{
  "@id": "urn:uuid:16d23ec9-3acd-479e-9001-fc15e85c4462",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-15T06:15:16.636848+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-11-14T23:16:00.034479+00:00",
      "status_notes": "Vulnerability CVE-2026-123561 affects version 5.6.4 of devalue, and is fixed in 5.6.4-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-123561"
      },
      "action_statement": "Vulnerability CVE-2026-123561 affects version 5.6.4 of devalue, and is fixed in 5.6.4-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123562 affects version 5.6.4 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123562"
      },
      "action_statement": "Vulnerability CVE-2026-123562 affects version 5.6.4 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123563 affects version 5.6.4 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123563"
      },
      "action_statement": "Vulnerability CVE-2026-123563 affects version 5.6.4 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123564 affects version 5.6.4 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123564"
      },
      "action_statement": "Vulnerability CVE-2026-123564 affects version 5.6.4 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-11-15T06:15:16.636848+00:00",
      "status_notes": "Vulnerability CVE-2026-123565 affects version 5.6.4 of devalue, and is fixed in 5.6.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-123565"
      },
      "action_statement": "Vulnerability CVE-2026-123565 affects version 5.6.4 of devalue, and is fixed in 5.6.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123566 affects version 5.6.4 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123566"
      },
      "action_statement": "Vulnerability CVE-2026-123566 affects version 5.6.4 of devalue."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-11-13T21:35:52.743365+00:00",
      "status_notes": "Vulnerability CVE-2026-123567 does not affect version 5.6.4 of devalue. not_affected \u2014 devalue 5.6.4 already contains the upstream fix. src/parse.js rejects any '__proto__' key on every object-reconstruction path (plain objects, 'null'-prototype objects, boxed 'Object'). The fix commits 87c1f3c and 40f1db1 are upstream-authored and are ancestors of HEAD, inside the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-123567"
      },
      "impact_statement": "not_affected \u2014 devalue 5.6.4 already contains the upstream fix. src/parse.js rejects any '__proto__' key on every object-reconstruction path (plain objects, 'null'-prototype objects, boxed 'Object'). The fix commits 87c1f3c and 40f1db1 are upstream-authored and are ancestors of HEAD, inside the upstream release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123568 affects version 5.6.4 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123568"
      },
      "action_statement": "Vulnerability CVE-2026-123568 affects version 5.6.4 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-11-08T01:46:48.037524+00:00",
      "status_notes": "Vulnerability CVE-2026-123569 affects version 5.6.4 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-123569"
      },
      "action_statement": "Vulnerability CVE-2026-123569 affects version 5.6.4 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42570 affects version 5.6.4 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-42570"
      },
      "action_statement": "Vulnerability CVE-2026-42570 affects version 5.6.4 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-11-14T23:16:00.034479+00:00",
      "status_notes": "Vulnerability CVE-2026-81176 affects version 5.6.4 of devalue, and is fixed in 5.6.4-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-81176"
      },
      "action_statement": "Vulnerability CVE-2026-81176 affects version 5.6.4 of devalue, and is fixed in 5.6.4-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-10-01T15:25:17.861384+00:00",
      "status_notes": "Vulnerability CVE-2026-92708 affects version 5.6.4 of devalue.",
      "vulnerability": {
        "name": "CVE-2026-92708"
      },
      "action_statement": "Vulnerability CVE-2026-92708 affects version 5.6.4 of devalue."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-11-13T21:30:00.606277+00:00",
      "status_notes": "Vulnerability GHSA-4q55-j62x-fr9h does not affect version 5.6.4 of devalue. not_affected \u2014 devalue 5.6.4 already contains the upstream fix for GHSA-4q55-j62x-fr9h. parse/unflatten in src/parse.js throws on `__proto__` keys in every object-construction path ('Object' wrapper, 'null' prototype objects, plain objects). The fix was authored upstream by Elliott Johnson (commit 87c1f3c, upstream release 5.6.4) and was in the code before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-4q55-j62x-fr9h"
      },
      "impact_statement": "not_affected \u2014 devalue 5.6.4 already contains the upstream fix for GHSA-4q55-j62x-fr9h. parse/unflatten in src/parse.js throws on `__proto__` keys in every object-construction path ('Object' wrapper, 'null' prototype objects, plain objects). The fix was authored upstream by Elliott Johnson (commit 87c1f3c, upstream release 5.6.4) and was in the code before the first TuxCare commit."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-10-01T15:25:17.861384+00:00",
      "status_notes": "Vulnerability GHSA-hx4r-w6wj-j8fg affects version 5.6.4 of devalue.",
      "vulnerability": {
        "name": "GHSA-hx4r-w6wj-j8fg"
      },
      "action_statement": "Vulnerability GHSA-hx4r-w6wj-j8fg affects version 5.6.4 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-11-15T06:15:16.636848+00:00",
      "status_notes": "Vulnerability GHSA-mcm9-63f2-9j32 affects version 5.6.4 of devalue, and is fixed in 5.6.4-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-mcm9-63f2-9j32"
      },
      "action_statement": "Vulnerability GHSA-mcm9-63f2-9j32 affects version 5.6.4 of devalue, and is fixed in 5.6.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-10-01T15:25:17.861384+00:00",
      "status_notes": "Vulnerability GHSA-r9w8-h9r3-54w4 affects version 5.6.4 of devalue.",
      "vulnerability": {
        "name": "GHSA-r9w8-h9r3-54w4"
      },
      "action_statement": "Vulnerability GHSA-r9w8-h9r3-54w4 affects version 5.6.4 of devalue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/devalue@5.6.4",
          "identifiers": {
            "purl": "pkg:npm/devalue@5.6.4"
          }
        }
      ],
      "timestamp": "2026-10-01T15:25:17.861384+00:00",
      "status_notes": "Vulnerability GHSA-wf3x-273g-mvxv affects version 5.6.4 of devalue.",
      "vulnerability": {
        "name": "GHSA-wf3x-273g-mvxv"
      },
      "action_statement": "Vulnerability GHSA-wf3x-273g-mvxv affects version 5.6.4 of devalue."
    }
  ]
}