{
  "@id": "urn:uuid:044fc644-ddcc-42e9-89df-e284ab7311f5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-11T05:13:00.126952+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40astrojs/webapi@2.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40astrojs/webapi@2.2.0"
          }
        }
      ],
      "timestamp": "2026-10-11T05:13:00.126952+00:00",
      "status_notes": "Vulnerability CVE-2024-56140 is a false positive for @astrojs/webapi 2.2.0. false_positive \u2014 CVE-2024-56140 is a wrong-project match. The vulnerability concerns the CSRF-protection middleware in the main 'astro' framework package, but the target being analyzed is '@astrojs/webapi' version 2.2.0 - a completely different package that provides Web API polyfills for Node.js. The @astrojs/webapi package has no CSRF middleware, no server framework functionality, and no dependency relationshi...",
      "vulnerability": {
        "name": "CVE-2024-56140"
      },
      "impact_statement": "false_positive \u2014 CVE-2024-56140 is a wrong-project match. The vulnerability concerns the CSRF-protection middleware in the main 'astro' framework package, but the target being analyzed is '@astrojs/webapi' version 2.2.0 - a completely different package that provides Web API polyfills for Node.js. The @astrojs/webapi package has no CSRF middleware, no server framework functionality, and no dependency relationshi..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40astrojs/webapi@2.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40astrojs/webapi@2.2.0"
          }
        }
      ],
      "timestamp": "2026-10-11T05:13:00.126952+00:00",
      "status_notes": "Vulnerability CVE-2024-56159 affects version 2.2.0 of @astrojs/webapi.",
      "vulnerability": {
        "name": "CVE-2024-56159"
      },
      "action_statement": "Vulnerability CVE-2024-56159 affects version 2.2.0 of @astrojs/webapi."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40astrojs/webapi@2.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40astrojs/webapi@2.2.0"
          }
        }
      ],
      "timestamp": "2026-10-11T05:13:00.126952+00:00",
      "status_notes": "Vulnerability CVE-2025-55303 affects version 2.2.0 of @astrojs/webapi.",
      "vulnerability": {
        "name": "CVE-2025-55303"
      },
      "action_statement": "Vulnerability CVE-2025-55303 affects version 2.2.0 of @astrojs/webapi."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40astrojs/webapi@2.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40astrojs/webapi@2.2.0"
          }
        }
      ],
      "timestamp": "2026-10-11T05:13:00.126952+00:00",
      "status_notes": "Vulnerability CVE-2025-61925 does not affect version 2.2.0 of @astrojs/webapi. not_affected \u2014 Target version 2.5.6 is not affected by CVE-2025-61925. The vulnerability requires processing of the X-Forwarded-Host header without validation, but this feature was not introduced until version 4.2.8 (commit 041fdd5c89, dated Jan 31 2024) as part of i18n domain support. Version 2.5.6 predates this feature by 1684 commits and does not process X-Forwarded-Host headers at all. The only forwarded ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-61925"
      },
      "impact_statement": "not_affected \u2014 Target version 2.5.6 is not affected by CVE-2025-61925. The vulnerability requires processing of the X-Forwarded-Host header without validation, but this feature was not introduced until version 4.2.8 (commit 041fdd5c89, dated Jan 31 2024) as part of i18n domain support. Version 2.5.6 predates this feature by 1684 commits and does not process X-Forwarded-Host headers at all. The only forwarded ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40astrojs/webapi@2.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40astrojs/webapi@2.2.0"
          }
        }
      ],
      "timestamp": "2026-10-11T05:13:00.126952+00:00",
      "status_notes": "Vulnerability CVE-2025-64757 affects version 2.2.0 of @astrojs/webapi.",
      "vulnerability": {
        "name": "CVE-2025-64757"
      },
      "action_statement": "Vulnerability CVE-2025-64757 affects version 2.2.0 of @astrojs/webapi."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40astrojs/webapi@2.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40astrojs/webapi@2.2.0"
          }
        }
      ],
      "timestamp": "2026-10-11T05:13:00.126952+00:00",
      "status_notes": "Vulnerability CVE-2025-64764 does not affect version 2.2.0 of @astrojs/webapi. Target version 2.2.0 is NOT AFFECTED by CVE-2025-64764 (Server Islands XSS). The vulnerability requires the Server Islands feature with its `/_server-islands/[name]` endpoint to process attacker-controlled `e=file` and `s` parameters. This feature was first introduced in Astro 4.12.0 (commit d495df5361, 2024-07-17), many versions after 2.2.0. Exhaustive searches confirmed: (1) no `/_server-islands` route handler exists, (2) no `server:defer` directive support, (3) no server-island infrastructure files, (4) the only injected route in v2.2.0 is `/_image` for image assets. Rule 5 Type A1: The CVE's INPUT (server islands requests) cannot be received anywhere in the target codebase because the feature does not exist.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-64764"
      },
      "impact_statement": "Target version 2.2.0 is NOT AFFECTED by CVE-2025-64764 (Server Islands XSS). The vulnerability requires the Server Islands feature with its `/_server-islands/[name]` endpoint to process attacker-controlled `e=file` and `s` parameters. This feature was first introduced in Astro 4.12.0 (commit d495df5361, 2024-07-17), many versions after 2.2.0. Exhaustive searches confirmed: (1) no `/_server-islands` route handler exists, (2) no `server:defer` directive support, (3) no server-island infrastructure files, (4) the only injected route in v2.2.0 is `/_image` for image assets. Rule 5 Type A1: The CVE's INPUT (server islands requests) cannot be received anywhere in the target codebase because the feature does not exist."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40astrojs/webapi@2.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40astrojs/webapi@2.2.0"
