{
  "@id": "urn:uuid:91e04d61-0b92-43a0-8510-f6defdf1afcd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T02:04:15.585197+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@6.2.3",
          "identifiers": {
            "purl": "pkg:npm/ws@6.2.3"
          }
        }
      ],
      "timestamp": "2026-10-31T12:27:58.397026+00:00",
      "status_notes": "Vulnerability CVE-2016-10518 affects version 6.2.3 of ws.",
      "vulnerability": {
        "name": "CVE-2016-10518"
      },
      "action_statement": "Vulnerability CVE-2016-10518 affects version 6.2.3 of ws."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@6.2.3",
          "identifiers": {
            "purl": "pkg:npm/ws@6.2.3"
          }
        }
      ],
      "timestamp": "2026-10-31T12:27:58.397026+00:00",
      "status_notes": "Vulnerability CVE-2016-10542 affects version 6.2.3 of ws.",
      "vulnerability": {
        "name": "CVE-2016-10542"
      },
      "action_statement": "Vulnerability CVE-2016-10542 affects version 6.2.3 of ws."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ws@6.2.3",
          "identifiers": {
            "purl": "pkg:npm/ws@6.2.3"
          }
        }
      ],
      "timestamp": "2026-11-04T02:04:15.585197+00:00",
      "status_notes": "Vulnerability CVE-2021-32640 does not affect version 6.2.3 of ws. not_affected \u2014 CVE-2021-32640 ReDoS vulnerability is NOT present in target ws@6.2.3-tuxcare.1. The vulnerable code pattern (protocol.trim().split(/ *, */)) has been replaced with the secure implementation (protocol.split(',').map(trim)) in upstream commit 78c676d2 by Luigi Pinca, which was already included in the upstream release that TuxCare onboarded. The fix eliminates the regex-based backtracking vulnerab...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-32640"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-32640 ReDoS vulnerability is NOT present in target ws@6.2.3-tuxcare.1. The vulnerable code pattern (protocol.trim().split(/ *, */)) has been replaced with the secure implementation (protocol.split(',').map(trim)) in upstream commit 78c676d2 by Luigi Pinca, which was already included in the upstream release that TuxCare onboarded. The fix eliminates the regex-based backtracking vulnerab..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@6.2.3",
          "identifiers": {
            "purl": "pkg:npm/ws@6.2.3"
          }
        }
      ],
      "timestamp": "2026-10-31T12:28:33.638846+00:00",
      "status_notes": "Vulnerability CVE-2024-37890 affects version 6.2.3 of ws.",
      "vulnerability": {
        "name": "CVE-2024-37890"
      },
      "action_statement": "Vulnerability CVE-2024-37890 affects version 6.2.3 of ws."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@6.2.3",
          "identifiers": {
            "purl": "pkg:npm/ws@6.2.3"
          }
        }
      ],
      "timestamp": "2026-10-31T12:28:33.638846+00:00",
      "status_notes": "Vulnerability CVE-2026-45736 affects version 6.2.3 of ws.",
      "vulnerability": {
        "name": "CVE-2026-45736"
      },
      "action_statement": "Vulnerability CVE-2026-45736 affects version 6.2.3 of ws."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@6.2.3",
          "identifiers": {
            "purl": "pkg:npm/ws@6.2.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48779 affects version 6.2.3 of ws, and is fixed in 6.2.3-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-48779"
      },
      "action_statement": "Vulnerability CVE-2026-48779 affects version 6.2.3 of ws, and is fixed in 6.2.3-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@6.2.3",
          "identifiers": {
            "purl": "pkg:npm/ws@6.2.3"
          }
        }
      ],
      "timestamp": "2026-10-31T12:27:58.397026+00:00",
      "status_notes": "Vulnerability GHSA-5v72-xg48-5rpm affects version 6.2.3 of ws.",
      "vulnerability": {
        "name": "GHSA-5v72-xg48-5rpm"
      },
      "action_statement": "Vulnerability GHSA-5v72-xg48-5rpm affects version 6.2.3 of ws."
    }
  ]
}