{ "@id": "urn:uuid:84b3c026-e7cd-4d12-be79-0f29bb1e0f12", "role": "Document Creator", "author": "https://tuxcare.com", "version": 43, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T03:13:00.060830+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 8.6.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-14T00:07:00.231663+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 8.6.0 of undici. not_affected \u2014 Not affected. The target (undici 8.6.0) already removes cookie, authorization, proxy-authorization and host request headers when a fetch redirect crosses origins (lib/web/fetch/index.js:1350-1359). The dispatcher redirect handler also strips them on cross-origin redirects (lib/handler/redirect-handler.js:170). The upstream fix e041de3 is an ancestor of HEAD and predates the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Not affected. The target (undici 8.6.0) already removes cookie, authorization, proxy-authorization and host request headers when a fetch redirect crosses origins (lib/web/fetch/index.js:1350-1359). The dispatcher redirect handler also strips them on cross-origin redirects (lib/handler/redirect-handler.js:170). The upstream fix e041de3 is an ancestor of HEAD and predates the first TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 8.6.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-13T22:22:49.594925+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 8.6.0 of undici. not_affected \u2014 undici 8.6.0 already strips Proxy-Authorization on cross-origin redirects, in both the fetch implementation and the dispatcher redirect handler. The fix is the upstream commit b9da3e40 (GHSA-3787-6prv-h9w3), which shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 undici 8.6.0 already strips Proxy-Authorization on cross-origin redirects, in both the fetch implementation and the dispatcher redirect handler. The fix is the upstream commit b9da3e40 (GHSA-3787-6prv-h9w3), which shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-14T00:33:45.023269+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 8.6.0 of undici. not_affected \u2014 Target is undici 8.6.0, a plain upstream release. Its redirect handler already strips authorization, proxy-authorization and cookie headers on cross-origin redirects, so undici.request() and the dispatcher path no longer leak credentials. The upstream fix, merge commit 6805746 by Matteo Collina, is an ancestor of HEAD and shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 Target is undici 8.6.0, a plain upstream release. Its redirect handler already strips authorization, proxy-authorization and cookie headers on cross-origin redirects, so undici.request() and the dispatcher path no longer leak credentials. The upstream fix, merge commit 6805746 by Matteo Collina, is an ancestor of HEAD and shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-13T23:39:20.408363+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 8.6.0 of undici. not_affected \u2014 undici 8.6.0 is not affected by CVE-2024-30261. The fetch integrity check already uses the spec-compliant strongest-algorithm selection. Upstream commit d542b8cd (Matteo Collina) is an ancestor of HEAD and shipped in the upstream release. The patch text was not provided, so the defense was checked against my knowledge of the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 undici 8.6.0 is not affected by CVE-2024-30261. The fetch integrity check already uses the spec-compliant strongest-algorithm selection. Upstream commit d542b8cd (Matteo Collina) is an ancestor of HEAD and shipped in the upstream release. The patch text was not provided, so the defense was checked against my knowledge of the upstream fix." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 8.6.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-13T21:31:44.249794+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 8.6.0 of undici. not_affected \u2014 The multipart boundary is no longer generated with a predictable Math.random() call. HEAD (undici 8.6.0) already contains the upstream fix for CVE-2025-22150. The boundary comes from node:crypto randomInt whenever crypto is available. Math.random() is only a fallback when crypto is missing, which matches upstream's later fix 35f5d45e. The fix commits are authored by upstream (hello@matteocollin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 The multipart boundary is no longer generated with a predictable Math.random() call. HEAD (undici 8.6.0) already contains the upstream fix for CVE-2025-22150. The boundary comes from node:crypto randomInt whenever crypto is available. Math.random() is only a fallback when crypto is missing, which matches upstream's later fix 35f5d45e. The fix commits are authored by upstream (hello@matteocollin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-13T21:37:00.197268+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 8.6.0 of undici. not_affected \u2014 undici 8.6.