream fix, so not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.10.2 already clears Proxy-Authorization on cross-origin redirects, in both the fetch redirect path and the dispatcher RedirectHandler. The fix is the upstream commit b9da3e40, which is in the upstream release before the first TuxCare commit. It is an upstream fix, so not_affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-14T00:33:45.023269+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 does not affect version 8.10.2 of undici. not_affected \u2014 Not affected. The redirect handler already strips authorization, proxy-authorization and cookie headers on cross-origin redirects, and that logic applies to undici.request() too. The upstream fix (6805746) is an ancestor of HEAD and shipped in the upstream release. No TuxCare commit carries it.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "impact_statement": "not_affected \u2014 Not affected. The redirect handler already strips authorization, proxy-authorization and cookie headers on cross-origin redirects, and that logic applies to undici.request() too. The upstream fix (6805746) is an ancestor of HEAD and shipped in the upstream release. No TuxCare commit carries it."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T23:40:06.042253+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 8.10.2 of undici. not_affected \u2014 Target undici 8.10.2 is not affected by CVE-2024-30261. The SRI check in lib/web/subresource-integrity/subresource-integrity.js parses the metadata, keeps only the strongest supported algorithm, and compares the computed digest with a padding-tolerant comparison. This is the behaviour of the upstream fix (d542b8cd), which is an ancestor of HEAD and is not TuxCare-authored.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.10.2 is not affected by CVE-2024-30261. The SRI check in lib/web/subresource-integrity/subresource-integrity.js parses the metadata, keeps only the strongest supported algorithm, and compares the computed digest with a padding-tolerant comparison. This is the behaviour of the upstream fix (d542b8cd), which is an ancestor of HEAD and is not TuxCare-authored."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 8.10.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:31:44.249794+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 does not affect version 8.10.2 of undici. not_affected \u2014 undici 8.10.2 is a plain upstream release that already includes the CVE-2025-22150 fix. Multipart boundaries are generated with node:crypto randomInt, not Math.random(). A Math.random fallback exists only when node:crypto is unavailable in the runtime.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "impact_statement": "not_affected \u2014 undici 8.10.2 is a plain upstream release that already includes the CVE-2025-22150 fix. Multipart boundaries are generated with node:crypto randomInt, not Math.random(). A Math.random fallback exists only when node:crypto is unavailable in the runtime."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:39:00.116210+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 does not affect version 8.10.2 of undici. not_affected \u2014 Undici 8.10.2 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). The Pool removes clients that hit a connection error from its client list, so repeated TLS failures cannot accumulate retained client objects. The fix arrived with the upstream release, not through a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "impact_statement": "not_affected \u2014 Undici 8.10.2 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). The Pool removes clients that hit a connection error from its client list, so repeated TLS failures cannot accumulate retained client objects. The fix arrived with the upstream release, not through a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:22:00.069315+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:22:00.069315+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:23:00.084126+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "action_statement": "Vulnerability CVE-2026-109841 affects version 8.10.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-14T03:10:00.496456+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 does not affect version 8.10.2 of undici. not_affected \u2014 Target is undici 8.10.2. The CVE says the regression was introduced in 8.11.0, and the 8.10.2 code does not have it. In 8.10.2 an HTTP/2 websocket upgrade request is never marked `completed`, so a failed handshake still aborts the request, and the abort closes and destroys the ClientHttp2Stream. The abort is not a no-op, so no stream is orphaned without an error listener.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.10.2. The CVE says the regression was introduced in 8.11.0, and the 8.10.2 code does not have it. In 8.10.2 an HTTP/2 websocket upgrade request is never marked `completed`, so a failed handshake still aborts the request, and the abort closes and destroys the ClientHttp2Stream. The abort is not a no-op, so no stream is orphaned without an error listener."