{ "@id": "urn:uuid:f49560c0-2e59-442a-a143-dc9c356ad3bc", "role": "Document Creator", "author": "https://tuxcare.com", "version": 43, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:34:53.666741+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31150 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2022-31150" }, "action_statement": "Vulnerability CVE-2022-31150 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-31151 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2022-31151" }, "action_statement": "Vulnerability CVE-2022-31151 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-32210 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2022-32210" }, "action_statement": "Vulnerability CVE-2022-32210 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35948 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2022-35948" }, "action_statement": "Vulnerability CVE-2022-35948 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2022-35949 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2022-35949" }, "action_statement": "Vulnerability CVE-2022-35949 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-05T09:02:00.129046+00:00", "status_notes": "Vulnerability CVE-2023-23936 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2023-23936" }, "action_statement": "Vulnerability CVE-2023-23936 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2023-24807 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2023-24807" }, "action_statement": "Vulnerability CVE-2023-24807 affects version 8.9.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-14T00:07:00.231663+00:00", "status_notes": "Vulnerability CVE-2023-45143 does not affect version 8.9.0 of undici. not_affected \u2014 Undici 8.9.0 is not affected by CVE-2023-45143. The upstream fix e041de3 (author maitken033380023@gmail.com, committer noreply@github.com) is an ancestor of HEAD and shipped in the upstream release. On a cross-origin redirect, lib/web/fetch/index.js (httpRedirectFetch) deletes authorization, proxy-authorization, cookie and host. lib/handler/redirect-handler.js strips the same headers for dispat...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45143" }, "impact_statement": "not_affected \u2014 Undici 8.9.0 is not affected by CVE-2023-45143. The upstream fix e041de3 (author maitken033380023@gmail.com, committer noreply@github.com) is an ancestor of HEAD and shipped in the upstream release. On a cross-origin redirect, lib/web/fetch/index.js (httpRedirectFetch) deletes authorization, proxy-authorization, cookie and host. lib/handler/redirect-handler.js strips the same headers for dispat..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-24750 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2024-24750" }, "action_statement": "Vulnerability CVE-2024-24750 affects version 8.9.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T22:22:49.594925+00:00", "status_notes": "Vulnerability CVE-2024-24758 does not affect version 8.9.0 of undici. not_affected \u2014 The target already strips Proxy-Authorization on cross-origin redirects. This happens in both the fetch redirect path and the generic RedirectHandler. The fix is the upstream commit b9da3e40, which is an ancestor of the first TuxCare commit, so it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24758" }, "impact_statement": "not_affected \u2014 The target already strips Proxy-Authorization on cross-origin redirects. This happens in both the fetch redirect path and the generic RedirectHandler. The fix is the upstream commit b9da3e40, which is an ancestor of the first TuxCare commit, so it shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-14T00:33:45.023269+00:00", "status_notes": "Vulnerability CVE-2024-30260 does not affect version 8.9.0 of undici. not_affected \u2014 The target (undici 8.9.0, a plain upstream release with no TuxCare commits in HEAD history) already contains the upstream fix for CVE-2024-30260. The redirect handler drops authorization, proxy-authorization and cookie headers when a redirect changes origin. This applies to every dispatch-level caller, including undici.request() with maxRedirections.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30260" }, "impact_statement": "not_affected \u2014 The target (undici 8.9.0, a plain upstream release with no TuxCare commits in HEAD history) already contains the upstream fix for CVE-2024-30260. The redirect handler drops authorization, proxy-authorization and cookie headers when a redirect changes origin. This applies to every dispatch-level caller, including undici.request() with maxRedirections." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T23:48:00.073744+00:00", "status_notes": "Vulnerability CVE-2024-30261 does not affect version 8.9.0 of undici. not_affected \u2014 Not affected. The target (undici 8.9.0) already contains the upstream fix for CVE-2024-30261. Upstream commit d542b8cd (Matteo Collina, GHSA-9qxr-qj54-h672) is an ancestor of HEAD, and the integrity check in the target is spec-compliant. HEAD's history has no TuxCare/CloudLinux-domain commit, so the fix shipped with the upstream release and is not TuxCare-attributed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-30261" }, "impact_statement": "not_affected \u2014 Not affected. The target (undici 8.9.0) already contains the upstream fix for CVE-2024-30261. Upstream commit d542b8cd (Matteo Collina, GHSA-9qxr-qj54-h672) is an ancestor of HEAD, and the integrity check in the target is spec-compliant. HEAD's history has no TuxCare/CloudLinux-domain commit, so the fix shipped with the upstream release and is not TuxCare-attributed." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-05T09:03:00.085312+00:00", "status_notes": "Vulnerability CVE-2024-38372 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2024-38372" }, "action_statement": "Vulnerability CVE-2024-38372 affects version 8.9.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T21:31:44.249794+00:00", "status_notes": "Vulnerability CVE-2025-22150 does not affect version 8.9.0 of undici. not_affected \u2014 Undici 8.9.0 already contains the upstream fix for CVE-2025-22150. The multipart boundary is generated with node:crypto randomInt, not Math.random. The fix is upstream commit c2d78cd1 (author hello@matteocollina.com), which is in the upstream release. HEAD has no commit by a TuxCare-domain author.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22150" }, "impact_statement": "not_affected \u2014 Undici 8.9.0 already contains the upstream fix for CVE-2025-22150. The multipart boundary is generated with node:crypto randomInt, not Math.random. The fix is upstream commit c2d78cd1 (author hello@matteocollina.com), which is in the upstream release. HEAD has no commit by a TuxCare-domain author." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T21:41:43.943334+00:00", "status_notes": "Vulnerability CVE-2025-47279 does not affect version 8.9.0 of undici. not_affected \u2014 undici 8.9.0 already contains an upstream fix for the CVE-2025-47279 leak class. Agent in lib/dispatcher/agent.js removes and closes a per-origin client from its kClients map (and drops the origin from kOrigins) when that client emits 'disconnect' or 'connectionError' and has no connected sockets and is not busy. The fix commit is ab6ea16e (\"fix: memory leak in Agent (#4425)\"), authored by upst...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-47279" }, "impact_statement": "not_affected \u2014 undici 8.9.0 already contains an upstream fix for the CVE-2025-47279 leak class. Agent in lib/dispatcher/agent.js removes and closes a per-origin client from its kClients map (and drops the origin from kOrigins) when that client emits 'disconnect' or 'connectionError' and has no connected sockets and is not busy. The fix commit is ab6ea16e (\"fix: memory leak in Agent (#4425)\"), authored by upst..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-10-16T20:22:00.069315+00:00", "status_notes": "Vulnerability CVE-2026-109383 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-109383" }, "action_statement": "Vulnerability CVE-2026-109383 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-10-16T20:22:00.069315+00:00", "status_notes": "Vulnerability CVE-2026-109829 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-109829" }, "action_statement": "Vulnerability CVE-2026-109829 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-10-16T20:23:00.084126+00:00", "status_notes": "Vulnerability CVE-2026-109841 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-109841" }, "action_statement": "Vulnerability CVE-2026-109841 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-05T09:06:00.064776+00:00", "status_notes": "Vulnerability CVE-2026-109855 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-109855" }, "action_statement": "Vulnerability CVE-2026-109855 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-10-16T20:22:00.069315+00:00", "status_notes": "Vulnerability CVE-2026-109869 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-109869" }, "action_statement": "Vulnerability CVE-2026-109869 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-10-16T20:22:00.069315+00:00", "status_notes": "Vulnerability CVE-2026-109924 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-109924" }, "action_statement": "Vulnerability CVE-2026-109924 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-10-16T20:08:00.152629+00:00", "status_notes": "Vulnerability CVE-2026-109932 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-109932" }, "action_statement": "Vulnerability CVE-2026-109932 affects version 8.9.