{
  "@id": "urn:uuid:e1f18f70-4365-49a0-b0cc-660e0c89283f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T02:17:00.047857+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.5.13",
          "identifiers": {
            "purl": "pkg:npm/ws@7.5.13"
          }
        }
      ],
      "timestamp": "2026-10-31T12:27:58.397026+00:00",
      "status_notes": "Vulnerability CVE-2016-10518 affects version 7.5.13 of ws.",
      "vulnerability": {
        "name": "CVE-2016-10518"
      },
      "action_statement": "Vulnerability CVE-2016-10518 affects version 7.5.13 of ws."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.5.13",
          "identifiers": {
            "purl": "pkg:npm/ws@7.5.13"
          }
        }
      ],
      "timestamp": "2026-10-31T12:27:58.397026+00:00",
      "status_notes": "Vulnerability CVE-2016-10542 affects version 7.5.13 of ws.",
      "vulnerability": {
        "name": "CVE-2016-10542"
      },
      "action_statement": "Vulnerability CVE-2016-10542 affects version 7.5.13 of ws."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.5.13",
          "identifiers": {
            "purl": "pkg:npm/ws@7.5.13"
          }
        }
      ],
      "timestamp": "2026-11-04T02:17:00.047857+00:00",
      "status_notes": "Vulnerability CVE-2021-32640 does not affect version 7.5.13 of ws. not_affected \u2014 Target version 7.5.13 is not affected by CVE-2021-32640. The vulnerable regex-based parsing of the Sec-Websocket-Protocol header has been replaced with a safe literal comma split followed by individual trimming. The fix was authored by upstream maintainer Luigi Pinca in commit 00c425ec, shipped in upstream version 7.4.6, and is present in the target version 7.5.13 that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-32640"
      },
      "impact_statement": "not_affected \u2014 Target version 7.5.13 is not affected by CVE-2021-32640. The vulnerable regex-based parsing of the Sec-Websocket-Protocol header has been replaced with a safe literal comma split followed by individual trimming. The fix was authored by upstream maintainer Luigi Pinca in commit 00c425ec, shipped in upstream version 7.4.6, and is present in the target version 7.5.13 that TuxCare onboarded."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.5.13",
          "identifiers": {
            "purl": "pkg:npm/ws@7.5.13"
          }
        }
      ],
      "timestamp": "2026-10-31T12:28:33.638846+00:00",
      "status_notes": "Vulnerability CVE-2024-37890 affects version 7.5.13 of ws.",
      "vulnerability": {
        "name": "CVE-2024-37890"
      },
      "action_statement": "Vulnerability CVE-2024-37890 affects version 7.5.13 of ws."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.5.13",
          "identifiers": {
            "purl": "pkg:npm/ws@7.5.13"
          }
        }
      ],
      "timestamp": "2026-10-31T12:28:33.638846+00:00",
      "status_notes": "Vulnerability CVE-2026-45736 affects version 7.5.13 of ws.",
      "vulnerability": {
        "name": "CVE-2026-45736"
      },
      "action_statement": "Vulnerability CVE-2026-45736 affects version 7.5.13 of ws."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.5.13",
          "identifiers": {
            "purl": "pkg:npm/ws@7.5.13"
          }
        }
      ],
      "timestamp": "2026-10-31T12:28:48.255901+00:00",
      "status_notes": "Vulnerability CVE-2026-48779 affects version 7.5.13 of ws.",
      "vulnerability": {
        "name": "CVE-2026-48779"
      },
      "action_statement": "Vulnerability CVE-2026-48779 affects version 7.5.13 of ws."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ws@7.5.13",
          "identifiers": {
            "purl": "pkg:npm/ws@7.5.13"
          }
        }
      ],
      "timestamp": "2026-10-31T12:27:58.397026+00:00",
      "status_notes": "Vulnerability GHSA-5v72-xg48-5rpm affects version 7.5.13 of ws.",
      "vulnerability": {
        "name": "GHSA-5v72-xg48-5rpm"
      },
      "action_statement": "Vulnerability GHSA-5v72-xg48-5rpm affects version 7.5.13 of ws."
    }
  ]
}