{ "@id": "urn:uuid:43033ff0-a552-4c6e-9c92-bf664031dd45", "role": "Document Creator", "author": "https://tuxcare.com", "version": 43, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T03:09:36.526982+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 8.8.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-14T00:05:01.866674+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 8.8.0 of undici. not_affected \u2014 Not affected. The target (undici 8.8.0) already contains the upstream fix e041de3 (GHSA-wqq4-5wpv-mx2g). On a cross-origin redirect, httpRedirectFetch deletes authorization, proxy-authorization, cookie and host. The commit is an ancestor of HEAD, and HEAD has no TuxCare commits, so this is a plain upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Not affected. The target (undici 8.8.0) already contains the upstream fix e041de3 (GHSA-wqq4-5wpv-mx2g). On a cross-origin redirect, httpRedirectFetch deletes authorization, proxy-authorization, cookie and host. The commit is an ancestor of HEAD, and HEAD has no TuxCare commits, so this is a plain upstream release." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 8.8.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-13T22:23:00.050166+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 8.8.0 of undici. not_affected \u2014 undici 8.8.0 already strips Proxy-Authorization on cross-origin redirects. The check shipped in the upstream release, and the only commit above upstream is a TuxCare build-config commit. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 undici 8.8.0 already strips Proxy-Authorization on cross-origin redirects. The check shipped in the upstream release, and the only commit above upstream is a TuxCare build-config commit. Not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-14T00:33:45.023269+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 8.8.0 of undici. not_affected \u2014 Target is undici 8.8.0, a plain upstream release (the only non-upstream commit at HEAD is a tuxcare.yaml build config). The upstream fix for CVE-2024-30260 (commit 6805746, authored by the upstream maintainer) is an ancestor of HEAD. lib/handler/redirect-handler.js strips authorization, proxy-authorization and cookie headers whenever a redirect changes origin, for both array and object header f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 Target is undici 8.8.0, a plain upstream release (the only non-upstream commit at HEAD is a tuxcare.yaml build config). The upstream fix for CVE-2024-30260 (commit 6805746, authored by the upstream maintainer) is an ancestor of HEAD. lib/handler/redirect-handler.js strips authorization, proxy-authorization and cookie headers whenever a redirect changes origin, for both array and object header f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-13T23:39:52.749609+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 8.8.0 of undici. not_affected \u2014 undici 8.8.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). The fix commit d542b8cd is an ancestor of HEAD and shipped in the upstream release. No TuxCare commit carries the fix, so this is an upstream fix and the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 undici 8.8.0 already contains the upstream fix for CVE-2024-30261 (GHSA-9qxr-qj54-h672). The fix commit d542b8cd is an ancestor of HEAD and shipped in the upstream release. No TuxCare commit carries the fix, so this is an upstream fix and the verdict is not_affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 8.8.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-13T21:31:44.249794+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 8.8.0 of undici. not_affected \u2014 undici 8.8.0 is not affected by CVE-2025-22150. The multipart boundary is generated in lib/web/fetch/formdata.js using node:crypto randomInt (CSPRNG) instead of Math.random(). This is the upstream fix (merge c2d78cd1, author hello@matteocollina.com), which was already in the upstream 8.8.0 release. No TuxCare commit exists in HEAD's history, so this is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 undici 8.8.0 is not affected by CVE-2025-22150. The multipart boundary is generated in lib/web/fetch/formdata.js using node:crypto randomInt (CSPRNG) instead of Math.random(). This is the upstream fix (merge c2d78cd1, author hello@matteocollina.com), which was already in the upstream 8.8.0 release. No TuxCare commit exists in HEAD's history, so this is an upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-13T21:38:00.122263+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 8.8.0 of undici. not_affected \u2014 Undici 8.8.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e, by Matteo Collina). Pool and RoundRobinPool listen for 'connectionError' and splice the failed client out of the pool's client list, so failed clients no longer accumulate. The fix shipped in the upstream release and is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 Undici 8.8.0 already contains the upstream fix for CVE-2025-47279 (nodejs/undici PR #4088, commit f317618e, by Matteo Collina). Pool and RoundRobinPool listen for 'connectionError' and splice the failed client out of the pool's client list, so failed clients no longer accumulate. The fix shipped in the upstream release and is not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-10-15T18:44:00.132301+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-10-15T18:46:33.687871+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 8.8.