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool registers a 'connectionError' handler that removes failed clients from its client list, so repeated failed TLS handshakes no longer leave dead clients accumulating. The fix is an upstream-authored commit that shipped in the release, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 undici 8.6.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e). Pool registers a 'connectionError' handler that removes failed clients from its client list, so repeated failed TLS handshakes no longer leave dead clients accumulating. The fix is an upstream-authored commit that shipped in the release, so the target is not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 8.6.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-14T03:13:00.060830+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 8.6.0 of undici. not_affected \u2014 Not affected. The target is undici 8.6.0, and the CVE says the regression arrived in 8.11.0. On the handshake-validation-failure path, the abort in this version still closes the HTTP/2 stream, because the request is never marked completed for upgrade requests. I could not run a live proof-of-concept because the sandbox only has Node 20, which this undici version does not load on. The verdict re...", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Not affected. The target is undici 8.6.0, and the CVE says the regression arrived in 8.11.0. On the handshake-validation-failure path, the abort in this version still closes the HTTP/2 stream, because the request is never marked completed for upgrade requests. I could not run a live proof-of-concept because the sandbox only has Node 20, which this undici version does not load on. The verdict re..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-10-15T18:29:00.261196+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-10-15T18:34:00.250279+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 8.6.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-13T20:01:00.036985+00:00", "status_notes": "Vulnerability CVE-2026-11525 does not affect version 8.6.0 of undici. not_affected \u2014 undici 8.6.0 already parses the SameSite attribute strictly (case-insensitive exact match for none/strict/lax; any other value is ignored). The fix is upstream commit 5655ea43, shipped in the upstream v8.6.0 release. HEAD adds only a tuxcare.yaml config commit on top.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-11525" }, "impact_statement": "not_affected \u2014 undici 8.6.0 already parses the SameSite attribute strictly (case-insensitive exact match for none/strict/lax; any other value is ignored). The fix is upstream commit 5655ea43, shipped in the upstream v8.6.0 release. HEAD adds only a tuxcare.yaml config commit on top." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-06T10:20:57.098620+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 8.6.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-13T20:03:00.065439+00:00", "status_notes": "Vulnerability CVE-2026-12151 does not affect version 8.6.0 of undici. not_affected \u2014 undici 8.6.0 already contains the upstream fix for CVE-2026-12151 (fragment-count limit). Upstream commits 32dbf0b3 and c5ed7875 (author luigipinca@gmail.com, committer hello@matteocollina.com) are in the 8.6.0 release that TuxCare onboarded. A default cap of 131072 fragments per message is enforced for both the compressed and uncompressed receive paths. It is wired into both WebSocket and WebS...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-12151" }, "impact_statement": "not_affected \u2014 undici 8.6.0 already contains the upstream fix for CVE-2026-12151 (fragment-count limit). Upstream commits 32dbf0b3 and c5ed7875 (author luigipinca@gmail.com, committer hello@matteocollina.com) are in the 8.6.0 release that TuxCare onboarded. A default cap of 131072 fragments per message is enforced for both the compressed and uncompressed receive paths. It is wired into both WebSocket and WebS..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-14643 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-14643" }, "action_statement": "Vulnerability CVE-2026-14643 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 8.6.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-13T21:51:25.708621+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 8.6.0 of undici. not_affected \u2014 Target undici 8.6.0 already contains the upstream fix (nodejs/undici 74495c63, \"fix: reject duplicate content-length and host headers\"). processHeader lowercases every header name and throws on a second content-length, so case-variant duplicates in a flat array are rejected. The fix is an ancestor of HEAD and predates any TuxCare commit, so this is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 Target undici 8.6.0 already contains the upstream fix (nodejs/undici 74495c63, \"fix: reject duplicate content-length and host headers\"). processHeader lowercases every header name and throws on a second content-length, so case-variant duplicates in a flat array are rejected. The fix is an ancestor of HEAD and predates any TuxCare commit, so this is an upstream fix." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 8.6.