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:22:00.069315+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:22:00.069315+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "action_statement": "Vulnerability CVE-2026-109924 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:08:00.152629+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 8.10.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:01:00.036985+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 does not affect version 8.10.2 of undici. not_affected \u2014 undici 8.10.2 already contains the upstream fix for CVE-2026-11525. The SameSite attribute is parsed with exact, case-insensitive equality, not substring matching. The fix is upstream commit 5655ea43 (\"fix(cookies): preserve values and parse SameSite strictly\") by hello@matteocollina.com. It is an ancestor of HEAD, and HEAD has no TuxCare-authored commits.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "impact_statement": "not_affected \u2014 undici 8.10.2 already contains the upstream fix for CVE-2026-11525. The SameSite attribute is parsed with exact, case-insensitive equality, not substring matching. The fix is upstream commit 5655ea43 (\"fix(cookies): preserve values and parse SameSite strictly\") by hello@matteocollina.com. It is an ancestor of HEAD, and HEAD has no TuxCare-authored commits."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:20:57.098620+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "action_statement": "Vulnerability CVE-2026-116630 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "action_statement": "Vulnerability CVE-2026-120222 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "action_statement": "Vulnerability CVE-2026-120415 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "action_statement": "Vulnerability CVE-2026-120423 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:06:35.912230+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "action_statement": "Vulnerability CVE-2026-120474 affects version 8.10.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:03:00.065439+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 does not affect version 8.10.2 of undici. not_affected \u2014 The upstream fix for CVE-2026-12151 is already in the target (undici 8.10.2). The receiver counts fragments per message and fails the connection with close code 1008 once the limit is reached. The default limit is 131072. The fix commit was authored upstream (Luigi Pinca) and is an ancestor of HEAD. HEAD contains no commit by a @cloudlinux.com or @tuxcare.com identity, so the fix is attributed ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-12151 is already in the target (undici 8.10.2). The receiver counts fragments per message and fails the connection with close code 1008 once the limit is reached. The default limit is 131072. The fix commit was authored upstream (Luigi Pinca) and is an ancestor of HEAD. HEAD contains no commit by a @cloudlinux.com or @tuxcare.com identity, so the fix is attributed ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:09:00.046186+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 does not affect version 8.10.2 of undici. not_affected \u2014 Not affected. undici 8.10.2 already contains the upstream hardening (commit c601fff1, \"fix(cache): harden cache directive parsing\"), which is in the upstream release. Empty or blank qualified `private` values collapse to `private: true`, and an existing `true` is never concatenated onto. I ran the parser on the CVE payloads and confirmed neither the shared-cache disclosure nor the TypeError cra...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "impact_statement": "not_affected \u2014 Not affected. undici 8.10.2 already contains the upstream hardening (commit c601fff1, \"fix(cache): harden cache directive parsing\"), which is in the upstream release. Empty or blank qualified `private` values collapse to `private: true`, and an existing `true` is never concatenated onto. I ran the parser on the CVE payloads and confirmed neither the shared-cache disclosure nor the TypeError cra..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:08:00.042663+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 does not affect version 8.10.2 of undici. not_affected \u2014 undici 8.10.2 already includes the upstream fix for CVE-2026-14643 (fixed in 8.9.0 and 7.29.0). parseCacheControlHeader in lib/util/cache.js trims OWS on both sides of '=' and parses qualified private/no-cache field lists correctly. Runtime tests with padded directives returned proper field-name arrays. The fix commits are upstream-authored and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "impact_statement": "not_affected \u2014 undici 8.10.2 already includes the upstream fix for CVE-2026-14643 (fixed in 8.9.0 and 7.29.0). parseCacheControlHeader in lib/util/cache.js trims OWS on both sides of '=' and parses qualified private/no-cache field lists correctly. Runtime tests with padded directives returned proper field-name arrays. The fix commits are upstream-authored and shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:05:06.156764+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 does not affect version 8.10.2 of undici. not_affected \u2014 Target undici 8.10.2 already contains the upstream fix (nodejs/undici 7d3cf924, \"fix: validate blob body content type\"). In lib/dispatcher/client-h1.js the blob-like body type is validated with util.isValidHeaderValue() before being pushed as content-type. HEAD has no TuxCare commits, so it is a plain upstream release and the fix shipped with it.