{
  "@id": "urn:uuid:3f8b69eb-5190-4fb1-8c5f-0d794956eff5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 48,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T04:05:00.045223+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31150 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31150"
      },
      "action_statement": "Vulnerability CVE-2022-31150 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-31151 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-31151"
      },
      "action_statement": "Vulnerability CVE-2022-31151 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:02:00.129046+00:00",
      "status_notes": "Vulnerability CVE-2022-32210 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-32210"
      },
      "action_statement": "Vulnerability CVE-2022-32210 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2022-35948 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35948"
      },
      "action_statement": "Vulnerability CVE-2022-35948 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2022-35949 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2022-35949"
      },
      "action_statement": "Vulnerability CVE-2022-35949 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-23936 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2023-23936"
      },
      "action_statement": "Vulnerability CVE-2023-23936 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2023-24807 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2023-24807"
      },
      "action_statement": "Vulnerability CVE-2023-24807 affects version 8.11.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T00:13:27.422359+00:00",
      "status_notes": "Vulnerability CVE-2023-45143 does not affect version 8.11.1 of undici. not_affected \u2014 Undici 8.11.1 already contains the CVE-2023-45143 fix from upstream commit e041de3. On a cross-origin redirect, fetch deletes cookie, authorization, proxy-authorization and host headers, and the dispatcher-level redirect handler strips the same credential headers. Both defenses shipped in the upstream release, so this is not_affected rather than a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45143"
      },
      "impact_statement": "not_affected \u2014 Undici 8.11.1 already contains the CVE-2023-45143 fix from upstream commit e041de3. On a cross-origin redirect, fetch deletes cookie, authorization, proxy-authorization and host headers, and the dispatcher-level redirect handler strips the same credential headers. Both defenses shipped in the upstream release, so this is not_affected rather than a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "action_statement": "Vulnerability CVE-2024-24750 affects version 8.11.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T22:28:00.036754+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 8.11.1 of undici. not_affected \u2014 undici 8.11.1 already strips Proxy-Authorization on cross-origin redirects, in both the fetch implementation and the dispatcher RedirectHandler. The upstream fix (b9da3e40, GHSA-3787-6prv-h9w3, Feb 2024) is an ancestor of HEAD, and HEAD has no TuxCare-domain commits.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.1 already strips Proxy-Authorization on cross-origin redirects, in both the fetch implementation and the dispatcher RedirectHandler. The upstream fix (b9da3e40, GHSA-3787-6prv-h9w3, Feb 2024) is an ancestor of HEAD, and HEAD has no TuxCare-domain commits."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T00:33:45.023269+00:00",
      "status_notes": "Vulnerability CVE-2024-30260 does not affect version 8.11.1 of undici. not_affected \u2014 Undici 8.11.1 already contains the upstream fix for CVE-2024-30260. The redirect handler strips authorization, cookie and proxy-authorization headers when a redirect crosses origins, for undici.request() and for every other dispatch path that uses the redirect handler. The fix commit 6805746 is an upstream commit by Matteo Collina and is an ancestor of HEAD. HEAD has no TuxCare-domain commits, ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30260"
      },
      "impact_statement": "not_affected \u2014 Undici 8.11.1 already contains the upstream fix for CVE-2024-30260. The redirect handler strips authorization, cookie and proxy-authorization headers when a redirect crosses origins, for undici.request() and for every other dispatch path that uses the redirect handler. The fix commit 6805746 is an upstream commit by Matteo Collina and is an ancestor of HEAD. HEAD has no TuxCare-domain commits, ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T23:48:00.073744+00:00",