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T20:01:00.036985+00:00", "status_notes": "Vulnerability CVE-2026-11525 does not affect version 8.9.0 of undici. not_affected \u2014 undici 8.9.0 parses SameSite with strict case-insensitive equality, so the substring-matching flaw is not present. The upstream fix 5655ea43 ('fix(cookies): preserve values and parse SameSite strictly') is already in the v8.9.0 release that this target is built on.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-11525" }, "impact_statement": "not_affected \u2014 undici 8.9.0 parses SameSite with strict case-insensitive equality, so the substring-matching flaw is not present. The upstream fix 5655ea43 ('fix(cookies): preserve values and parse SameSite strictly') is already in the v8.9.0 release that this target is built on." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-116592 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-116592" }, "action_statement": "Vulnerability CVE-2026-116592 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-06T10:20:57.098620+00:00", "status_notes": "Vulnerability CVE-2026-116630 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-116630" }, "action_statement": "Vulnerability CVE-2026-116630 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120222 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-120222" }, "action_statement": "Vulnerability CVE-2026-120222 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120415 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-120415" }, "action_statement": "Vulnerability CVE-2026-120415 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-06T10:14:00.096681+00:00", "status_notes": "Vulnerability CVE-2026-120423 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-120423" }, "action_statement": "Vulnerability CVE-2026-120423 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-06T10:06:35.912230+00:00", "status_notes": "Vulnerability CVE-2026-120474 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-120474" }, "action_statement": "Vulnerability CVE-2026-120474 affects version 8.9.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T20:03:00.065439+00:00", "status_notes": "Vulnerability CVE-2026-12151 does not affect version 8.9.0 of undici. not_affected \u2014 undici 8.9.0 already contains the upstream fix (nodejs/undici 32dbf0b3, \"websocket: limit the number of fragments in a message\"). The receiver caps buffered fragments per message (default 131072) and fails the connection with 1008 when the cap is exceeded. The fix shipped in the upstream release, so this is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-12151" }, "impact_statement": "not_affected \u2014 undici 8.9.0 already contains the upstream fix (nodejs/undici 32dbf0b3, \"websocket: limit the number of fragments in a message\"). The receiver caps buffered fragments per message (default 131072) and fails the connection with 1008 when the cap is exceeded. The fix shipped in the upstream release, so this is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T20:09:00.046186+00:00", "status_notes": "Vulnerability CVE-2026-13697 does not affect version 8.9.0 of undici. not_affected \u2014 Target is undici 8.9.0, which is the fixed upstream release named in the advisory. The upstream fix commits 4fe5bc5f (empty qualified private directive), 9f09b49a (crash test), and c601fff1 (cache directive parsing hardening) are ancestors of HEAD. They were authored by Matteo Collina and Ulises Gascon, not TuxCare. HEAD has no TuxCare-domain commits. The qualified private/no-cache branch in li...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-13697" }, "impact_statement": "not_affected \u2014 Target is undici 8.9.0, which is the fixed upstream release named in the advisory. The upstream fix commits 4fe5bc5f (empty qualified private directive), 9f09b49a (crash test), and c601fff1 (cache directive parsing hardening) are ancestors of HEAD. They were authored by Matteo Collina and Ulises Gascon, not TuxCare. HEAD has no TuxCare-domain commits. The qualified private/no-cache branch in li..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T20:08:00.042663+00:00", "status_notes": "Vulnerability CVE-2026-14643 does not affect version 8.9.0 of undici. not_affected \u2014 Target undici 8.9.0 already contains the upstream fix. parseCacheControlHeader in lib/util/cache.js trims whitespace around '=' for qualified no-cache/private directives and parses the quoted field list. The fix is upstream commit c601fff1 (\"fix(cache): harden cache directive parsing\") by Matteo Collina. It is an ancestor of HEAD and ships in the upstream v8.9.0 release. HEAD has no TuxCare-dom...