{ "@id": "urn:uuid:edaeae4a-7827-494f-abea-f137d02f6354", "role": "Document Creator", "author": "https://tuxcare.com", "version": 44, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:34:22.669842+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 8.5.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-14T00:05:01.866674+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 8.5.0 of undici. not_affected \u2014 Undici 8.5.0 already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, both fetch and the dispatcher redirect handler strip the cookie header. The fix shipped in the upstream release, before the first TuxCare onboarding commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Undici 8.5.0 already contains the upstream fix for CVE-2023-45143. On a cross-origin redirect, both fetch and the dispatcher redirect handler strip the cookie header. The fix shipped in the upstream release, before the first TuxCare onboarding commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 8.5.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-13T22:22:49.594925+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 8.5.0 of undici. not_affected \u2014 Target undici 8.5.0 already strips Proxy-Authorization on cross-origin redirects, in both the dispatcher redirect handler and the fetch redirect path. The fix is the upstream commit b9da3e40, authored by a non-TuxCare identity and shipped in the upstream release. HEAD has no TuxCare-authored commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 Target undici 8.5.0 already strips Proxy-Authorization on cross-origin redirects, in both the dispatcher redirect handler and the fetch redirect path. The fix is the upstream commit b9da3e40, authored by a non-TuxCare identity and shipped in the upstream release. HEAD has no TuxCare-authored commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-14T00:31:00.130291+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 8.5.0 of undici. not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2024-30260. RedirectHandler drops authorization, proxy-authorization and cookie headers whenever a redirect goes to a different origin. The fix commit 6805746 is an ancestor of HEAD, and no TuxCare-domain commit exists in history, so this is an upstream fix shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2024-30260. RedirectHandler drops authorization, proxy-authorization and cookie headers whenever a redirect goes to a different origin. The fix commit 6805746 is an ancestor of HEAD, and no TuxCare-domain commit exists in history, so this is an upstream fix shipped in the release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-13T23:34:14.677808+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 8.5.0 of undici. not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2024-30261. The integrity check in lib/web/subresource-integrity/subresource-integrity.js reduces the parsed metadata to the strongest-algorithm entries before comparing the body hash. The fix commit d542b8cd (author hello@matteocollina.com) is an ancestor of HEAD, and no TuxCare commits exist in HEAD's history, so this is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2024-30261. The integrity check in lib/web/subresource-integrity/subresource-integrity.js reduces the parsed metadata to the strongest-algorithm entries before comparing the body hash. The fix commit d542b8cd (author hello@matteocollina.com) is an ancestor of HEAD, and no TuxCare commits exist in HEAD's history, so this is an upstream fix." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 8.5.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-13T21:31:00.047911+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 8.5.0 of undici. not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2025-22150. The multipart boundary is generated with node:crypto randomInt, which is a CSPRNG, instead of Math.random. Math.random is used only as a fallback when the runtime has no crypto support. The fix commit c2d78cd19fe4 is upstream-authored and was in the upstream release. HEAD has no TuxCare commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2025-22150. The multipart boundary is generated with node:crypto randomInt, which is a CSPRNG, instead of Math.random. Math.random is used only as a fallback when the runtime has no crypto support. The fix commit c2d78cd19fe4 is upstream-authored and was in the upstream release. HEAD has no TuxCare commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-13T21:37:00.197268+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 8.5.0 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e) is already in the 8.5.0 tree. Pool registers a connectionError handler that removes failed clients from the pool's client list, so repeated failed TLS connections no longer accumulate clients.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e) is already in the 8.5.0 tree. Pool registers a connectionError handler that removes failed clients from the pool's client list, so repeated failed TLS connections no longer accumulate clients." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-10-15T18:47:21.529900+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-05T09:06:00.064776+00:00", "status_notes": "Vulnerability CVE-2026-109855 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-109855" }, "action_statement": "Vulnerability CVE-2026-109855 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-10-15T18:29:00.261196+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-10-15T18:34:00.250279+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-10-15T21:36:16.074202+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 8.5.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-13T19:59:43.713349+00:00", "status_notes": "Vulnerability CVE-2026-11525 does not affect version 8.5.0 of undici. not_affected \u2014 undici 8.5.0 already contains the upstream fix (nodejs/undici 5655ea43, \"fix(cookies): preserve values and parse SameSite strictly\"). The SameSite attribute is compared by case-insensitive exact equality, not by substring. The fix commit is an ancestor of HEAD and was written by an upstream author (hello@matteocollina.com). HEAD's history has no TuxCare commit, so the fix shipped in the upstrea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-11525" }, "impact_statement": "not_affected \u2014 undici 8.5.0 already contains the upstream fix (nodejs/undici 5655ea43, \"fix(cookies): preserve values and parse SameSite strictly\"). The SameSite attribute is compared by case-insensitive exact equality, not by substring. The fix commit is an ancestor of HEAD and was written by an upstream author (hello@matteocollina.com). HEAD's history has no TuxCare commit, so the fix shipped in the upstrea..