      "status_notes": "Vulnerability CVE-2024-30261 does not affect version 8.11.1 of undici. not_affected \u2014 undici 8.11.1 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd). Fetch integrity checking selects the strongest-algorithm metadata and compares the full computed digest to the expected value exactly, so an empty, truncated or weak integrity value can't make a tampered response pass. The fix is an ancestor of HEAD and was authored upstream, not by TuxCare.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-30261"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.1 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd). Fetch integrity checking selects the strongest-algorithm metadata and compares the full computed digest to the expected value exactly, so an empty, truncated or weak integrity value can't make a tampered response pass. The fix is an ancestor of HEAD and was authored upstream, not by TuxCare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:00.085312+00:00",
      "status_notes": "Vulnerability CVE-2024-38372 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2024-38372"
      },
      "action_statement": "Vulnerability CVE-2024-38372 affects version 8.11.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T21:31:44.249794+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 does not affect version 8.11.1 of undici. not_affected \u2014 Target undici 8.11.1 already contains the upstream fix for CVE-2025-22150 (upstream commit c2d78cd1, authored by hello@matteocollina.com). The multipart boundary is generated with node:crypto randomInt rather than Math.random(). Math.random() remains only as a fallback when the 'crypto' runtime feature is unavailable, which does not apply to a Node.js build.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.11.1 already contains the upstream fix for CVE-2025-22150 (upstream commit c2d78cd1, authored by hello@matteocollina.com). The multipart boundary is generated with node:crypto randomInt rather than Math.random(). Math.random() remains only as a fallback when the 'crypto' runtime feature is unavailable, which does not apply to a Node.js build."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T21:41:43.943334+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 does not affect version 8.11.1 of undici. not_affected \u2014 Target is plain upstream undici 8.11.1. The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e, \"Removed clients with unrecoverable errors from the Pool\") is already in HEAD. Pool.connectionError now removes failed clients from the pool, so repeated connection failures (e.g. invalid certificate) no longer accumulate per-attempt state. Agent also closes unused pools on conn...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "impact_statement": "not_affected \u2014 Target is plain upstream undici 8.11.1. The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e, \"Removed clients with unrecoverable errors from the Pool\") is already in HEAD. Pool.connectionError now removes failed clients from the pool, so repeated connection failures (e.g. invalid certificate) no longer accumulate per-attempt state. Agent also closes unused pools on conn..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-10-16T20:22:00.069315+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-10-16T20:22:00.069315+00:00",
      "status_notes": "Vulnerability CVE-2026-109829 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109829"
      },
      "action_statement": "Vulnerability CVE-2026-109829 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-10-16T20:23:00.084126+00:00",
      "status_notes": "Vulnerability CVE-2026-109841 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109841"
      },
      "action_statement": "Vulnerability CVE-2026-109841 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-10-15T15:20:03.549917+00:00",
      "status_notes": "Vulnerability CVE-2026-109855 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109855"
      },
      "action_statement": "Vulnerability CVE-2026-109855 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-10-16T20:22:00.069315+00:00",
      "status_notes": "Vulnerability CVE-2026-109869 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109869"
      },
      "action_statement": "Vulnerability CVE-2026-109869 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-10-16T20:22:00.069315+00:00",
      "status_notes": "Vulnerability CVE-2026-109924 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109924"
      },
      "action_statement": "Vulnerability CVE-2026-109924 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-10-16T20:08:00.152629+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 8.11.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T03:29:00.140939+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 does not affect version 8.11.1 of undici. not_affected \u2014 Target undici 8.11.1 already contains the upstream fix for CVE-2026-11525 (fixed in 8.5.0). The SameSite parser in lib/web/cookies/parse.js uses exact case-insensitive equality against none/strict/lax, with no substring matching. The fix, upstream commit 5655ea43 by Matteo Collina, is in the upstream release and not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.11.1 already contains the upstream fix for CVE-2026-11525 (fixed in 8.5.0). The SameSite parser in lib/web/cookies/parse.js uses exact case-insensitive equality against none/strict/lax, with no substring matching. The fix, upstream commit 5655ea43 by Matteo Collina, is in the upstream release and not a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-116592 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116592"