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.10.2 already contains the upstream fix (nodejs/undici 7d3cf924, \"fix: validate blob body content type\"). In lib/dispatcher/client-h1.js the blob-like body type is validated with util.isValidHeaderValue() before being pushed as content-type. HEAD has no TuxCare commits, so it is a plain upstream release and the fix shipped with it."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:56:00.146677+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 does not affect version 8.10.2 of undici. not_affected \u2014 The target (undici 8.10.2) already rejects duplicate content-length headers regardless of name case. The fix is the upstream commit 74495c63a (Matteo Collina), which is listed in the patch URLs and shipped inside the upstream release that TuxCare onboarded. HEAD's only TuxCare commit is a tuxcare.yaml build-config commit, not a fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "impact_statement": "not_affected \u2014 The target (undici 8.10.2) already rejects duplicate content-length headers regardless of name case. The fix is the upstream commit 74495c63a (Matteo Collina), which is listed in the patch URLs and shipped inside the upstream release that TuxCare onboarded. HEAD's only TuxCare commit is a tuxcare.yaml build-config commit, not a fix."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 8.10.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:13:50.517753+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 does not affect version 8.10.2 of undici. not_affected \u2014 Target undici 8.10.2 already contains the upstream fix for CVE-2026-1527. Request construction validates the upgrade option with isValidHeaderValue, so CR/LF values are rejected before client-h1.js interpolates them into the request head. The fix is upstream commit 77594f92 (Matteo Collina), which is in the 8.10.2 release; HEAD has no TuxCare-domain commits.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.10.2 already contains the upstream fix for CVE-2026-1527. Request construction validates the upgrade option with isValidHeaderValue, so CR/LF values are rejected before client-h1.js interpolates them into the request head. The fix is upstream commit 77594f92 (Matteo Collina), which is in the 8.10.2 release; HEAD has no TuxCare-domain commits."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:05:00.053359+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 does not affect version 8.10.2 of undici. not_affected \u2014 undici 8.10.2 already contains the upstream fix for CVE-2026-1528. The 64-bit WebSocket payload-length handler in lib/web/websocket/receiver.js rejects any length with a non-zero upper 32 bits or a lower half above 2^31-1, and fails the connection with 1009. This is upstream commit 84235c62 (\"Fix websocket 64-bit length overflow\"), which is in the shipped 8.10.2 release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "impact_statement": "not_affected \u2014 undici 8.10.2 already contains the upstream fix for CVE-2026-1528. The 64-bit WebSocket payload-length handler in lib/web/websocket/receiver.js rejects any length with a non-zero upper 32 bits or a lower half above 2^31-1, and fails the connection with 1009. This is upstream commit 84235c62 (\"Fix websocket 64-bit length overflow\"), which is in the shipped 8.10.2 release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:04:00.059662+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 does not affect version 8.10.2 of undici. not_affected \u2014 Undici 8.10.2 already contains the upstream fix for CVE-2026-16728 (commit e11a68ed, 'fix(retry): reject partial content length mismatch'). The retry handler now rejects a 206 response whose Content-Length differs from the size implied by its Content-Range, so the stale-length scenario in the CVE cannot occur. The fix shipped in the upstream release. HEAD has no TuxCare-domain commits.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "impact_statement": "not_affected \u2014 Undici 8.10.2 already contains the upstream fix for CVE-2026-16728 (commit e11a68ed, 'fix(retry): reject partial content length mismatch'). The retry handler now rejects a 206 response whose Content-Length differs from the size implied by its Content-Range, so the stale-length scenario in the CVE cannot occur. The fix shipped in the upstream release. HEAD has no TuxCare-domain commits."