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-06T10:20:26.750713+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 8.5.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-13T20:03:00.065439+00:00", "status_notes": "Vulnerability CVE-2026-12151 does not affect version 8.5.0 of undici. not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2026-12151. Commits 32dbf0b3 (\"websocket: limit the number of fragments in a message\") and c5ed7875 (\"websocket: handle empty fragments and stream limits\") are both ancestors of HEAD. Both are authored by upstream (luigipinca@gmail.com, committer hello@matteocollina.com). The Receiver enforces a maximum fragment count, 131072 by default, an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-12151" }, "impact_statement": "not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2026-12151. Commits 32dbf0b3 (\"websocket: limit the number of fragments in a message\") and c5ed7875 (\"websocket: handle empty fragments and stream limits\") are both ancestors of HEAD. Both are authored by upstream (luigipinca@gmail.com, committer hello@matteocollina.com). The Receiver enforces a maximum fragment count, 131072 by default, an..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-14643 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-14643" }, "action_statement": "Vulnerability CVE-2026-14643 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 8.5.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-13T21:51:25.708621+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 8.5.0 of undici. not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2026-1525. processHeader() in lib/core/request.js lowercases the header name and throws 'duplicate content-length header' if request.contentLength is already set, so case-variant duplicate Content-Length entries in a flat header array are rejected. The fix commit 74495c63 is by upstream author Matteo Collina and ships in the upstream releas...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2026-1525. processHeader() in lib/core/request.js lowercases the header name and throws 'duplicate content-length header' if request.contentLength is already set, so case-variant duplicate Content-Length entries in a flat header array are rejected. The fix commit 74495c63 is by upstream author Matteo Collina and ships in the upstream releas..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 8.5.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-13T22:11:00.043442+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 8.5.0 of undici. not_affected \u2014 undici 8.5.0 already validates the `upgrade` option. The Request constructor rejects non-string values and any value containing characters invalid in a header value, including CR and LF. The fix is the upstream commit 77594f92, which is an ancestor of HEAD and shipped in the upstream release. The HTTP/1 writer interpolates only this validated value.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 undici 8.5.0 already validates the `upgrade` option. The Request constructor rejects non-string values and any value containing characters invalid in a header value, including CR and LF. The fix is the upstream commit 77594f92, which is an ancestor of HEAD and shipped in the upstream release. The HTTP/1 writer interpolates only this validated value." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-13T22:02:00.042261+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 8.5.0 of undici. not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2026-1528 (upstream commit 84235c62, \"Fix websocket 64-bit length overflow\"). The fix shipped in the upstream 8.5.0 release, so this is an upstream fix and not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2026-1528 (upstream commit 84235c62, \"Fix websocket 64-bit length overflow\"). The fix shipped in the upstream 8.5.0 release, so this is an upstream fix and not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 8.5.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-13T21:47:00.051716+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 8.5.0 of undici. not_affected \u2014 undici 8.5.0 already caps the Content-Encoding chain at 5 in both fetch() and the decompress interceptor. The caps shipped in the upstream release, authored by upstream (hello@matteocollina.com, committed via noreply@github.com), so the unbounded-chain pattern is absent. HEAD has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 undici 8.5.0 already caps the Content-Encoding chain at 5 in both fetch() and the decompress interceptor. The caps shipped in the upstream release, authored by upstream (hello@matteocollina.com, committed via noreply@github.com), so the unbounded-chain pattern is absent. HEAD has no TuxCare-domain commits." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 8.5.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-14T01:37:47.119617+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 8.5.0 of undici. not_affected \u2014 Undici 8.5.0 already contains the upstream fix for CVE-2026-2581 (commit 5890c7b7 \"fix(deduplicate): stream response chunks to waiting handlers\", by Matteo Collina). It is an ancestor of HEAD and was shipped in the upstream release; no TuxCare-domain commit exists in HEAD history. The deduplication handler streams chunks to waiting handlers and refuses late attachment once body data has started...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 Undici 8.5.0 already contains the upstream fix for CVE-2026-2581 (commit 5890c7b7 \"fix(deduplicate): stream response chunks to waiting handlers\", by Matteo Collina). It is an ancestor of HEAD and was shipped in the upstream release; no TuxCare-domain commit exists in HEAD history. The deduplication handler streams chunks to waiting handlers and refuses late attachment once body data has started..