{
  "@id": "urn:uuid:4fbc2631-6d68-4a04-bc48-8bcbc3b25bfd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-12T19:40:00.143781+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fast-uri@3.1.5",
          "identifiers": {
            "purl": "pkg:npm/fast-uri@3.1.5"
          }
        }
      ],
      "timestamp": "2026-10-06T12:51:00.262915+00:00",
      "status_notes": "Vulnerability CVE-2026-16221 does not affect version 3.1.5 of fast-uri. The target fast-uri v3.1.5 is not affected by CVE-2026-16221. The vulnerability pattern (literal backslash in URI authority causing host-parsing divergence between fast-uri and Node's WHATWG URL) has been removed by upstream vendor fix commit 2d50fba authored by Matteo Collina. The fix rejects URIs containing literal backslash in the authority component by setting a parse error, preventing the host extraction difference that enables SSRF/redirect bypasses. This is an upstream vendor fix incorporated into v3.1.5, not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-16221"
      },
      "impact_statement": "The target fast-uri v3.1.5 is not affected by CVE-2026-16221. The vulnerability pattern (literal backslash in URI authority causing host-parsing divergence between fast-uri and Node's WHATWG URL) has been removed by upstream vendor fix commit 2d50fba authored by Matteo Collina. The fix rejects URIs containing literal backslash in the authority component by setting a parse error, preventing the host extraction difference that enables SSRF/redirect bypasses. This is an upstream vendor fix incorporated into v3.1.5, not a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-uri@3.1.5",
          "identifiers": {
            "purl": "pkg:npm/fast-uri@3.1.5"
          }
        }
      ],
      "timestamp": "2026-10-01T13:26:37.692920+00:00",
      "status_notes": "Vulnerability CVE-2026-75899 affects version 3.1.5 of fast-uri, and is fixed in 3.1.5-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-75899"
      },
      "action_statement": "Vulnerability CVE-2026-75899 affects version 3.1.5 of fast-uri, and is fixed in 3.1.5-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-uri@3.1.5",
          "identifiers": {
            "purl": "pkg:npm/fast-uri@3.1.5"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability CVE-2026-75931 affects version 3.1.5 of fast-uri, and is fixed in 3.1.5-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-75931"
      },
      "action_statement": "Vulnerability CVE-2026-75931 affects version 3.1.5 of fast-uri, and is fixed in 3.1.5-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-uri@3.1.5",
          "identifiers": {
            "purl": "pkg:npm/fast-uri@3.1.5"
          }
        }
      ],
      "timestamp": "2026-10-01T13:26:37.692920+00:00",
      "status_notes": "Vulnerability CVE-2026-75975 affects version 3.1.5 of fast-uri, and is fixed in 3.1.5-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-75975"
      },
      "action_statement": "Vulnerability CVE-2026-75975 affects version 3.1.5 of fast-uri, and is fixed in 3.1.5-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-uri@3.1.5",
          "identifiers": {
            "purl": "pkg:npm/fast-uri@3.1.5"
          }
        }
      ],
      "timestamp": "2026-10-01T13:26:37.692920+00:00",
      "status_notes": "Vulnerability CVE-2026-76172 affects version 3.1.5 of fast-uri, and is fixed in 3.1.5-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-76172"
      },
      "action_statement": "Vulnerability CVE-2026-76172 affects version 3.1.5 of fast-uri, and is fixed in 3.1.5-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-uri@3.1.5",
          "identifiers": {
            "purl": "pkg:npm/fast-uri@3.1.5"
          }
        }
      ],
      "timestamp": "2026-10-12T19:40:00.143781+00:00",
      "status_notes": "Vulnerability CVE-2026-84292 affects version 3.1.5 of fast-uri, and is fixed in 3.1.5-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-84292"
      },
      "action_statement": "Vulnerability CVE-2026-84292 affects version 3.1.5 of fast-uri, and is fixed in 3.1.5-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-uri@3.1.5",
          "identifiers": {
            "purl": "pkg:npm/fast-uri@3.1.5"
          }
        }
      ],
      "timestamp": "2026-10-01T13:54:37.298140+00:00",
      "status_notes": "Vulnerability CVE-2026-86472 affects version 3.1.5 of fast-uri, and is fixed in 3.1.5-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-86472"
      },
      "action_statement": "Vulnerability CVE-2026-86472 affects version 3.1.5 of fast-uri, and is fixed in 3.1.5-tuxcare.3."
    }
  ]
}