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-14643" }, "impact_statement": "not_affected \u2014 Target undici 8.9.0 already contains the upstream fix. parseCacheControlHeader in lib/util/cache.js trims whitespace around '=' for qualified no-cache/private directives and parses the quoted field list. The fix is upstream commit c601fff1 (\"fix(cache): harden cache directive parsing\") by Matteo Collina. It is an ancestor of HEAD and ships in the upstream v8.9.0 release. HEAD has no TuxCare-dom..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T20:05:06.156764+00:00", "status_notes": "Vulnerability CVE-2026-15157 does not affect version 8.9.0 of undici. not_affected \u2014 Target is undici 8.9.0, which already contains the upstream fix (commit 7d3cf924, \"fix: validate blob body content type\"). The blob-like body branch in lib/dispatcher/client-h1.js now runs body.type through isValidHeaderValue() and rejects the request if it is invalid. The fix shipped in the upstream release, so this is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-15157" }, "impact_statement": "not_affected \u2014 Target is undici 8.9.0, which already contains the upstream fix (commit 7d3cf924, \"fix: validate blob body content type\"). The blob-like body branch in lib/dispatcher/client-h1.js now runs body.type through isValidHeaderValue() and rejects the request if it is invalid. The fix shipped in the upstream release, so this is not_affected rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T21:51:37.743034+00:00", "status_notes": "Vulnerability CVE-2026-1525 does not affect version 8.9.0 of undici. not_affected \u2014 Not affected. The upstream fix for CVE-2026-1525 (duplicate content-length rejection) is already in HEAD (undici 8.9.0). lib/core/request.js lowercases header names and throws 'duplicate content-length header' on a second length header. The fix commit was authored upstream by Matteo Collina. The target has no TuxCare-authored commits, so the fix is upstream-shipped.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1525" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2026-1525 (duplicate content-length rejection) is already in HEAD (undici 8.9.0). lib/core/request.js lowercases header names and throws 'duplicate content-length header' on a second length header. The fix commit was authored upstream by Matteo Collina. The target has no TuxCare-authored commits, so the fix is upstream-shipped." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-1526 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-1526" }, "action_statement": "Vulnerability CVE-2026-1526 affects version 8.9.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T22:12:00.040260+00:00", "status_notes": "Vulnerability CVE-2026-1527 does not affect version 8.9.0 of undici. not_affected \u2014 Undici 8.9.0 is not affected by CVE-2026-1527. The upstream fix (77594f92, Matteo Collina) is already in HEAD. Request's constructor rejects non-string upgrade values and any upgrade value containing characters outside the valid header-value set, including CR and LF. This happens before client-h1.js writes `upgrade: ${upgrade}` to the socket. The fix shipped in the upstream release, and HEAD ha...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1527" }, "impact_statement": "not_affected \u2014 Undici 8.9.0 is not affected by CVE-2026-1527. The upstream fix (77594f92, Matteo Collina) is already in HEAD. Request's constructor rejects non-string upgrade values and any upgrade value containing characters outside the valid header-value set, including CR and LF. This happens before client-h1.js writes `upgrade: ${upgrade}` to the socket. The fix shipped in the upstream release, and HEAD ha..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T22:05:00.053359+00:00", "status_notes": "Vulnerability CVE-2026-1528 does not affect version 8.9.0 of undici. not_affected \u2014 undici 8.9.0 already contains the upstream fix for CVE-2026-1528 (commit 84235c62, 'Fix websocket 64-bit length overflow', by Matteo Collina). The ByteParser rejects 64-bit payload lengths with non-zero upper bits or lower bits above 2^31-1 and fails the connection with 1009, so it no longer reaches the invalid state and the fatal TypeError. The fix shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1528" }, "impact_statement": "not_affected \u2014 undici 8.9.0 already contains the upstream fix for CVE-2026-1528 (commit 84235c62, 'Fix websocket 64-bit length overflow', by Matteo Collina). The ByteParser rejects 64-bit payload lengths with non-zero upper bits or lower bits above 2^31-1 and fails the connection with 1009, so it no longer reaches the invalid state and the fatal TypeError. The fix shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T20:04:00.059662+00:00", "status_notes": "Vulnerability CVE-2026-16728 does not affect version 8.9.0 of undici. not_affected \u2014 Target is undici 8.9.0, which already includes the upstream fix e11a68ed (fix(retry): reject partial content length mismatch). It shipped in the upstream release and was authored by Matteo Collina; there is no TuxCare commit in HEAD's history. RetryHandler now rejects a 206 whose Content-Length does not equal its Content-Range span, so the stale-header scenario cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16728" }, "impact_statement": "not_affected \u2014 Target is undici 8.9.0, which already includes the upstream fix e11a68ed (fix(retry): reject partial content length mismatch). It shipped in the upstream release and was authored by Matteo Collina; there is no TuxCare commit in HEAD's history. RetryHandler now rejects a 206 whose Content-Length does not equal its Content-Range span, so the stale-header scenario cannot occur." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T20:07:00.106745+00:00", "status_notes": "Vulnerability CVE-2026-16729 does not affect version 8.9.0 of undici. not_affected \u2014 Target is undici 8.9.0, which already contains the upstream fix (commit 10d93fc3, \"harden cookie domain, path, and unparsed attribute validation\"). validateCookieDomain now enforces the RFC 1034 letter-digit-hyphen set, so ';' is rejected. Each unparsed entry's key and value go through validateCookieName and validateCookieValue, which reject ';'. The fix arrived with the upstream release, not t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-16729" }, "impact_statement": "not_affected \u2014 Target is undici 8.9.0, which already contains the upstream fix (commit 10d93fc3, \"harden cookie domain, path, and unparsed attribute validation\"). validateCookieDomain now enforces the RFC 1034 letter-digit-hyphen set, so ';' is rejected. Each unparsed entry's key and value go through validateCookieName and validateCookieValue, which reject ';'. The fix arrived with the upstream release, not t..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18149 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-18149" }, "action_statement": "Vulnerability CVE-2026-18149 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-18540 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-18540" }, "action_statement": "Vulnerability CVE-2026-18540 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-19534 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-19534" }, "action_statement": "Vulnerability CVE-2026-19534 affects version 8.9.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T21:47:00.051716+00:00", "status_notes": "Vulnerability CVE-2026-22036 does not affect version 8.9.0 of undici. not_affected \u2014 The target (undici 8.9.0) already caps the Content-Encoding chain at 5 in both fetch() and the decompress interceptor. The fix is upstream commit b04e3cbb, authored by Matteo Collina and committed through GitHub. It is already in the upstream release that TuxCare onboarded. Only the final automation commit (\"Add tuxcare.yaml build configuration\") is TuxCare-side. The target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22036" }, "impact_statement": "not_affected \u2014 The target (undici 8.9.0) already caps the Content-Encoding chain at 5 in both fetch() and the decompress interceptor. The fix is upstream commit b04e3cbb, authored by Matteo Collina and committed through GitHub. It is already in the upstream release that TuxCare onboarded. Only the final automation commit (\"Add tuxcare.yaml build configuration\") is TuxCare-side. The target is not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-05T09:03:43.285238+00:00", "status_notes": "Vulnerability CVE-2026-2229 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-2229" }, "action_statement": "Vulnerability CVE-2026-2229 affects version 8.9.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-14T01:40:03.504280+00:00", "status_notes": "Vulnerability CVE-2026-2581 does not affect version 8.9.0 of undici. not_affected \u2014 The upstream fix, commit 5890c7b7 \"fix(deduplicate): stream response chunks to waiting handlers\", is already in this tree (undici 8.9.0). Its author and committer are the upstream maintainer, and it predates the 8.9.0 bump commit 21a8e1ed. The deduplication handler streams chunks and refuses late attachment once body data has started, so the vulnerable accumulation pattern is gone.