      },
      "action_statement": "Vulnerability CVE-2026-116592 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:20:57.098620+00:00",
      "status_notes": "Vulnerability CVE-2026-116630 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-116630"
      },
      "action_statement": "Vulnerability CVE-2026-116630 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120222 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120222"
      },
      "action_statement": "Vulnerability CVE-2026-120222 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120415 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120415"
      },
      "action_statement": "Vulnerability CVE-2026-120415 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:14:00.096681+00:00",
      "status_notes": "Vulnerability CVE-2026-120423 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120423"
      },
      "action_statement": "Vulnerability CVE-2026-120423 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:06:35.912230+00:00",
      "status_notes": "Vulnerability CVE-2026-120474 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-120474"
      },
      "action_statement": "Vulnerability CVE-2026-120474 affects version 8.11.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T03:50:05.160189+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 does not affect version 8.11.1 of undici. not_affected \u2014 Target undici 8.11.1 already contains the upstream fix for CVE-2026-12151, which is a cap on the number of fragments per WebSocket message. Upstream commit 32dbf0b3 (\"websocket: limit the number of fragments in a message\") is an ancestor of HEAD and shipped in the upstream release, so this is an upstream fix. The Receiver rejects a message with close code 1008 once its fragment count reaches ma...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.11.1 already contains the upstream fix for CVE-2026-12151, which is a cap on the number of fragments per WebSocket message. Upstream commit 32dbf0b3 (\"websocket: limit the number of fragments in a message\") is an ancestor of HEAD and shipped in the upstream release, so this is an upstream fix. The Receiver rejects a message with close code 1008 once its fragment count reaches ma..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T03:44:00.034447+00:00",
      "status_notes": "Vulnerability CVE-2026-13697 does not affect version 8.11.1 of undici. not_affected \u2014 undici 8.11.1 already contains the upstream fix for CVE-2026-13697. lib/util/cache.js has the fix: an empty or invalid qualified private list becomes `true`, and an existing `true` is never concat-ed. Fix commit 4fe5bc5f (Matteo Collina, upstream) is an ancestor of HEAD. HEAD has no TuxCare-domain commits, so the fix shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-13697"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.1 already contains the upstream fix for CVE-2026-13697. lib/util/cache.js has the fix: an empty or invalid qualified private list becomes `true`, and an existing `true` is never concat-ed. Fix commit 4fe5bc5f (Matteo Collina, upstream) is an ancestor of HEAD. HEAD has no TuxCare-domain commits, so the fix shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T04:04:00.074738+00:00",
      "status_notes": "Vulnerability CVE-2026-14643 does not affect version 8.11.1 of undici. not_affected \u2014 Target undici 8.11.1 already contains the upstream fix for CVE-2026-14643. parseCacheControlHeader in lib/util/cache.js trims optional whitespace around '=' and strips the quotes from qualified no-cache/private field lists. Padded directives parse to proper field-name arrays. The fix shipped in the upstream release (no TuxCare commit in history), so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-14643"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.11.1 already contains the upstream fix for CVE-2026-14643. parseCacheControlHeader in lib/util/cache.js trims optional whitespace around '=' and strips the quotes from qualified no-cache/private field lists. Padded directives parse to proper field-name arrays. The fix shipped in the upstream release (no TuxCare commit in history), so the verdict is not_affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T03:50:29.950665+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 does not affect version 8.11.1 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2026-15157 (nodejs/undici commit 7d3cf924, \"fix: validate blob body content type\", by Matteo Collina) is already in the 8.11.1 release this target is built from. The blob-like body branch in lib/dispatcher/client-h1.js now runs isValidHeaderValue() on body.type and rejects invalid values, so the pre-fix unvalidated push is gone.