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-14T03:09:36.526982+00:00", "status_notes": "Vulnerability CVE-2026-109855 does not affect version 8.8.0 of undici. not_affected \u2014 Target is undici 8.8.0. CVE-2026-109855 is a regression introduced in 8.11.0 that affects only 8.11.0 and 8.11.1. In 8.8.0 the HTTP/2 WebSocket upgrade path does not mark the request completed on a successful upgrade response. So when WebSocket handshake validation fails, the abort reaches the request's abort handler, which closes and destroys the ClientHttp2Stream. No orphaned stream with no e...", "vulnerability": { "name": "CVE-2026-109855" }, "impact_statement": "not_affected \u2014 Target is undici 8.8.0. CVE-2026-109855 is a regression introduced in 8.11.0 that affects only 8.11.0 and 8.11.1. In 8.8.0 the HTTP/2 WebSocket upgrade path does not mark the request completed on a successful upgrade response. So when WebSocket handshake validation fails, the abort reaches the request's abort handler, which closes and destroys the ClientHttp2Stream. No orphaned stream with no e..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-10-15T18:29:00.261196+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-10-15T18:34:00.250279+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 8.8.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-13T20:01:00.036985+00:00", "status_notes": "Vulnerability CVE-2026-11525 does not affect version 8.8.0 of undici. not_affected \u2014 Not affected. undici 8.8.0 already contains the upstream fix (5655ea43, \"fix(cookies): preserve values and parse SameSite strictly\"). lib/web/cookies/parse.js lowercases the SameSite value and compares it exactly to none/strict/lax, ignoring anything else. The upstream fix shipped in the 8.8.0 release, which has no TuxCare allowlist commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-11525" }, "impact_statement": "not_affected \u2014 Not affected. undici 8.8.0 already contains the upstream fix (5655ea43, \"fix(cookies): preserve values and parse SameSite strictly\"). lib/web/cookies/parse.js lowercases the SameSite value and compares it exactly to none/strict/lax, ignoring anything else. The upstream fix shipped in the 8.8.0 release, which has no TuxCare allowlist commits." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-06T10:20:57.098620+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 8.8.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-13T20:03:00.065439+00:00", "status_notes": "Vulnerability CVE-2026-12151 does not affect version 8.8.0 of undici. not_affected \u2014 undici 8.8.0 already contains the upstream fix for CVE-2026-12151. The WebSocket receiver caps the number of fragments per message (default 131072) and closes the connection with 1008 'Too many message fragments' when the cap is hit. The fix is upstream commit 32dbf0b3 (Luigi Pinca), with follow-up c5ed7875 for empty fragments and WebSocketStream limits. It is in the 8.8.0 release, before any T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-12151" }, "impact_statement": "not_affected \u2014 undici 8.8.0 already contains the upstream fix for CVE-2026-12151. The WebSocket receiver caps the number of fragments per message (default 131072) and closes the connection with 1008 'Too many message fragments' when the cap is hit. The fix is upstream commit 32dbf0b3 (Luigi Pinca), with follow-up c5ed7875 for empty fragments and WebSocketStream limits. It is in the 8.8.0 release, before any T..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-13697 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-13697" }, "action_statement": "Vulnerability CVE-2026-13697 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-14643 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-14643" }, "action_statement": "Vulnerability CVE-2026-14643 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-15157 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-15157" }, "action_statement": "Vulnerability CVE-2026-15157 affects version 8.8.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-13T21:55:34.449898+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 8.8.0 of undici. not_affected \u2014 undici 8.8.0 already contains the upstream fix for CVE-2026-1525 (commit 74495c63, \"reject duplicate content-length and host headers\", by Matteo Collina). It shipped in the upstream release. Case-variant duplicate Content-Length headers are rejected in lib/core/request.js and are never serialized onto the wire.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 undici 8.8.0 already contains the upstream fix for CVE-2026-1525 (commit 74495c63, \"reject duplicate content-length and host headers\", by Matteo Collina). It shipped in the upstream release. Case-variant duplicate Content-Length headers are rejected in lib/core/request.js and are never serialized onto the wire." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 8.8.