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:06:00.086837+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 does not affect version 8.10.2 of undici. not_affected \u2014 undici 8.10.2 already contains the upstream fix (nodejs/undici 10d93fc3, \"harden cookie domain, path, and unparsed attribute validation\"), shipped in the upstream release (>= 8.9.0). validateCookieDomain enforces the RFC 1034 letter-digit-hyphen syntax, which rejects ';'. Each unparsed entry's key and value go through validateCookieName and validateCookieValue, which reject ';'. Neither injecti...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "impact_statement": "not_affected \u2014 undici 8.10.2 already contains the upstream fix (nodejs/undici 10d93fc3, \"harden cookie domain, path, and unparsed attribute validation\"), shipped in the upstream release (>= 8.9.0). validateCookieDomain enforces the RFC 1034 letter-digit-hyphen syntax, which rejects ';'. Each unparsed entry's key and value go through validateCookieName and validateCookieValue, which reject ';'. Neither injecti..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:57:00.077756+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 does not affect version 8.10.2 of undici. not_affected \u2014 The target (undici 8.10.2) already contains the upstream fix, nodejs/undici e905b5b8 \"fix(retry): settle exposed body on terminal failure\". When a non-retryable response arrives after the headers were already forwarded, RetryHandler now calls onResponseError, so the original body is errored instead of left pending. The fix is in the upstream release (by Matteo Collina), not a TuxCare backport, ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "impact_statement": "not_affected \u2014 The target (undici 8.10.2) already contains the upstream fix, nodejs/undici e905b5b8 \"fix(retry): settle exposed body on terminal failure\". When a non-retryable response arrives after the headers were already forwarded, RetryHandler now calls onResponseError, so the original body is errored instead of left pending. The fix is in the upstream release (by Matteo Collina), not a TuxCare backport, ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:04:00.118761+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 does not affect version 8.10.2 of undici. not_affected \u2014 undici 8.10.2 already contains the upstream fix for CVE-2026-18540 (commit 0160a719, \"validate resumed response framing\"), shipped in the upstream v8.10.2 release. lib/handler/retry-handler.js no longer resumes a response that wasn't range-resumable and validates every resumed response's Content-Range, ETag and length. The patch URLs could not be read as diffs, so the fix semantics were inferre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "impact_statement": "not_affected \u2014 undici 8.10.2 already contains the upstream fix for CVE-2026-18540 (commit 0160a719, \"validate resumed response framing\"), shipped in the upstream v8.10.2 release. lib/handler/retry-handler.js no longer resumes a response that wasn't range-resumable and validates every resumed response's Content-Range, ETag and length. The patch URLs could not be read as diffs, so the fix semantics were inferre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:07:23.036454+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 does not affect version 8.10.2 of undici. not_affected \u2014 Target is undici 8.10.2, which already contains the upstream fix 66e12816 (fix(websocket): reject unrequested subprotocols). The handshake check now fails the connection with code 1002 when no subprotocols were requested, instead of throwing a TypeError in the microtask.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.10.2, which already contains the upstream fix 66e12816 (fix(websocket): reject unrequested subprotocols). The handshake check now fails the connection with code 1002 when no subprotocols were requested, instead of throwing a TypeError in the microtask."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T21:44:51.271214+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 does not affect version 8.10.2 of undici. not_affected \u2014 undici 8.10.2 already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses with more than 5 Content-Encoding codings. The fix is upstream-authored and shipped in the upstream release, so there is no TuxCare attribution.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "impact_statement": "not_affected \u2014 undici 8.10.2 already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses with more than 5 Content-Encoding codings. The fix is upstream-authored and shipped in the upstream release, so there is no TuxCare attribution."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 8.10.