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2026-15157 (nodejs/undici commit 7d3cf924, \"fix: validate blob body content type\", by Matteo Collina) is already in the 8.11.1 release this target is built from. The blob-like body branch in lib/dispatcher/client-h1.js now runs isValidHeaderValue() on body.type and rejects invalid values, so the pre-fix unvalidated push is gone."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T21:55:34.449898+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 does not affect version 8.11.1 of undici. not_affected \u2014 Target undici 8.11.1 already contains the upstream fix for CVE-2026-1525 (commit 74495c63, \"reject duplicate content-length and host headers\", authored by Matteo Collina). HEAD has no TuxCare commit in its history, so the fix shipped in the upstream release. Case-variant duplicate Content-Length headers in an array are rejected in Request construction before reaching the wire.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.11.1 already contains the upstream fix for CVE-2026-1525 (commit 74495c63, \"reject duplicate content-length and host headers\", authored by Matteo Collina). HEAD has no TuxCare commit in its history, so the fix shipped in the upstream release. Case-variant duplicate Content-Length headers in an array are rejected in Request construction before reaching the wire."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 8.11.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T22:14:17.313956+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 does not affect version 8.11.1 of undici. not_affected \u2014 undici 8.11.1 already contains the upstream fix for CVE-2026-1527. Request's constructor rejects an `upgrade` value containing CR/LF with InvalidArgumentError before it reaches the HTTP/1 serializer. The fix is upstream commit 77594f92 (\"fix: validate upgrade header to prevent CRLF injection\"), which is an ancestor of HEAD. HEAD has no commit by a TuxCare allowlisted author or committer.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.1 already contains the upstream fix for CVE-2026-1527. Request's constructor rejects an `upgrade` value containing CR/LF with InvalidArgumentError before it reaches the HTTP/1 serializer. The fix is upstream commit 77594f92 (\"fix: validate upgrade header to prevent CRLF injection\"), which is an ancestor of HEAD. HEAD has no commit by a TuxCare allowlisted author or committer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T22:06:40.895438+00:00",
      "status_notes": "Vulnerability CVE-2026-1528 does not affect version 8.11.1 of undici. not_affected \u2014 undici 8.11.1 already contains the upstream fix for CVE-2026-1528. In lib/web/websocket/receiver.js, the PAYLOADLENGTH_64 state rejects any 64-bit length whose upper 32 bits are non-zero, or whose lower 32 bits exceed 2^31-1. It closes the connection with code 1009 instead of continuing to parse. The fix shipped in the upstream release, so this is not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1528"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.1 already contains the upstream fix for CVE-2026-1528. In lib/web/websocket/receiver.js, the PAYLOADLENGTH_64 state rejects any 64-bit length whose upper 32 bits are non-zero, or whose lower 32 bits exceed 2^31-1. It closes the connection with code 1009 instead of continuing to parse. The fix shipped in the upstream release, so this is not a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T03:58:35.229113+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 does not affect version 8.11.1 of undici. not_affected \u2014 Target undici 8.11.1 already contains the upstream fix (nodejs/undici e11a68ed, \"fix(retry): reject partial content length mismatch\"), which shipped in the upstream release. The retry handler rejects a 206 response whose Content-Length differs from its Content-Range span, so the stale-Content-Length scenario cannot occur. No TuxCare-authored commit is involved.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.11.1 already contains the upstream fix (nodejs/undici e11a68ed, \"fix(retry): reject partial content length mismatch\"), which shipped in the upstream release. The retry handler rejects a 206 response whose Content-Length differs from its Content-Range span, so the stale-Content-Length scenario cannot occur. No TuxCare-authored commit is involved."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T03:52:00.030063+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 does not affect version 8.11.1 of undici. not_affected \u2014 undici 8.11.1 already contains the upstream fix (nodejs/undici 10d93fc3, \"harden cookie domain, path, and unparsed attribute validation\"). validateCookieDomain enforces the RFC 1034 letter-digit-hyphen syntax, so ';' is rejected. The unparsed entries are validated with validateCookieName and validateCookieValue, which both reject ';'. The fix shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.1 already contains the upstream fix (nodejs/undici 10d93fc3, \"harden cookie domain, path, and unparsed attribute validation\"). validateCookieDomain enforces the RFC 1034 letter-digit-hyphen syntax, so ';' is rejected. The unparsed entries are validated with validateCookieName and validateCookieValue, which both reject ';'. The fix shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T20:58:00.045389+00:00",