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-13T19:59:00.044739+00:00", "status_notes": "Vulnerability CVE-2026-6733 does not affect version 8.5.0 of undici. not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2026-6733 (idle-socket validation before reusing a keep-alive socket). The fix commits are ancestors of HEAD and shipped in the upstream 8.5.0 release. HEAD has no TuxCare-domain commits, so this is an upstream fix and the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6733" }, "impact_statement": "not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2026-6733 (idle-socket validation before reusing a keep-alive socket). The fix commits are ancestors of HEAD and shipped in the upstream 8.5.0 release. HEAD has no TuxCare-domain commits, so this is an upstream fix and the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-13T20:09:50.079453+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 8.5.0 of undici. not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2026-6734. Socks5ProxyAgent keeps a Map of Pools keyed by origin (kPools) and creates a separate Pool and SOCKS5 tunnel for each origin. The fix is upstream commit a516f87 (author DeepView Autofix, committer GitHub), which is an ancestor of HEAD. HEAD has no @cloudlinux.com or @tuxcare.com commits, so the fix shipped in the upstream release...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2026-6734. Socks5ProxyAgent keeps a Map of Pools keyed by origin (kPools) and creates a separate Pool and SOCKS5 tunnel for each origin. The fix is upstream commit a516f87 (author DeepView Autofix, committer GitHub), which is an ancestor of HEAD. HEAD has no @cloudlinux.com or @tuxcare.com commits, so the fix shipped in the upstream release..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-09-29T18:27:17.765346+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-09-28T21:53:00.082407+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 8.5.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-14T02:34:22.669842+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 8.5.0 of undici. not_affected \u2014 Target is undici 8.5.0. The CVE says the flaw was introduced in 8.10.0, and in this tree the cache and deduplicate interceptors key on the request's own opts.origin and skip requests that have none. The origin-less keying pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 8.5.0. The CVE says the flaw was introduced in 8.10.0, and in this tree the cache and deduplicate interceptors key on the request's own opts.origin and skip requests that have none. The origin-less keying pattern is not present." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 8.5.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 8.5.0 of undici.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 8.5.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-14T01:58:40.749057+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 8.5.0 of undici. not_affected \u2014 Target is undici 8.5.0, which already contains the upstream fix for CVE-2026-9675. The ByteParser enforces maxPayloadSize cumulatively across uncompressed fragments and also caps the fragment count. All three vendor commits are ancestors of HEAD, and none is authored by a TuxCare identity.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 Target is undici 8.5.0, which already contains the upstream fix for CVE-2026-9675. The ByteParser enforces maxPayloadSize cumulatively across uncompressed fragments and also caps the fragment count. All three vendor commits are ancestors of HEAD, and none is authored by a TuxCare identity." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-13T20:11:32.988243+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 8.5.0 of undici. not_affected \u2014 Not affected. The upstream fix (cb105d7c, \"fix(cache): trim qualified field names\") by Matteo Collina is already in HEAD (undici 8.5.0). parseCacheControlHeader now trims every qualified private/no-cache field name, so \" authorization\" and \"\\tauthorization\" normalize to \"authorization\" and canCacheResponse rejects the response.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix (cb105d7c, \"fix(cache): trim qualified field names\") by Matteo Collina is already in HEAD (undici 8.5.0). parseCacheControlHeader now trims every qualified private/no-cache field name, so \" authorization\" and \"\\tauthorization\" normalize to \"authorization\" and canCacheResponse rejects the response." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-13T20:02:00.043521+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 8.5.0 of undici. not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2026-9679. parseSetCookie in lib/web/cookies/parse.js no longer percent-decodes cookie values, and qsUnescape/unescape/decodeURIComponent appear nowhere in lib/. The fix commit 5655ea43 is by Matteo Collina (upstream), is an ancestor of HEAD, and HEAD's history has no TuxCare-domain commits, so the fix shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 undici 8.5.0 already contains the upstream fix for CVE-2026-9679. parseSetCookie in lib/web/cookies/parse.js no longer percent-decodes cookie values, and qsUnescape/unescape/decodeURIComponent appear nowhere in lib/. The fix commit 5655ea43 is by Matteo Collina (upstream), is an ancestor of HEAD, and HEAD's history has no TuxCare-domain commits, so the fix shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.5.0", "identifiers": { "purl": "pkg:npm/undici@8.5.0" } } ], "timestamp": "2026-11-13T20:14:00.045604+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 8.5.0 of undici. not_affected \u2014 Target is undici 8.5.0, which already contains the upstream fix 42d49559 (\"fix: honor requestTls when proxy is SOCKS5\"). Both ProxyAgent and Socks5ProxyAgent forward requestTls into the TLS upgrade over the SOCKS5 tunnel. The fix shipped in the upstream release, and HEAD has no TuxCare-authored commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 Target is undici 8.5.0, which already contains the upstream fix 42d49559 (\"fix: honor requestTls when proxy is SOCKS5\"). Both ProxyAgent and Socks5ProxyAgent forward requestTls into the TLS upgrade over the SOCKS5 tunnel. The fix shipped in the upstream release, and HEAD has no TuxCare-authored commits." } ] }