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-13T22:11:00.043442+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 8.6.0 of undici. not_affected \u2014 undici 8.6.0 already contains the upstream fix for CVE-2026-1527. Request construction rejects any `upgrade` value with invalid header characters (including CR/LF) before client-h1.js serializes it. The fix is upstream commit 77594f92 by Matteo Collina, which is in the 8.6.0 release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 undici 8.6.0 already contains the upstream fix for CVE-2026-1527. Request construction rejects any `upgrade` value with invalid header characters (including CR/LF) before client-h1.js serializes it. The fix is upstream commit 77594f92 by Matteo Collina, which is in the 8.6.0 release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-13T22:02:00.042261+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 8.6.0 of undici. not_affected \u2014 undici 8.6.0 already contains the upstream fix for CVE-2026-1528 (commit 84235c62, \"Fix websocket 64-bit length overflow\"). The 64-bit payload-length branch in ByteParser fails the connection with close code 1009 when the high 32 bits are non-zero or the low 32 bits exceed 2^31-1. An oversized length can no longer reach the length arithmetic or buffering.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 undici 8.6.0 already contains the upstream fix for CVE-2026-1528 (commit 84235c62, \"Fix websocket 64-bit length overflow\"). The 64-bit payload-length branch in ByteParser fails the connection with close code 1009 when the high 32 bits are non-zero or the low 32 bits exceed 2^31-1. An oversized length can no longer reach the length arithmetic or buffering." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 8.6.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-13T21:44:51.271214+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 8.6.0 of undici. not_affected \u2014 Not affected. The target (undici 8.6.0) already contains the upstream fix for CVE-2026-22036 (upstream commit b04e3cbb). Both fetch() and the decompress interceptor reject responses whose Content-Encoding lists more than 5 codings. The fix shipped in the upstream release, so it is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 Not affected. The target (undici 8.6.0) already contains the upstream fix for CVE-2026-22036 (upstream commit b04e3cbb). Both fetch() and the decompress interceptor reject responses whose Content-Encoding lists more than 5 codings. The fix shipped in the upstream release, so it is not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 8.6.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-14T01:38:00.597373+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 8.6.0 of undici. not_affected \u2014 Target undici 8.6.0 already contains the upstream fix 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\"), shipped in the upstream release. Chunks are streamed to waiting handlers as they arrive, late attachment is refused once body data has started, and paused-handler buffering is capped. The vulnerable accumulate-whole-body pattern is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 Target undici 8.6.0 already contains the upstream fix 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\"), shipped in the upstream release. Chunks are streamed to waiting handlers as they arrive, late attachment is refused once body data has started, and paused-handler buffering is capped. The vulnerable accumulate-whole-body pattern is absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-13T19:59:36.292466+00:00", "status_notes": "Vulnerability CVE-2026-6733 does not affect version 8.6.0 of undici. not_affected \u2014 undici 8.6.0 already contains the upstream fix for CVE-2026-6733 (response-queue poisoning on idle keep-alive sockets). Upstream commit 6ea54ef8 adds idle-socket validation in lib/dispatcher/client-h1.js. That commit is in the upstream 8.6.0 release, before the first TuxCare commit, so this is an upstream fix and the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6733" }, "impact_statement": "not_affected \u2014 undici 8.6.0 already contains the upstream fix for CVE-2026-6733 (response-queue poisoning on idle keep-alive sockets). Upstream commit 6ea54ef8 adds idle-socket validation in lib/dispatcher/client-h1.js. That commit is in the upstream 8.6.0 release, before the first TuxCare commit, so this is an upstream fix and the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-13T20:09:50.079453+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 8.6.0 of undici. not_affected \u2014 Target (undici 8.6.0) already contains the upstream per-origin pool fix (a516f870, nodejs/undici #5041). Socks5ProxyAgent keys pools in a Map by origin, so requests to different origins no longer share the first origin's tunnel. The fix is upstream-authored and was in the upstream release before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 Target (undici 8.6.0) already contains the upstream per-origin pool fix (a516f870, nodejs/undici #5041). Socks5ProxyAgent keys pools in a Map by origin, so requests to different origins no longer share the first origin's tunnel. The fix is upstream-authored and was in the upstream release before the first TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-09-29T18:27:17.765346+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-10-15T12:23:19.034848+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 8.6.