      "status_notes": "Vulnerability CVE-2026-18149 does not affect version 8.11.1 of undici. not_affected \u2014 Target undici 8.11.1 already contains the upstream fix for CVE-2026-18149 (commit e905b5b8 \"fix(retry): settle exposed body on terminal failure\" by Matteo Collina). RetryHandler now propagates an error to the downstream handler instead of forwarding a second non-retryable response when headers were already sent. The fix shipped in the upstream release, before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18149"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.11.1 already contains the upstream fix for CVE-2026-18149 (commit e905b5b8 \"fix(retry): settle exposed body on terminal failure\" by Matteo Collina). RetryHandler now propagates an error to the downstream handler instead of forwarding a second non-retryable response when headers were already sent. The fix shipped in the upstream release, before the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T21:01:00.087381+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 does not affect version 8.11.1 of undici. not_affected \u2014 undici 8.11.1 already contains the upstream fix 0160a719 (\"fix(retry): validate resumed response framing\"), which is one of the three patch URLs. It was shipped in the upstream release (8.10.2 and later) and is an ancestor of HEAD. The retry handler now validates a resumed response against the original framing, so resumed bytes can't be appended beyond the declared Content-Length.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.1 already contains the upstream fix 0160a719 (\"fix(retry): validate resumed response framing\"), which is one of the three patch URLs. It was shipped in the upstream release (8.10.2 and later) and is an ancestor of HEAD. The retry handler now validates a resumed response against the original framing, so resumed bytes can't be appended beyond the declared Content-Length."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T21:05:00.124252+00:00",
      "status_notes": "Vulnerability CVE-2026-19534 does not affect version 8.11.1 of undici. not_affected \u2014 undici 8.11.1 already contains the upstream fix for CVE-2026-19534 (commit 66e12816, \"fix(websocket): reject unrequested subprotocols\"). The handshake handler now fails the connection with a 1002 close instead of raising an unhandled TypeError when the server sends an unrequested Sec-WebSocket-Protocol. The fix shipped in the upstream release, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-19534"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.1 already contains the upstream fix for CVE-2026-19534 (commit 66e12816, \"fix(websocket): reject unrequested subprotocols\"). The handshake handler now fails the connection with a 1002 close instead of raising an unhandled TypeError when the server sends an unrequested Sec-WebSocket-Protocol. The fix shipped in the upstream release, so the verdict is not_affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T21:47:00.051716+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 does not affect version 8.11.1 of undici. not_affected \u2014 Undici 8.11.1 already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses whose Content-Encoding lists more than 5 codings. The fix is upstream commit b04e3cbb (author hello@matteocollina.com), which is an ancestor of HEAD. HEAD's history has no commit with a @cloudlinux.com or @tuxcare.com address, so this is an upstream fix and not a TuxC...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "impact_statement": "not_affected \u2014 Undici 8.11.1 already contains the upstream fix for CVE-2026-22036. Both fetch() and the decompress interceptor reject responses whose Content-Encoding lists more than 5 codings. The fix is upstream commit b04e3cbb (author hello@matteocollina.com), which is an ancestor of HEAD. HEAD's history has no commit with a @cloudlinux.com or @tuxcare.com address, so this is an upstream fix and not a TuxC..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:03:43.285238+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 8.11.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T01:48:23.776675+00:00",