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-14T01:45:00.097042+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 does not affect version 8.10.2 of undici. not_affected \u2014 The target (undici 8.10.2) already contains the upstream fix 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\"). The fix shipped in the upstream release, before any TuxCare commit. The deduplication handler streams chunks to waiting handlers and refuses late attachment once body data has started. It buffers only while a consumer is paused, and caps that buffer at maxBuffe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "impact_statement": "not_affected \u2014 The target (undici 8.10.2) already contains the upstream fix 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\"). The fix shipped in the upstream release, before any TuxCare commit. The deduplication handler streams chunks to waiting handlers and refuses late attachment once body data has started. It buffers only while a consumer is paused, and caps that buffer at maxBuffe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T19:59:00.044739+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 does not affect version 8.10.2 of undici. not_affected \u2014 undici 8.10.2 already contains the upstream fix for CVE-2026-6733 (GHSA-35p6-xmwp-9g52). The H1 client validates reused idle sockets before writing the next request, and it destroys the socket if response data arrives with no request in flight. Matteo Collina's upstream commit 6ea54ef8 shipped in the upstream release, so the verdict is not_affected, not an attributed TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "impact_statement": "not_affected \u2014 undici 8.10.2 already contains the upstream fix for CVE-2026-6733 (GHSA-35p6-xmwp-9g52). The H1 client validates reused idle sockets before writing the next request, and it destroys the socket if response data arrives with no request in flight. Matteo Collina's upstream commit 6ea54ef8 shipped in the upstream release, so the verdict is not_affected, not an attributed TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:10:29.841377+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 does not affect version 8.10.2 of undici. not_affected \u2014 Not affected. Socks5ProxyAgent in this target (undici 8.10.2) already keeps one Pool per origin, keyed by String(origin), and each Pool's connect function tunnels to that pool's own origin. The upstream fix commit a516f870 (companion 3805b8f8) is in HEAD's history. It shipped in the upstream release: HEAD has no TuxCare fix commit, only a tuxcare.yaml build-config commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "impact_statement": "not_affected \u2014 Not affected. Socks5ProxyAgent in this target (undici 8.10.2) already keeps one Pool per origin, keyed by String(origin), and each Pool's connect function tunnels to that pool's own origin. The upstream fix commit a516f870 (companion 3805b8f8) is in HEAD's history. It shipped in the upstream release: HEAD has no TuxCare fix commit, only a tuxcare.yaml build-config commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:49:50.518578+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 does not affect version 8.10.2 of undici. not_affected \u2014 Target undici 8.10.2 already contains the upstream fix for CVE-2026-84890. lib/interceptor/decompress.js accepts a maxSize option (default 64 MiB) and aborts with ResponseExceededMaxSizeError once decompressed output exceeds it. The fix commit 7aac7f12 was authored by Matteo Collina (upstream) and shipped in the v8.10.2 release, before any TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.10.2 already contains the upstream fix for CVE-2026-84890. lib/interceptor/decompress.js accepts a maxSize option (default 64 MiB) and aborts with ResponseExceededMaxSizeError once decompressed output exceeds it. The fix commit 7aac7f12 was authored by Matteo Collina (upstream) and shipped in the v8.10.2 release, before any TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:43:37.800265+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 does not affect version 8.10.2 of undici. not_affected \u2014 Target is undici 8.10.2, which is the first fixed release for this CVE. The upstream fix cb75bbb3 (\"fix(cache): do not cache Set-Cookie in shared caches\", hello@matteocollina.com) is an ancestor of HEAD. In shared mode the interceptor and handler refuse to store, revalidate against, or re-serve responses that carry Set-Cookie, so the pre-fix pattern is absent.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.10.2, which is the first fixed release for this CVE. The upstream fix cb75bbb3 (\"fix(cache): do not cache Set-Cookie in shared caches\", hello@matteocollina.com) is an ancestor of HEAD. In shared mode the interceptor and handler refuse to store, revalidate against, or re-serve responses that carry Set-Cookie, so the pre-fix pattern is absent."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:24:53.288104+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 does not affect version 8.10.2 of undici. not_affected \u2014 Target undici 8.10.2 already contains the upstream fix for CVE-2026-84947 (commit 6d583124, \"fix(interceptor/dump): abort oversized chunked responses\", by Matteo Collina). The commit is an ancestor of HEAD and ships in the upstream 8.10.2 release. HEAD has no TuxCare-domain commits. lib/interceptor/dump.js now throws RequestAbortedError when received bytes exceed maxSize, and no longer ends the...