          }
        }
      ],
      "timestamp": "2026-10-11T05:13:00.126952+00:00",
      "status_notes": "Vulnerability CVE-2025-64765 affects version 2.2.0 of @astrojs/webapi.",
      "vulnerability": {
        "name": "CVE-2025-64765"
      },
      "action_statement": "Vulnerability CVE-2025-64765 affects version 2.2.0 of @astrojs/webapi."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40astrojs/webapi@2.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40astrojs/webapi@2.2.0"
          }
        }
      ],
      "timestamp": "2026-10-11T05:13:00.126952+00:00",
      "status_notes": "Vulnerability CVE-2025-65019 does not affect version 2.2.0 of @astrojs/webapi. not_affected \u2014 Astro v2.5.6 is NOT AFFECTED by CVE-2025-65019. The target version lacks the vulnerable code pattern described in the CVE. While v2.5.6 has an image optimization endpoint (/_image) that accepts data: URLs, it processes images SERVER-SIDE via fetch() and imageService.transform(), returning processed image data. The CVE's exploitation mechanism (302 redirect to data: URL causing browser JavaScrip...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-65019"
      },
      "impact_statement": "not_affected \u2014 Astro v2.5.6 is NOT AFFECTED by CVE-2025-65019. The target version lacks the vulnerable code pattern described in the CVE. While v2.5.6 has an image optimization endpoint (/_image) that accepts data: URLs, it processes images SERVER-SIDE via fetch() and imageService.transform(), returning processed image data. The CVE's exploitation mechanism (302 redirect to data: URL causing browser JavaScrip..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40astrojs/webapi@2.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40astrojs/webapi@2.2.0"
          }
        }
      ],
      "timestamp": "2026-10-11T05:13:00.126952+00:00",
      "status_notes": "Vulnerability CVE-2025-66202 affects version 2.2.0 of @astrojs/webapi.",
      "vulnerability": {
        "name": "CVE-2025-66202"
      },
      "action_statement": "Vulnerability CVE-2025-66202 affects version 2.2.0 of @astrojs/webapi."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40astrojs/webapi@2.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40astrojs/webapi@2.2.0"
          }
        }
      ],
      "timestamp": "2026-10-11T05:13:00.126952+00:00",
      "status_notes": "Vulnerability CVE-2026-33769 does not affect version 2.2.0 of @astrojs/webapi. not_affected \u2014 Target version Astro 2.5.6 does not have the vulnerable code. The CVE concerns a path bypass vulnerability in the matchPathname() function within packages/internal-helpers/src/remote.ts, which validates remotePatterns configuration for remote image URLs. This entire feature (remotePatterns support for remote images) was introduced in version 2.10.10 via commit d6b4943764 in August 2023. The tar...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-33769"
      },
      "impact_statement": "not_affected \u2014 Target version Astro 2.5.6 does not have the vulnerable code. The CVE concerns a path bypass vulnerability in the matchPathname() function within packages/internal-helpers/src/remote.ts, which validates remotePatterns configuration for remote image URLs. This entire feature (remotePatterns support for remote images) was introduced in version 2.10.10 via commit d6b4943764 in August 2023. The tar..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40astrojs/webapi@2.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40astrojs/webapi@2.2.0"
          }
        }
      ],
      "timestamp": "2026-10-11T05:13:00.126952+00:00",
      "status_notes": "Vulnerability CVE-2026-41067 affects version 2.2.0 of @astrojs/webapi.",
      "vulnerability": {
        "name": "CVE-2026-41067"
      },
      "action_statement": "Vulnerability CVE-2026-41067 affects version 2.2.0 of @astrojs/webapi."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40astrojs/webapi@2.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40astrojs/webapi@2.2.0"
          }
        }
      ],
      "timestamp": "2026-10-11T05:13:00.126952+00:00",
      "status_notes": "Vulnerability CVE-2026-50146 affects version 2.2.0 of @astrojs/webapi.",
      "vulnerability": {
        "name": "CVE-2026-50146"
      },
      "action_statement": "Vulnerability CVE-2026-50146 affects version 2.2.0 of @astrojs/webapi."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40astrojs/webapi@2.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40astrojs/webapi@2.2.0"
          }
        }
      ],
      "timestamp": "2026-10-11T05:13:00.126952+00:00",
      "status_notes": "Vulnerability CVE-2026-54298 affects version 2.2.0 of @astrojs/webapi.",
      "vulnerability": {
        "name": "CVE-2026-54298"
      },
      "action_statement": "Vulnerability CVE-2026-54298 affects version 2.2.0 of @astrojs/webapi."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40astrojs/webapi@2.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40astrojs/webapi@2.2.0"
          }
        }
      ],
      "timestamp": "2026-10-11T05:13:00.126952+00:00",
      "status_notes": "Vulnerability CVE-2026-54299 does not affect version 2.2.0 of @astrojs/webapi. Astro version 2.5.6 is NOT affected by CVE-2026-54299. The vulnerability requires a specific feature (HTTP fetching of prerendered error pages using the request URL origin) that was introduced in a later version (commit e3422aa423, August 2025). Version 2.5.6 renders all error pages in-process and never performs HTTP fetches for error pages, making the attack chain unreachable.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54299"
      },
      "impact_statement": "Astro version 2.5.6 is NOT affected by CVE-2026-54299. The vulnerability requires a specific feature (HTTP fetching of prerendered error pages using the request URL origin) that was introduced in a later version (commit e3422aa423, August 2025). Version 2.5.6 renders all error pages in-process and never performs HTTP fetches for error pages, making the attack chain unreachable."
    }
  ]
}