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-13T22:13:50.517753+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 8.8.0 of undici. not_affected \u2014 Target undici 8.8.0 already contains the upstream CVE-2026-1527 fix (commit 77594f92, Matteo Collina). The Request constructor rejects non-string `upgrade` values and any `upgrade` value containing CR, LF or NUL before client-h1 writes it to the socket. No TuxCare commit is involved, so this is an upstream fix shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 Target undici 8.8.0 already contains the upstream CVE-2026-1527 fix (commit 77594f92, Matteo Collina). The Request constructor rejects non-string `upgrade` values and any `upgrade` value containing CR, LF or NUL before client-h1 writes it to the socket. No TuxCare commit is involved, so this is an upstream fix shipped in the release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-13T22:06:56.306734+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 8.8.0 of undici. not_affected \u2014 The target (undici 8.8.0) already contains the upstream fix for CVE-2026-1528. In lib/web/websocket/receiver.js, the 64-bit length branch fails the connection with 1009 when the high 32 bits are non-zero or the low 32 bits exceed 2^31-1. The fix was authored upstream by Matteo Collina in 84235c62 and is an ancestor of HEAD. HEAD's history has no TuxCare commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 The target (undici 8.8.0) already contains the upstream fix for CVE-2026-1528. In lib/web/websocket/receiver.js, the 64-bit length branch fails the connection with 1009 when the high 32 bits are non-zero or the low 32 bits exceed 2^31-1. The fix was authored upstream by Matteo Collina in 84235c62 and is an ancestor of HEAD. HEAD's history has no TuxCare commits." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16728 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-16728" }, "action_statement": "Vulnerability CVE-2026-16728 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-16729 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-16729" }, "action_statement": "Vulnerability CVE-2026-16729 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 8.8.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-13T21:44:51.271214+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 8.8.0 of undici. not_affected \u2014 undici 8.8.0 already contains the upstream fix for CVE-2026-22036. Both fetch() (lib/web/fetch/index.js) and the decompress interceptor (lib/interceptor/decompress.js) reject responses with more than 5 Content-Encoding codings before any decoders are created. The fix, upstream commit b04e3cbb, shipped in the upstream release. It is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 undici 8.8.0 already contains the upstream fix for CVE-2026-22036. Both fetch() (lib/web/fetch/index.js) and the decompress interceptor (lib/interceptor/decompress.js) reject responses with more than 5 Content-Encoding codings before any decoders are created. The fix, upstream commit b04e3cbb, shipped in the upstream release. It is not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 8.8.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-14T01:40:03.504280+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 8.8.0 of undici. not_affected \u2014 The target (undici 8.8.0) already contains the upstream fix commit 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\"). The fix shipped in the upstream release. DeduplicationHandler forwards each chunk to waiting handlers as it arrives. It refuses late attachment once body data has started. It buffers only while a waiter is paused, and that buffer is capped.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 The target (undici 8.8.0) already contains the upstream fix commit 5890c7b7 (\"fix(deduplicate): stream response chunks to waiting handlers\"). The fix shipped in the upstream release. DeduplicationHandler forwards each chunk to waiting handlers as it arrives. It refuses late attachment once body data has started. It buffers only while a waiter is paused, and that buffer is capped." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-13T19:59:36.292466+00:00", "status_notes": "Vulnerability CVE-2026-6733 does not affect version 8.8.0 of undici. not_affected \u2014 undici 8.8.0 already contains the upstream fix for HTTP/1.1 response queue poisoning on reused keep-alive sockets (idle socket validation, commit 6ea54ef8, GHSA-35p6-xmwp-9g52). The fix shipped in the upstream release (fixed in v8.5.0). Author and committer are upstream (hello@matteocollina.com); HEAD has no TuxCare-domain commits. The vulnerable pre-fix pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6733" }, "impact_statement": "not_affected \u2014 undici 8.8.0 already contains the upstream fix for HTTP/1.1 response queue poisoning on reused keep-alive sockets (idle socket validation, commit 6ea54ef8, GHSA-35p6-xmwp-9g52). The fix shipped in the upstream release (fixed in v8.5.0). Author and committer are upstream (hello@matteocollina.com); HEAD has no TuxCare-domain commits. The vulnerable pre-fix pattern is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-13T20:10:07.561437+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 8.8.0 of undici. not_affected \u2014 undici 8.8.0 already contains the upstream fix for CVE-2026-6734. Socks5ProxyAgent keeps a Map of pools keyed by origin and creates a separate Pool for each origin, so requests to different origins no longer share one pool. The fix commit a516f870 is authored by upstream (DeepView Autofix) and shipped in the upstream 8.8.0 release before any TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 undici 8.8.0 already contains the upstream fix for CVE-2026-6734. Socks5ProxyAgent keeps a Map of pools keyed by origin and creates a separate Pool for each origin, so requests to different origins no longer share one pool. The fix commit a516f870 is authored by upstream (DeepView Autofix) and shipped in the upstream 8.8.0 release before any TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-09-29T18:27:17.765346+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-10-15T12:23:19.034848+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 8.8.