      "status_notes": "Vulnerability CVE-2026-2581 does not affect version 8.11.1 of undici. not_affected \u2014 undici 8.11.1 already contains the upstream fix (commit 5890c7b7, \"fix(deduplicate): stream response chunks to waiting handlers\"). The deduplication handler forwards chunks as they arrive and refuses late attachment once body data has started. Per-waiter buffering happens only while a consumer is paused, and it is capped by maxBufferSize. The fix shipped in the upstream release, so the verdict ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2581"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.1 already contains the upstream fix (commit 5890c7b7, \"fix(deduplicate): stream response chunks to waiting handlers\"). The deduplication handler forwards chunks as they arrive and refuses late attachment once body data has started. Per-waiter buffering happens only while a consumer is paused, and it is capped by maxBufferSize. The fix shipped in the upstream release, so the verdict ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T04:04:00.074738+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 does not affect version 8.11.1 of undici. not_affected \u2014 Target is undici 8.11.1, which is past the upstream fix release 8.5.0. The upstream fix for CVE-2026-6733 is already in HEAD: idle-socket validation plus rejection of responses when no request is running. Upstream-authored, shipped in the upstream release, so not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.11.1, which is past the upstream fix release 8.5.0. The upstream fix for CVE-2026-6733 is already in HEAD: idle-socket validation plus rejection of responses when no request is running. Upstream-authored, shipped in the upstream release, so not_affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T04:05:00.045223+00:00",
      "status_notes": "Vulnerability CVE-2026-6734 does not affect version 8.11.1 of undici. not_affected \u2014 undici 8.11.1 already contains the upstream fix for CVE-2026-6734. Socks5ProxyAgent keeps one Pool per origin, in a Map keyed by String(origin), and no single pool is shared across origins. The fix commit a516f870 is an ancestor of HEAD and is authored upstream (DeepView Autofix), so this is an upstream fix shipped in the release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6734"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.1 already contains the upstream fix for CVE-2026-6734. Socks5ProxyAgent keeps one Pool per origin, in a Map keyed by String(origin), and no single pool is shared across origins. The fix commit a516f870 is an ancestor of HEAD and is authored upstream (DeepView Autofix), so this is an upstream fix shipped in the release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T20:51:19.498372+00:00",
      "status_notes": "Vulnerability CVE-2026-84890 does not affect version 8.11.1 of undici. not_affected \u2014 The upstream fix for CVE-2026-84890 (commit 7aac7f12, \"fix(decompress): limit decompressed response size\", by Matteo Collina) is already in HEAD, and v8.11.1 shipped it. lib/interceptor/decompress.js has the maxSize option, a cumulative decompressed-byte check, per-stage limiters for chained encodings, and ResponseExceededMaxSizeError. A later upstream commit (19901d8b) changed the default from...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84890"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-84890 (commit 7aac7f12, \"fix(decompress): limit decompressed response size\", by Matteo Collina) is already in HEAD, and v8.11.1 shipped it. lib/interceptor/decompress.js has the maxSize option, a cumulative decompressed-byte check, per-stage limiters for chained encodings, and ResponseExceededMaxSizeError. A later upstream commit (19901d8b) changed the default from..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T20:43:37.800265+00:00",
      "status_notes": "Vulnerability CVE-2026-84933 does not affect version 8.11.1 of undici. not_affected \u2014 undici 8.11.1 already contains the upstream fix (commit cb75bbb3, \"fix(cache): do not cache Set-Cookie in shared caches\"). In shared mode, responses with Set-Cookie are not stored. Existing stored entries with Set-Cookie are evicted on read, and revalidation responses carrying Set-Cookie disallow cached reuse. The fix shipped in the upstream release, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84933"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.1 already contains the upstream fix (commit cb75bbb3, \"fix(cache): do not cache Set-Cookie in shared caches\"). In shared mode, responses with Set-Cookie are not stored. Existing stored entries with Set-Cookie are evicted on read, and revalidation responses carrying Set-Cookie disallow cached reuse. The fix shipped in the upstream release, so the verdict is not_affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T20:23:23.689292+00:00",