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.10.2 already contains the upstream fix for CVE-2026-84947 (commit 6d583124, \"fix(interceptor/dump): abort oversized chunked responses\", by Matteo Collina). The commit is an ancestor of HEAD and ships in the upstream 8.10.2 release. HEAD has no TuxCare-domain commits. lib/interceptor/dump.js now throws RequestAbortedError when received bytes exceed maxSize, and no longer ends the..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:41:41.011558+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 does not affect version 8.10.2 of undici. not_affected \u2014 Target undici 8.10.2 already contains the upstream fix. BalancedPool destructures `connect` and `tls` from the options before the JSON deepClone and re-attaches them afterwards, so function-valued TLS options such as `checkServerIdentity` reach each per-upstream Pool. The fix commit is 8f5868fb (author hello@matteocollina.com, an upstream author), and it is part of the upstream 8.10.2 release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.10.2 already contains the upstream fix. BalancedPool destructures `connect` and `tls` from the options before the JSON deepClone and re-attaches them afterwards, so function-valued TLS options such as `checkServerIdentity` reach each per-upstream Pool. The fix commit is 8f5868fb (author hello@matteocollina.com, an upstream author), and it is part of the upstream 8.10.2 release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:30:18.013446+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 does not affect version 8.10.2 of undici. not_affected \u2014 Target is undici 8.10.2, which already contains the upstream fix for CVE-2026-85008 (commit 2be07bf9, \"fix(cache): reject unsafe method response caching\"). The cache interceptor now skips store.get() for unsafe methods, and canCacheResponse() returns false for them, so no read or write happens. Invalidation on successful unsafe requests is preserved.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.10.2, which already contains the upstream fix for CVE-2026-85008 (commit 2be07bf9, \"fix(cache): reject unsafe method response caching\"). The cache interceptor now skips store.get() for unsafe methods, and canCacheResponse() returns false for them, so no read or write happens. Invalidation on successful unsafe requests is preserved."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:19:00.066324+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 does not affect version 8.10.2 of undici. not_affected \u2014 The target (undici 8.10.2) already contains the upstream fix for CVE-2026-85014 (GHSA-rx4f-c7p8-82vq). It is commit 662d0ea6, authored by Matteo Collina and an ancestor of HEAD. The unclean-close handler no longer calls abort() on the writable stream. It now calls #writableStreamController.error(error) on the retained controller, which returns no promise, so no unobserved rejection can occur.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "impact_statement": "not_affected \u2014 The target (undici 8.10.2) already contains the upstream fix for CVE-2026-85014 (GHSA-rx4f-c7p8-82vq). It is commit 662d0ea6, authored by Matteo Collina and an ancestor of HEAD. The unclean-close handler no longer calls abort() on the writable stream. It now calls #writableStreamController.error(error) on the retained controller, which returns no promise, so no unobserved rejection can occur."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:16:12.818073+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 does not affect version 8.10.2 of undici. not_affected \u2014 undici 8.10.2 already contains the upstream fix (nodejs/undici 4411a238, \"fix(websocket): destroy inflater after decompression limit\") in lib/web/websocket/permessage-deflate.js. After the size-limit callback, the code removes listeners and calls this.#inflate.destroy(), so a late Z_DATA_ERROR cannot fire with no listener. The fix is an upstream commit by hello@matteocollina.com that shipped in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "impact_statement": "not_affected \u2014 undici 8.10.2 already contains the upstream fix (nodejs/undici 4411a238, \"fix(websocket): destroy inflater after decompression limit\") in lib/web/websocket/permessage-deflate.js. After the size-limit callback, the code removes listeners and calls this.#inflate.destroy(), so a late Z_DATA_ERROR cannot fire with no listener. The fix is an upstream commit by hello@matteocollina.com that shipped in..