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2581" }, "impact_statement": "not_affected \u2014 The upstream fix, commit 5890c7b7 \"fix(deduplicate): stream response chunks to waiting handlers\", is already in this tree (undici 8.9.0). Its author and committer are the upstream maintainer, and it predates the 8.9.0 bump commit 21a8e1ed. The deduplication handler streams chunks and refuses late attachment once body data has started, so the vulnerable accumulation pattern is gone." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T19:58:35.243229+00:00", "status_notes": "Vulnerability CVE-2026-6733 does not affect version 8.9.0 of undici. not_affected \u2014 undici 8.9.0 already contains the upstream fix for CVE-2026-6733 (GHSA-35p6-xmwp-9g52). The idle-socket validation commits 6ea54ef8, c9fbe9d2 and ac5394b8 are ancestors of HEAD. They landed before the 8.5.0 bump. They are authored by Matteo Collina, who is outside the TuxCare domains. HEAD contains no TuxCare-domain commit, only an automation commit that adds tuxcare.yaml. So this is an upstrea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6733" }, "impact_statement": "not_affected \u2014 undici 8.9.0 already contains the upstream fix for CVE-2026-6733 (GHSA-35p6-xmwp-9g52). The idle-socket validation commits 6ea54ef8, c9fbe9d2 and ac5394b8 are ancestors of HEAD. They landed before the 8.5.0 bump. They are authored by Matteo Collina, who is outside the TuxCare domains. HEAD contains no TuxCare-domain commit, only an automation commit that adds tuxcare.yaml. So this is an upstrea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T20:10:07.561437+00:00", "status_notes": "Vulnerability CVE-2026-6734 does not affect version 8.9.0 of undici. not_affected \u2014 undici 8.9.0 already contains the upstream fix for CVE-2026-6734. Socks5ProxyAgent keeps a Map of Pools keyed by origin and builds each Pool's SOCKS5 connect function from that origin. Requests to different origins can no longer share the first origin's pool. The fix is upstream commit a516f870, which is an ancestor of HEAD. HEAD has no TuxCare-authored commits, so this is an upstream fix and n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6734" }, "impact_statement": "not_affected \u2014 undici 8.9.0 already contains the upstream fix for CVE-2026-6734. Socks5ProxyAgent keeps a Map of Pools keyed by origin and builds each Pool's SOCKS5 connect function from that origin. Requests to different origins can no longer share the first origin's pool. The fix is upstream commit a516f870, which is an ancestor of HEAD. HEAD has no TuxCare-authored commits, so this is an upstream fix and n..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-84890 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-84890" }, "action_statement": "Vulnerability CVE-2026-84890 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-09-29T18:42:25.726548+00:00", "status_notes": "Vulnerability CVE-2026-84933 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-84933" }, "action_statement": "Vulnerability CVE-2026-84933 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84947 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-84947" }, "action_statement": "Vulnerability CVE-2026-84947 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-09-29T18:33:13.066425+00:00", "status_notes": "Vulnerability CVE-2026-84961 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-84961" }, "action_statement": "Vulnerability CVE-2026-84961 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-09-29T18:38:31.258833+00:00", "status_notes": "Vulnerability CVE-2026-85008 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-85008" }, "action_statement": "Vulnerability CVE-2026-85008 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-09-29T18:27:17.765346+00:00", "status_notes": "Vulnerability CVE-2026-85014 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-85014" }, "action_statement": "Vulnerability CVE-2026-85014 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-09-28T21:56:00.190980+00:00", "status_notes": "Vulnerability CVE-2026-85024 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-85024" }, "action_statement": "Vulnerability CVE-2026-85024 affects version 8.9.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-14T02:34:53.666741+00:00", "status_notes": "Vulnerability CVE-2026-85152 does not affect version 8.9.0 of undici. not_affected \u2014 Target is undici 8.9.0. The CVE says the flaw was introduced in 8.10.0 and affects 8.10.0 and 8.10.1. In 8.9.0, the cache and deduplication keys always include the destination origin. Requests with no origin bypass both interceptors, so a response from one origin cannot be keyed together with another origin's response.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-85152" }, "impact_statement": "not_affected \u2014 Target is undici 8.9.0. The CVE says the flaw was introduced in 8.10.0 and affects 8.10.0 and 8.10.1. In 8.9.0, the cache and deduplication keys always include the destination origin. Requests with no origin bypass both interceptors, so a response from one origin cannot be keyed together with another origin's response." