{
  "@id": "urn:uuid:03d57bfb-a969-459d-b79d-dbb1d8b034d1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-15T21:35:00.382757+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-10-13T14:12:08.053071+00:00",
      "status_notes": "Vulnerability CVE-2024-24750 does not affect version 5.28.4 of undici-types. not_affected \u2014 Target version undici 5.28.4 is NOT AFFECTED by CVE-2024-24750. The vulnerability only affects versions 6.0.0 through 6.6.0 (fixed in 6.6.1). The vulnerable code construct\u2014a ReadableStream wrapper with async start() that drains data in an unbounded while(true) loop ignoring backpressure\u2014was introduced in the 6.x rewrite and does not exist in the 5.x codebase. Version 5.28.4 uses a fundamentally...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24750"
      },
      "impact_statement": "not_affected \u2014 Target version undici 5.28.4 is NOT AFFECTED by CVE-2024-24750. The vulnerability only affects versions 6.0.0 through 6.6.0 (fixed in 6.6.1). The vulnerable code construct\u2014a ReadableStream wrapper with async start() that drains data in an unbounded while(true) loop ignoring backpressure\u2014was introduced in the 6.x rewrite and does not exist in the 5.x codebase. Version 5.28.4 uses a fundamentally..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-10-13T14:11:00.164254+00:00",
      "status_notes": "Vulnerability CVE-2024-24758 does not affect version 5.28.4 of undici-types. not_affected \u2014 CVE-2024-24758: The target (undici 5.28.4) is NOT AFFECTED. The vulnerability concerning Proxy-Authorization header leakage on cross-origin redirects was fixed in upstream version 5.28.3. The target version 5.28.4 already contains the upstream fix (commit d3aa574b by Matteo Collina) which deletes the 'proxy-authorization' header during cross-origin redirects in the httpRedirectFetch function. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24758"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-24758: The target (undici 5.28.4) is NOT AFFECTED. The vulnerability concerning Proxy-Authorization header leakage on cross-origin redirects was fixed in upstream version 5.28.3. The target version 5.28.4 already contains the upstream fix (commit d3aa574b by Matteo Collina) which deletes the 'proxy-authorization' header during cross-origin redirects in the httpRedirectFetch function. T..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22150 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2025-22150"
      },
      "action_statement": "Vulnerability CVE-2025-22150 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-47279 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2025-47279"
      },
      "action_statement": "Vulnerability CVE-2025-47279 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-10-15T18:44:00.132301+00:00",
      "status_notes": "Vulnerability CVE-2026-109383 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2026-109383"
      },
      "action_statement": "Vulnerability CVE-2026-109383 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-109932 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2026-109932"
      },
      "action_statement": "Vulnerability CVE-2026-109932 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-11525 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2026-11525"
      },
      "action_statement": "Vulnerability CVE-2026-11525 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12151 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2026-12151"
      },
      "action_statement": "Vulnerability CVE-2026-12151 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-15157 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2026-15157"
      },
      "action_statement": "Vulnerability CVE-2026-15157 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1525 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2026-1525"
      },
      "action_statement": "Vulnerability CVE-2026-1525 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1526 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2026-1526"
      },
      "action_statement": "Vulnerability CVE-2026-1526 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1527 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2026-1527"
      },
      "action_statement": "Vulnerability CVE-2026-1527 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16728 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2026-16728"
      },
      "action_statement": "Vulnerability CVE-2026-16728 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16729 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2026-16729"
      },
      "action_statement": "Vulnerability CVE-2026-16729 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-29T18:46:58.638266+00:00",
      "status_notes": "Vulnerability CVE-2026-18540 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2026-18540"
      },
      "action_statement": "Vulnerability CVE-2026-18540 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22036 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2026-22036"
      },
      "action_statement": "Vulnerability CVE-2026-22036 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2229 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2026-2229"
      },
      "action_statement": "Vulnerability CVE-2026-2229 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6733 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2026-6733"
      },
      "action_statement": "Vulnerability CVE-2026-6733 affects version 5.28.4 of undici-types."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-10-15T18:47:21.529900+00:00",
      "status_notes": "Vulnerability CVE-2026-87018 affects version 5.28.4 of undici-types.",
      "vulnerability": {
        "name": "CVE-2026-87018"
      },
      "action_statement": "Vulnerability CVE-2026-87018 affects version 5.28.4 of undici-types."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/undici-types@5.28.4",
          "identifiers": {
            "purl": "pkg:npm/undici-types@5.28.4"
          }
        }
      ],
      "timestamp": "2026-10-13T14:15:48.189419+00:00",
      "status_notes": "Vulnerability CVE-2026-9679 does not affect version 5.28.4 of undici-types. not_affected \u2014 Target version 5.28.4 does not contain the vulnerable percent-decoding code pattern described in CVE-2026-9679. The vulnerability was introduced in undici 7.0.0 when `qsUnescape` was added to decode cookie values. Version 5.28.4 predates this introduction and returns cookie values as-is without any percent-decoding (lib/cookies/parse.js:80), preventing HTTP header injection even when applicatio...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9679"
      },
      "impact_statement": "not_affected \u2014 Target version 5.28.4 does not contain the vulnerable percent-decoding code pattern described in CVE-2026-9679. The vulnerability was introduced in undici 7.0.0 when `qsUnescape` was added to decode cookie values. Version 5.28.4 predates this introduction and returns cookie values as-is without any percent-decoding (lib/cookies/parse.js:80), preventing HTTP header injection even when applicatio..."
    }
  ]
}