{ "@id": "urn:uuid:aef0bc53-325b-41fa-a241-0041bd66ea2e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 36, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T03:11:00.049756+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-14T00:06:08.584527+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 8.3.0 of undici. not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2023-45143 (commit e041de35). Both the fetch redirect path and the dispatcher redirect handler strip the Cookie header on cross-origin redirects. The fix shipped in the upstream release, not through a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2023-45143 (commit e041de35). Both the fetch redirect path and the dispatcher redirect handler strip the Cookie header on cross-origin redirects. The fix shipped in the upstream release, not through a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T22:22:49.594925+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 8.3.0 of undici. not_affected \u2014 Target undici 8.3.0 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The fix came from the upstream release (merge b9da3e40, GHSA-3787-6prv-h9w3, by Matteo Collina). HEAD contains no commits from an allowlisted TuxCare/CloudLinux domain, so the verdict is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Target undici 8.3.0 already strips Proxy-Authorization on cross-origin redirects, in both the fetch path and the dispatcher RedirectHandler. The fix came from the upstream release (merge b9da3e40, GHSA-3787-6prv-h9w3, by Matteo Collina). HEAD contains no commits from an allowlisted TuxCare/CloudLinux domain, so the verdict is not_affected rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-14T00:31:07.366708+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 8.3.0 of undici. not_affected \u2014 Target is undici 8.3.0, far newer than the 5.28.4 / 6.11.1 fixed releases. lib/handler/redirect-handler.js strips authorization, cookie and proxy-authorization headers whenever a redirect changes origin. This is the upstream fix for CVE-2024-30260, and it shipped in the upstream release before any TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 Target is undici 8.3.0, far newer than the 5.28.4 / 6.11.1 fixed releases. lib/handler/redirect-handler.js strips authorization, cookie and proxy-authorization headers whenever a redirect changes origin. This is the upstream fix for CVE-2024-30260, and it shipped in the upstream release before any TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T23:34:14.677808+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 8.3.0 of undici. not_affected \u2014 Target undici 8.3.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd, authored by Matteo Collina). The commit is an ancestor of HEAD. The SRI integrity check now follows the spec: it keeps only the strongest-algorithm entries and compares the body against them. No TuxCare-authored commit exists in HEAD's history, so this is an upstream fix and not a Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Target undici 8.3.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672, commit d542b8cd, authored by Matteo Collina). The commit is an ancestor of HEAD. The SRI integrity check now follows the spec: it keeps only the strongest-algorithm entries and compares the body against them. No TuxCare-authored commit exists in HEAD's history, so this is an upstream fix and not a Tux..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T21:31:00.047911+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 8.3.0 of undici. not_affected \u2014 undici 8.3.0 is not affected by CVE-2025-22150. The multipart boundary no longer comes from Math.random() when node:crypto is available. lib/web/fetch/formdata.js uses crypto.randomInt, and the upstream fix commit c2d78cd1 (author hello@matteocollina.com, Matteo Collina) is an ancestor of HEAD. It was already in the upstream release before the first TuxCare commit, so this is an upstream fix an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 undici 8.3.0 is not affected by CVE-2025-22150. The multipart boundary no longer comes from Math.random() when node:crypto is available. lib/web/fetch/formdata.js uses crypto.randomInt, and the upstream fix commit c2d78cd1 (author hello@matteocollina.com, Matteo Collina) is an ancestor of HEAD. It was already in the upstream release before the first TuxCare commit, so this is an upstream fix an..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T21:37:00.197268+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 8.3.0 of undici. not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool registers a 'connectionError' handler that splices failed clients out of the pool's client list, so failed-certificate clients are not retained. The fix shipped in the upstream release the target is built from, and it is not a TuxCare-authored commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool registers a 'connectionError' handler that splices failed clients out of the pool's client list, so failed-certificate clients are not retained. The fix shipped in the upstream release the target is built from, and it is not a TuxCare-authored commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T18:47:21.529900+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-14T03:11:00.049756+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 8.3.0 of undici. not_affected \u2014 The target (undici 8.3.0 tuxcare build) has HTTP/2 websocket (RFC 8441) support, but the 8.11.0 regression is absent. When handshake validation fails, the abort is effective, not a no-op: request.completed is never set on the upgrade path, so abort() reaches stream.close(). The orphaned-stream-without-error-listener condition from the CVE does not arise through the described chain. The patch di...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 The target (undici 8.3.0 tuxcare build) has HTTP/2 websocket (RFC 8441) support, but the 8.11.0 regression is absent. When handshake validation fails, the abort is effective, not a no-op: request.completed is never set on the upgrade path, so abort() reaches stream.close(). The orphaned-stream-without-error-listener condition from the CVE does not arise through the described chain. The patch di..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T18:29:00.261196+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T18:34:00.250279+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T21:36:16.074202+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-11525 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-11525" }, "action_statement": "Vulnerability CVE-2026-11525 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-06T10:20:26.750713+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12151 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-12151" }, "action_statement": "Vulnerability CVE-2026-12151 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-14643 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-14643" }, "action_statement": "Vulnerability CVE-2026-14643 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T21:51:37.743034+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 8.3.0 of undici. not_affected \u2014 Not affected. undici 8.3.0 already contains the upstream fix (commit 74495c63, Matteo Collina, \"reject duplicate content-length and host headers\"). processHeader() lowercases the header name and throws on a second content-length header, so case-variant duplicates in array-form headers cannot reach the wire.