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-10-16T20:08:00.152629+00:00", "status_notes": "Vulnerability CVE-2026-87018 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-87018" }, "action_statement": "Vulnerability CVE-2026-87018 affects version 8.9.0 of undici." }, { "status": "affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-10-16T20:08:00.152629+00:00", "status_notes": "Vulnerability CVE-2026-87029 affects version 8.9.0 of undici.", "vulnerability": { "name": "CVE-2026-87029" }, "action_statement": "Vulnerability CVE-2026-87029 affects version 8.9.0 of undici." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-14T02:06:45.296491+00:00", "status_notes": "Vulnerability CVE-2026-9675 does not affect version 8.9.0 of undici. not_affected \u2014 undici 8.9.0 already contains the upstream fix for CVE-2026-9675. The fix commits b4c287b3 (\"enforce max payload size across fragments\"), 32dbf0b3 (fragment-count limit) and c5ed7875 (empty fragments and stream limits) are all ancestors of HEAD. They were authored upstream by Matteo Collina and Luigi Pinca. All predate the first TuxCare commit (8a2c1471, an automation-authored tuxcare.yaml-only...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9675" }, "impact_statement": "not_affected \u2014 undici 8.9.0 already contains the upstream fix for CVE-2026-9675. The fix commits b4c287b3 (\"enforce max payload size across fragments\"), 32dbf0b3 (fragment-count limit) and c5ed7875 (empty fragments and stream limits) are all ancestors of HEAD. They were authored upstream by Matteo Collina and Luigi Pinca. All predate the first TuxCare commit (8a2c1471, an automation-authored tuxcare.yaml-only..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T20:11:32.988243+00:00", "status_notes": "Vulnerability CVE-2026-9678 does not affect version 8.9.0 of undici. not_affected \u2014 Not affected. The target (undici 8.9.0) already trims optional whitespace (spaces and tabs) from each qualified private/no-cache field name when the Cache-Control header is parsed. So private=\" authorization\" and no-cache=\"\\tauthorization\" yield 'authorization', and canCacheResponse refuses to store the response. The hardening shipped in the upstream release through commit c601fff1 (Matteo Coll...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9678" }, "impact_statement": "not_affected \u2014 Not affected. The target (undici 8.9.0) already trims optional whitespace (spaces and tabs) from each qualified private/no-cache field name when the Cache-Control header is parsed. So private=\" authorization\" and no-cache=\"\\tauthorization\" yield 'authorization', and canCacheResponse refuses to store the response. The hardening shipped in the upstream release through commit c601fff1 (Matteo Coll..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T20:02:00.043521+00:00", "status_notes": "Vulnerability CVE-2026-9679 does not affect version 8.9.0 of undici. not_affected \u2014 Not affected. The target (undici 8.9.0) already contains the upstream fix 5655ea43 (same title as d0574cc4). parseSetCookie no longer percent-decodes cookie values, so the qsUnescape call and its import are gone.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9679" }, "impact_statement": "not_affected \u2014 Not affected. The target (undici 8.9.0) already contains the upstream fix 5655ea43 (same title as d0574cc4). parseSetCookie no longer percent-decodes cookie values, so the qsUnescape call and its import are gone." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/undici@8.9.0", "identifiers": { "purl": "pkg:npm/undici@8.9.0" } } ], "timestamp": "2026-11-13T20:18:00.067289+00:00", "status_notes": "Vulnerability CVE-2026-9697 does not affect version 8.9.0 of undici. not_affected \u2014 Target undici 8.9.0 already contains the upstream fix for CVE-2026-9697 (commit 42d4955, \"fix: honor requestTls when proxy is SOCKS5\"). ProxyAgent passes requestTls to Socks5ProxyAgent, which applies it to the TLS upgrade of the tunneled socket. The fix shipped in the upstream release, so the verdict is not_affected and not already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9697" }, "impact_statement": "not_affected \u2014 Target undici 8.9.0 already contains the upstream fix for CVE-2026-9697 (commit 42d4955, \"fix: honor requestTls when proxy is SOCKS5\"). ProxyAgent passes requestTls to Socks5ProxyAgent, which applies it to the TLS upgrade of the tunneled socket. The fix shipped in the upstream release, so the verdict is not_affected and not already_fixed." } ] }