{
  "@id": "urn:uuid:ef993bcd-fdb2-4950-9fb2-6279a28a75d5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T02:50:04.890115+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/ws@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-31T12:28:33.638846+00:00",
      "status_notes": "Vulnerability CVE-2016-10518 affects version 7.4.0 of ws.",
      "vulnerability": {
        "name": "CVE-2016-10518"
      },
      "action_statement": "Vulnerability CVE-2016-10518 affects version 7.4.0 of ws."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/ws@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-31T12:28:33.638846+00:00",
      "status_notes": "Vulnerability CVE-2016-10542 affects version 7.4.0 of ws.",
      "vulnerability": {
        "name": "CVE-2016-10542"
      },
      "action_statement": "Vulnerability CVE-2016-10542 affects version 7.4.0 of ws."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/ws@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-19T20:51:00.268817+00:00",
      "status_notes": "Vulnerability CVE-2021-32640 affects version 7.4.0 of ws, and is fixed in 7.4.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2021-32640"
      },
      "action_statement": "Vulnerability CVE-2021-32640 affects version 7.4.0 of ws, and is fixed in 7.4.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/ws@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-19T20:51:00.268817+00:00",
      "status_notes": "Vulnerability CVE-2024-37890 affects version 7.4.0 of ws, and is fixed in 7.4.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2024-37890"
      },
      "action_statement": "Vulnerability CVE-2024-37890 affects version 7.4.0 of ws, and is fixed in 7.4.0-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/ws@7.4.0"
          }
        }
      ],
      "timestamp": "2026-11-04T02:50:04.890115+00:00",
      "status_notes": "Vulnerability CVE-2026-45736 does not affect version 7.4.0 of ws. not_affected \u2014 Version 7.4.0 is NOT AFFECTED by CVE-2026-45736. The vulnerability exists only in ws >= 8.0.0 < 8.20.1 where the close() method uses buf.set() with TypedArrays. Version 7.4.0 uses a different code structure (buf.write() only, no buf.set() call) that does not exhibit this vulnerability. The GitHub Security Advisory explicitly excludes version 7.x from the vulnerable range, and all TuxCare backpo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45736"
      },
      "impact_statement": "not_affected \u2014 Version 7.4.0 is NOT AFFECTED by CVE-2026-45736. The vulnerability exists only in ws >= 8.0.0 < 8.20.1 where the close() method uses buf.set() with TypedArrays. Version 7.4.0 uses a different code structure (buf.write() only, no buf.set() call) that does not exhibit this vulnerability. The GitHub Security Advisory explicitly excludes version 7.x from the vulnerable range, and all TuxCare backpo..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/ws@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-19T20:51:00.268817+00:00",
      "status_notes": "Vulnerability CVE-2026-48779 affects version 7.4.0 of ws, and is fixed in 7.4.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-48779"
      },
      "action_statement": "Vulnerability CVE-2026-48779 affects version 7.4.0 of ws, and is fixed in 7.4.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.4.0",
          "identifiers": {
            "purl": "pkg:npm/ws@7.4.0"
          }
        }
      ],
      "timestamp": "2026-10-31T12:28:33.638846+00:00",
      "status_notes": "Vulnerability GHSA-5v72-xg48-5rpm affects version 7.4.0 of ws.",
      "vulnerability": {
        "name": "GHSA-5v72-xg48-5rpm"
      },
      "action_statement": "Vulnerability GHSA-5v72-xg48-5rpm affects version 7.4.0 of ws."
    }
  ]
}