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:42:09.185511+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 does not affect version 8.10.2 of undici. not_affected \u2014 Target is undici 8.10.2, which already contains the upstream fix commit caf6194d (fix(cache): isolate interceptor state by dispatcher origin) for CVE-2026-85152. Cache and dedup keys now derive from the authoritative dispatcher origin, and the interceptors bypass when no authoritative origin exists. The fix is upstream-authored and shipped in the release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.10.2, which already contains the upstream fix commit caf6194d (fix(cache): isolate interceptor state by dispatcher origin) for CVE-2026-85152. Cache and dedup keys now derive from the authoritative dispatcher origin, and the interceptors bypass when no authoritative origin exists. The fix is upstream-authored and shipped in the release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:08:00.152629+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 8.10.2 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-10-16T20:08:00.152629+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 affects version 8.10.2 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "action_statement": "Vulnerability CVE-2026-87029 affects version 8.10.2 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-14T01:59:09.013976+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 does not affect version 8.10.2 of undici. not_affected \u2014 Target undici 8.10.2 already contains the upstream fix for CVE-2026-9675. The WebSocket receiver rejects a frame once its length plus the bytes already buffered for the in-progress message exceeds maxPayloadSize. The fix commit b4c287b3 (Matteo Collina, upstream) is an ancestor of the first TuxCare commit, so it shipped in the upstream release. Companion commits 32dbf0b3 and c5ed7875 (Luigi Pin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.10.2 already contains the upstream fix for CVE-2026-9675. The WebSocket receiver rejects a frame once its length plus the bytes already buffered for the in-progress message exceeds maxPayloadSize. The fix commit b4c287b3 (Matteo Collina, upstream) is an ancestor of the first TuxCare commit, so it shipped in the upstream release. Companion commits 32dbf0b3 and c5ed7875 (Luigi Pin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:11:32.988243+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 does not affect version 8.10.2 of undici. not_affected \u2014 Target undici 8.10.2 already trims optional whitespace (spaces and tabs) from each qualified private/no-cache field name when parsing Cache-Control, so `private=\" authorization\"` or `no-cache=\"\\tauthorization\"` yields the canonical `authorization` entry and the shared-cache check rejects storage. The hardening shipped upstream in commit c601fff1 (author hello@matteocollina.com), which is in HEA...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.10.2 already trims optional whitespace (spaces and tabs) from each qualified private/no-cache field name when parsing Cache-Control, so `private=\" authorization\"` or `no-cache=\"\\tauthorization\"` yields the canonical `authorization` entry and the shared-cache check rejects storage. The hardening shipped upstream in commit c601fff1 (author hello@matteocollina.com), which is in HEA..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:02:00.043521+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 does not affect version 8.10.2 of undici. not_affected \u2014 undici 8.10.2 is not affected by CVE-2026-9679. The upstream fix, commit 5655ea43 by Matteo Collina, is already in the release this branch was built from. parseSetCookie in lib/web/cookies/parse.js no longer percent-decodes cookie values. The querystring unescape import is gone, and the value is returned as received. getCookies in lib/web/cookies/index.js never decoded values.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "impact_statement": "not_affected \u2014 undici 8.10.2 is not affected by CVE-2026-9679. The upstream fix, commit 5655ea43 by Matteo Collina, is already in the release this branch was built from. parseSetCookie in lib/web/cookies/parse.js no longer percent-decodes cookie values. The querystring unescape import is gone, and the value is returned as received. getCookies in lib/web/cookies/index.js never decoded values."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.10.2",
          "identifiers": {
            "purl": "pkg:npm/undici@8.10.2"
          }
        }
      ],
      "timestamp": "2026-11-13T20:17:00.069304+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 does not affect version 8.10.2 of undici. not_affected \u2014 undici 8.10.2 already contains the upstream fix for CVE-2026-9697. The fix is commit 42d4955987a1 (\"fix: honor requestTls when proxy is SOCKS5\"), authored by tonghuaroot@gmail.com and committed by hello@matteocollina.com. It is in the upstream release that TuxCare onboarded, so the target is not affected. ProxyAgent passes requestTls to Socks5ProxyAgent, which uses it for the TLS handshake over...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "impact_statement": "not_affected \u2014 undici 8.10.2 already contains the upstream fix for CVE-2026-9697. The fix is commit 42d4955987a1 (\"fix: honor requestTls when proxy is SOCKS5\"), authored by tonghuaroot@gmail.com and committed by hello@matteocollina.com. It is in the upstream release that TuxCare onboarded, so the target is not affected. ProxyAgent passes requestTls to Socks5ProxyAgent, which uses it for the TLS handshake over..."
    }
  ]
}