      "status_notes": "Vulnerability CVE-2026-84947 does not affect version 8.11.1 of undici. not_affected \u2014 Target undici 8.11.1 already contains the upstream fix (commit 6d583124, \"fix(interceptor/dump): abort oversized chunked responses\"), which shipped in the upstream release. DumpHandler.onResponseData now throws RequestAbortedError once the received size exceeds maxSize, so no truncated 200 is returned.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84947"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.11.1 already contains the upstream fix (commit 6d583124, \"fix(interceptor/dump): abort oversized chunked responses\"), which shipped in the upstream release. DumpHandler.onResponseData now throws RequestAbortedError once the received size exceeds maxSize, so no truncated 200 is returned."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T20:41:41.011558+00:00",
      "status_notes": "Vulnerability CVE-2026-84961 does not affect version 8.11.1 of undici. not_affected \u2014 The target (undici 8.11.1) already contains the upstream fix. BalancedPool's constructor destructures `connect` and `tls` before the JSON-based deep clone and re-attaches them afterwards, so function-valued options such as `checkServerIdentity` and custom connectors reach each upstream Pool. The fix commit is upstream-authored (Matteo Collina) and shipped in the upstream release before any TuxC...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84961"
      },
      "impact_statement": "not_affected \u2014 The target (undici 8.11.1) already contains the upstream fix. BalancedPool's constructor destructures `connect` and `tls` before the JSON-based deep clone and re-attaches them afterwards, so function-valued options such as `checkServerIdentity` and custom connectors reach each upstream Pool. The fix commit is upstream-authored (Matteo Collina) and shipped in the upstream release before any TuxC..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T20:33:00.084290+00:00",
      "status_notes": "Vulnerability CVE-2026-85008 does not affect version 8.11.1 of undici. not_affected \u2014 undici 8.11.1 already contains the upstream fix for CVE-2026-85008 (nodejs/undici commit 2be07bf9, \"fix(cache): reject unsafe method response caching\"). That commit is an ancestor of the v8.11.1 release commit. Unsafe methods are not looked up in the store, canCacheResponse rejects them, and successful unsafe responses only invalidate cache entries.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85008"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.1 already contains the upstream fix for CVE-2026-85008 (nodejs/undici commit 2be07bf9, \"fix(cache): reject unsafe method response caching\"). That commit is an ancestor of the v8.11.1 release commit. Unsafe methods are not looked up in the store, canCacheResponse rejects them, and successful unsafe responses only invalidate cache entries."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T20:22:41.158320+00:00",
      "status_notes": "Vulnerability CVE-2026-85014 does not affect version 8.11.1 of undici. not_affected \u2014 The upstream fix for CVE-2026-85014 (commit 662d0ea6) is already in the shipped 8.11.1 tree. #onSocketClose in WebSocketStream no longer calls abort() on the possibly-locked writable stream. It errors the stream through a retained WritableStreamDefaultController instead, so no unobserved rejected promise is created. The fix author is upstream, and HEAD has no TuxCare-domain commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85014"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-85014 (commit 662d0ea6) is already in the shipped 8.11.1 tree. #onSocketClose in WebSocketStream no longer calls abort() on the possibly-locked writable stream. It errors the stream through a retained WritableStreamDefaultController instead, so no unobserved rejected promise is created. The fix author is upstream, and HEAD has no TuxCare-domain commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T02:19:53.022319+00:00",
      "status_notes": "Vulnerability CVE-2026-85024 does not affect version 8.11.1 of undici. not_affected \u2014 Not affected. The permessage-deflate size-limit path in lib/web/websocket/permessage-deflate.js already contains the upstream fix, upstream commit 4411a238 \"destroy inflater after decompression limit\". That commit is in the upstream v8.11.1 release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85024"
      },
      "impact_statement": "not_affected \u2014 Not affected. The permessage-deflate size-limit path in lib/web/websocket/permessage-deflate.js already contains the upstream fix, upstream commit 4411a238 \"destroy inflater after decompression limit\". That commit is in the upstream v8.11.1 release that TuxCare onboarded."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T02:42:09.185511+00:00",
      "status_notes": "Vulnerability CVE-2026-85152 does not affect version 8.11.1 of undici. not_affected \u2014 Target is undici 8.11.1, which already includes the upstream fix caf6194d (fix(cache): isolate interceptor state by dispatcher origin, released in 8.10.2). Cache and dedup keys include the actual destination origin, and requests are not cached or deduplicated when no authoritative origin exists.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-85152"