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 Not affected. undici 8.3.0 already contains the upstream fix (commit 74495c63, Matteo Collina, \"reject duplicate content-length and host headers\"). processHeader() lowercases the header name and throws on a second content-length header, so case-variant duplicates in array-form headers cannot reach the wire." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T22:10:09.898362+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 8.3.0 of undici. not_affected \u2014 Target undici 8.3.0 already contains the upstream fix for CVE-2026-1527. Request construction rejects any `upgrade` value containing CR/LF or other invalid header characters before it reaches the socket writer in client-h1.js. The fix is upstream commit 77594f92 (author hello@matteocollina.com), which is an ancestor of HEAD. HEAD has no TuxCare commits in its history, so this is a plain upstrea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 Target undici 8.3.0 already contains the upstream fix for CVE-2026-1527. Request construction rejects any `upgrade` value containing CR/LF or other invalid header characters before it reaches the socket writer in client-h1.js. The fix is upstream commit 77594f92 (author hello@matteocollina.com), which is an ancestor of HEAD. HEAD has no TuxCare commits in its history, so this is a plain upstrea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T22:01:22.274965+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 8.3.0 of undici. not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2026-1528 (upstream commit 84235c62, \"Fix websocket 64-bit length overflow\"). The 64-bit length branch of the WebSocket frame parser rejects any length whose upper 32 bits are non-zero or whose lower 32 bits exceed 2^31-1, and fails the connection with close code 1009. The fix shipped in the upstream release and is not TuxCare-attributed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2026-1528 (upstream commit 84235c62, \"Fix websocket 64-bit length overflow\"). The 64-bit length branch of the WebSocket frame parser rejects any length whose upper 32 bits are non-zero or whose lower 32 bits exceed 2^31-1, and fails the connection with close code 1009. The fix shipped in the upstream release and is not TuxCare-attributed." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T21:44:27.229058+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 8.3.0 of undici. not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2026-22036. Both the fetch() response path and the decompress interceptor reject a Content-Encoding chain longer than 5 before any decoder is built. The fix, upstream commit b04e3cbb, shipped in the upstream release. No TuxCare-domain commit exists in HEAD's history.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 undici 8.3.0 already contains the upstream fix for CVE-2026-22036. Both the fetch() response path and the decompress interceptor reject a Content-Encoding chain longer than 5 before any decoder is built. The fix, upstream commit b04e3cbb, shipped in the upstream release. No TuxCare-domain commit exists in HEAD's history." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-14T01:38:00.597373+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 8.3.0 of undici. not_affected \u2014 Undici 8.3.0 already contains the upstream fix for CVE-2026-2581 (commit 5890c7b7, \"fix(deduplicate): stream response chunks to waiting handlers\", by Matteo Collina). The fix shipped in the upstream release, and no TuxCare commit exists in HEAD's history. Response chunks are streamed to waiting handlers, and late deduplication is refused once body streaming has started.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 Undici 8.3.0 already contains the upstream fix for CVE-2026-2581 (commit 5890c7b7, \"fix(deduplicate): stream response chunks to waiting handlers\", by Matteo Collina). The fix shipped in the upstream release, and no TuxCare commit exists in HEAD's history. Response chunks are streamed to waiting handlers, and late deduplication is refused once body streaming has started." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6733 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-6733" }, "action_statement": "Vulnerability CVE-2026-6733 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-13T20:09:50.079453+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 8.3.0 of undici. not_affected \u2014 Socks5ProxyAgent in this undici 8.3.0 tree already uses one Pool per origin, so requests cannot be routed to a pool for a different origin. The upstream fix commit a516f87 (PR #5041) is in HEAD and was in the upstream release before any TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Socks5ProxyAgent in this undici 8.3.0 tree already uses one Pool per origin, so requests cannot be routed to a pool for a different origin. The upstream fix commit a516f87 (PR #5041) is in HEAD and was in the upstream release before any TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-29T18:27:17.765346+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-28T21:53:00.082407+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 8.3.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-11-14T02:42:09.185511+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 8.3.0 of undici. not_affected \u2014 Target is undici 8.3.0. The CVE is a regression introduced in 8.10.0 (affects 8.10.0 and 8.10.1 only). In 8.3.0 the cache and deduplicate interceptors always put opts.origin in the key, and they skip caching/deduplication when opts.origin is absent. The origin-less keying that the fix addresses is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 8.3.0. The CVE is a regression introduced in 8.10.0 (affects 8.10.0 and 8.10.1 only). In 8.3.0 the cache and deduplicate interceptors always put opts.origin in the key, and they skip caching/deduplication when opts.origin is absent. The origin-less keying that the fix addresses is not present." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9675 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-9675" }, "action_statement": "Vulnerability CVE-2026-9675 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9678 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-9678" }, "action_statement": "Vulnerability CVE-2026-9678 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9679 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-9679" }, "action_statement": "Vulnerability CVE-2026-9679 affects version 8.3.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.3.0", "identifiers": { "purl": "pkg:npm/undici@8.3.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9697 affects version 8.3.0 of undici.", "vulnerability": { "name": "CVE-2026-9697" }, "action_statement": "Vulnerability CVE-2026-9697 affects version 8.3.0 of undici." } ] }