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-14T02:43:23.718472+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 8.8.0 of undici. not_affected \u2014 Target is undici 8.8.0. The CVE says the flaw was introduced in 8.10.0 (affects 8.10.0 and 8.10.1). In 8.8.0 the cache and dedup interceptors always build keys from opts.origin and skip any request that has no origin, so keys without the destination origin are never built.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 8.8.0. The CVE says the flaw was introduced in 8.10.0 (affects 8.10.0 and 8.10.1). In 8.8.0 the cache and dedup interceptors always build keys from opts.origin and skip any request that has no origin, so keys without the destination origin are never built." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-10-15T18:48:04.069265+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 8.8.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 8.8.0 of undici.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 8.8.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-14T01:58:59.147149+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 8.8.0 of undici. not_affected \u2014 undici 8.8.0 already contains the upstream fix for CVE-2026-9675. The Receiver enforces maxPayloadSize against cumulative fragment bytes (#fragmentsBytes plus the incoming frame length) at every frame-length state, and also caps fragment count. All three vendor commits (b4c287b3, 32dbf0b3, c5ed7875) are ancestors of HEAD and were part of the upstream release before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 undici 8.8.0 already contains the upstream fix for CVE-2026-9675. The Receiver enforces maxPayloadSize against cumulative fragment bytes (#fragmentsBytes plus the incoming frame length) at every frame-length state, and also caps fragment count. All three vendor commits (b4c287b3, 32dbf0b3, c5ed7875) are ancestors of HEAD and were part of the upstream release before the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-13T20:11:39.195113+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 8.8.0 of undici. not_affected \u2014 Target undici 8.8.0 already contains the upstream fix \"fix(cache): trim qualified field names\" (cb105d7c, Matteo Collina). Field names in qualified private/no-cache lists are trimmed in parseCacheControlHeader, so \" authorization\" and \"\\tauthorization\" match 'authorization' in canCacheResponse and the response is not stored. The fix shipped in the upstream release the target is based on, with n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Target undici 8.8.0 already contains the upstream fix \"fix(cache): trim qualified field names\" (cb105d7c, Matteo Collina). Field names in qualified private/no-cache lists are trimmed in parseCacheControlHeader, so \" authorization\" and \"\\tauthorization\" match 'authorization' in canCacheResponse and the response is not stored. The fix shipped in the upstream release the target is based on, with n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-13T20:02:00.043521+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 8.8.0 of undici. not_affected \u2014 Target undici 8.8.0 already contains the upstream fix (5655ea43, \"fix(cookies): preserve values and parse SameSite strictly\"). parseSetCookie no longer percent-decodes cookie values, so no vulnerable pattern remains. The fix shipped in the upstream release, so this is an upstream-fix not_affected case.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 Target undici 8.8.0 already contains the upstream fix (5655ea43, \"fix(cookies): preserve values and parse SameSite strictly\"). parseSetCookie no longer percent-decodes cookie values, so no vulnerable pattern remains. The fix shipped in the upstream release, so this is an upstream-fix not_affected case." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.8.0", "identifiers": { "purl": "pkg:npm/undici@8.8.0" } } ], "timestamp": "2026-11-13T20:14:00.045604+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 8.8.0 of undici. not_affected \u2014 undici 8.8.0 already contains the upstream fix for CVE-2026-9697. ProxyAgent forwards requestTls to Socks5ProxyAgent, and Socks5ProxyAgent applies it to the tls.connect call that upgrades the SOCKS5 tunnel. Upstream commit 42d49559 is an ancestor of HEAD, and HEAD has no earlier TuxCare commit, so the fix shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 undici 8.8.0 already contains the upstream fix for CVE-2026-9697. ProxyAgent forwards requestTls to Socks5ProxyAgent, and Socks5ProxyAgent applies it to the tls.connect call that upgrades the SOCKS5 tunnel. Upstream commit 42d49559 is an ancestor of HEAD, and HEAD has no earlier TuxCare commit, so the fix shipped in the upstream release." } ] }