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-14T02:42:09.185511+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 8.6.0 of undici. not_affected \u2014 Target is undici 8.6.0. The CVE says the flaw was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In this tree, interceptors.cache() and interceptors.deduplicate() never build a key without an origin. Both skip caching and dedup when opts.origin is absent, and makeCacheKey always puts opts.origin into the key (and throws if it is missing). I could not fetch the patch URL, so the fix wa...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 8.6.0. The CVE says the flaw was introduced in 8.10.0 and affects only 8.10.0 and 8.10.1. In this tree, interceptors.cache() and interceptors.deduplicate() never build a key without an origin. Both skip caching and dedup when opts.origin is absent, and makeCacheKey always puts opts.origin into the key (and throws if it is missing). I could not fetch the patch URL, so the fix wa..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 8.6.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 8.6.0 of undici.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 8.6.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-14T01:59:04.413808+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 8.6.0 of undici. not_affected \u2014 undici 8.6.0 already contains the upstream fix for CVE-2026-9675. The receiver enforces maxPayloadSize cumulatively across fragments (payloadLength + already-buffered fragment bytes) before each frame body is buffered, and it also limits the fragment count. The fix commits (b4c287b3, 32dbf0b3, c5ed7875) are upstream-authored and are ancestors of HEAD, inside the upstream 8.6.0 release. The repo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 undici 8.6.0 already contains the upstream fix for CVE-2026-9675. The receiver enforces maxPayloadSize cumulatively across fragments (payloadLength + already-buffered fragment bytes) before each frame body is buffered, and it also limits the fragment count. The fix commits (b4c287b3, 32dbf0b3, c5ed7875) are upstream-authored and are ancestors of HEAD, inside the upstream 8.6.0 release. The repo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-13T20:11:32.988243+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 8.6.0 of undici. not_affected \u2014 The upstream fix (cb105d7c, \"fix(cache): trim qualified field names\") is already in the target's v8.6.0 release. parseCacheControlHeader in lib/util/cache.js now trims whitespace from the qualified private/no-cache field names, so canCacheResponse matches 'authorization' and refuses to store the response.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 The upstream fix (cb105d7c, \"fix(cache): trim qualified field names\") is already in the target's v8.6.0 release. parseCacheControlHeader in lib/util/cache.js now trims whitespace from the qualified private/no-cache field names, so canCacheResponse matches 'authorization' and refuses to store the response." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-13T20:02:00.043521+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 8.6.0 of undici. not_affected \u2014 undici 8.6.0 already contains the upstream fix 5655ea43 (Matteo Collina), which stops percent-decoding cookie values. parseSetCookie returns the trimmed raw value, and lib/web/cookies has no qsUnescape or other decoding call. The fix shipped in the upstream release; HEAD is that release plus a tuxcare.yaml build config commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 undici 8.6.0 already contains the upstream fix 5655ea43 (Matteo Collina), which stops percent-decoding cookie values. parseSetCookie returns the trimmed raw value, and lib/web/cookies has no qsUnescape or other decoding call. The fix shipped in the upstream release; HEAD is that release plus a tuxcare.yaml build config commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.6.0", "identifiers": { "purl": "pkg:npm/undici@8.6.0" } } ], "timestamp": "2026-11-13T20:14:00.045604+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 8.6.0 of undici. not_affected \u2014 Not affected. The upstream fix (commit 42d49559, \"fix: honor requestTls when proxy is SOCKS5\") is already in the shipped undici 8.6.0 tree. ProxyAgent forwards requestTls to Socks5ProxyAgent, and Socks5ProxyAgent applies it in the target TLS upgrade.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix (commit 42d49559, \"fix: honor requestTls when proxy is SOCKS5\") is already in the shipped undici 8.6.0 tree. ProxyAgent forwards requestTls to Socks5ProxyAgent, and Socks5ProxyAgent applies it in the target TLS upgrade." } ] }