      },
      "impact_statement": "not_affected \u2014 Target is undici 8.11.1, which already includes the upstream fix caf6194d (fix(cache): isolate interceptor state by dispatcher origin, released in 8.10.2). Cache and dedup keys include the actual destination origin, and requests are not cached or deduplicated when no authoritative origin exists."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-10-16T20:08:00.152629+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 8.11.1 of undici."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-10-16T20:08:00.152629+00:00",
      "status_notes": "Vulnerability CVE-2026-87029 affects version 8.11.1 of undici.",
      "vulnerability": {
        "name": "CVE-2026-87029"
      },
      "action_statement": "Vulnerability CVE-2026-87029 affects version 8.11.1 of undici."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T01:59:22.635915+00:00",
      "status_notes": "Vulnerability CVE-2026-9675 does not affect version 8.11.1 of undici. not_affected \u2014 undici 8.11.1 already contains the upstream fix b4c287b (enforce max payload size across fragments). The receiver adds the bytes already buffered for earlier fragments to each new frame's payload length before comparing against maxPayloadSize. The fix shipped in the upstream release, so this is not_affected, not already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9675"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.1 already contains the upstream fix b4c287b (enforce max payload size across fragments). The receiver adds the bytes already buffered for earlier fragments to each new frame's payload length before comparing against maxPayloadSize. The fix shipped in the upstream release, so this is not_affected, not already_fixed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T20:14:00.045604+00:00",
      "status_notes": "Vulnerability CVE-2026-9678 does not affect version 8.11.1 of undici. not_affected \u2014 undici 8.11.1 is not affected by CVE-2026-9678. The Cache-Control parser trims optional whitespace (spaces and tabs) from every qualified private/no-cache field name before storing it, so the later comparison against 'authorization' in the store-eligibility check matches. The code that does this shipped in the upstream release and was not added by TuxCare.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9678"
      },
      "impact_statement": "not_affected \u2014 undici 8.11.1 is not affected by CVE-2026-9678. The Cache-Control parser trims optional whitespace (spaces and tabs) from every qualified private/no-cache field name before storing it, so the later comparison against 'authorization' in the store-eligibility check matches. The code that does this shipped in the upstream release and was not added by TuxCare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-14T03:30:12.116884+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 does not affect version 8.11.1 of undici. not_affected \u2014 Target undici 8.11.1 is not vulnerable. parseSetCookie in lib/web/cookies/parse.js does not percent-decode cookie values; the value is returned as the raw trimmed string. The upstream fix 5655ea43 (\"fix(cookies): preserve values and parse SameSite strictly\", by Matteo Collina) is an ancestor of HEAD and was already in the upstream release before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.11.1 is not vulnerable. parseSetCookie in lib/web/cookies/parse.js does not percent-decode cookie values; the value is returned as the raw trimmed string. The upstream fix 5655ea43 (\"fix(cookies): preserve values and parse SameSite strictly\", by Matteo Collina) is an ancestor of HEAD and was already in the upstream release before the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici@8.11.1",
          "identifiers": {
            "purl": "pkg:npm/undici@8.11.1"
          }
        }
      ],
      "timestamp": "2026-11-13T20:14:00.045604+00:00",
      "status_notes": "Vulnerability CVE-2026-9697 does not affect version 8.11.1 of undici. not_affected \u2014 Target undici 8.11.1 already contains the upstream fix for CVE-2026-9697 (commit 42d49559, \"fix: honor requestTls when proxy is SOCKS5\"). ProxyAgent passes requestTls to Socks5ProxyAgent, which applies it to tls.connect when upgrading the SOCKS5 tunnel. The fix is upstream-authored and shipped in the upstream release, with no TuxCare commit before it.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9697"
      },
      "impact_statement": "not_affected \u2014 Target undici 8.11.1 already contains the upstream fix for CVE-2026-9697 (commit 42d49559, \"fix: honor requestTls when proxy is SOCKS5\"). ProxyAgent passes requestTls to Socks5ProxyAgent, which applies it to tls.connect when upgrading the SOCKS5 tunnel. The fix is upstream-authored and shipped in the upstream release, with no TuxCare commit before it."
    }
  ]
}