{
  "@id": "urn:uuid:fb672d47-0dec-47d0-883e-510e537cc218",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T03:22:00.074884+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:00.165420+00:00",
      "status_notes": "Vulnerability CVE-2018-3711 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2018-3711"
      },
      "action_statement": "Vulnerability CVE-2018-3711 affects version 5.10.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:00.165420+00:00",
      "status_notes": "Vulnerability CVE-2020-8192 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2020-8192"
      },
      "action_statement": "Vulnerability CVE-2020-8192 affects version 5.10.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:00.165420+00:00",
      "status_notes": "Vulnerability CVE-2022-39288 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2022-39288"
      },
      "action_statement": "Vulnerability CVE-2022-39288 affects version 5.10.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2022-41919 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2022-41919"
      },
      "action_statement": "Vulnerability CVE-2022-41919 affects version 5.10.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2025-32442 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2025-32442"
      },
      "action_statement": "Vulnerability CVE-2025-32442 affects version 5.10.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2026-107832 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-107832"
      },
      "action_statement": "Vulnerability CVE-2026-107832 affects version 5.10.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-11-02T11:21:38.011707+00:00",
      "status_notes": "Vulnerability CVE-2026-120216 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-120216"
      },
      "action_statement": "Vulnerability CVE-2026-120216 affects version 5.10.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16732 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-16732"
      },
      "action_statement": "Vulnerability CVE-2026-16732 affects version 5.10.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-18504 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-18504"
      },
      "action_statement": "Vulnerability CVE-2026-18504 affects version 5.10.0 of fastify."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-11-14T03:21:00.067138+00:00",
      "status_notes": "Vulnerability CVE-2026-25223 does not affect version 5.10.0 of fastify. not_affected \u2014 Not affected. The upstream fix commit 32d7b6add39d (James Sumners, \"Updated content-type header parsing\", #6414) is an ancestor of HEAD. It introduced lib/content-type.js, a strict Content-Type parser. The request media type used to select the body schema now comes from the same ContentType parse the body parser uses. A header such as \"application/json\\ta\" is rejected as invalid (415) before va...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-25223"
      },
      "impact_statement": "not_affected \u2014 Not affected. The upstream fix commit 32d7b6add39d (James Sumners, \"Updated content-type header parsing\", #6414) is an ancestor of HEAD. It introduced lib/content-type.js, a strict Content-Type parser. The request media type used to select the body schema now comes from the same ContentType parse the body parser uses. A header such as \"application/json\\ta\" is rejected as invalid (415) before va..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-11-14T03:22:00.074884+00:00",
      "status_notes": "Vulnerability CVE-2026-25224 does not affect version 5.10.0 of fastify. not_affected \u2014 Target (fastify 5.10.0) already contains the upstream fix for CVE-2026-25224. sendWebStream in lib/reply.js honors backpressure: it stops reading from the web stream when res.write() returns false and resumes only on 'drain'. The upstream fix commit eb111563 is an ancestor of HEAD and was shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-25224"
      },
      "impact_statement": "not_affected \u2014 Target (fastify 5.10.0) already contains the upstream fix for CVE-2026-25224. sendWebStream in lib/reply.js honors backpressure: it stops reading from the web stream when res.write() returns false and resumes only on 'drain'. The upstream fix commit eb111563 is an ancestor of HEAD and was shipped in the upstream release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2026-33806 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-33806"
      },
      "action_statement": "Vulnerability CVE-2026-33806 affects version 5.10.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2026-3419 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-3419"
      },
      "action_statement": "Vulnerability CVE-2026-3419 affects version 5.10.0 of fastify."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-11-14T03:22:00.074884+00:00",
      "status_notes": "Vulnerability CVE-2026-3635 does not affect version 5.10.0 of fastify. not_affected \u2014 The vulnerable pattern (forwarded host/proto read from any peer) is not present. In lib/request.js the `host` and `protocol` getters only honor X-Forwarded-Host/Proto when `proxyFn(socket.remoteAddress, 0)` passes. That gate came from upstream commits (Matteo Collina) that shipped in the upstream release TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-3635"
      },
      "impact_statement": "not_affected \u2014 The vulnerable pattern (forwarded host/proto read from any peer) is not present. In lib/request.js the `host` and `protocol` getters only honor X-Forwarded-Host/Proto when `proxyFn(socket.remoteAddress, 0)` passes. That gate came from upstream commits (Matteo Collina) that shipped in the upstream release TuxCare onboarded."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-09-30T23:54:00.098505+00:00",
      "status_notes": "Vulnerability CVE-2026-76169 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-76169"
      },
      "action_statement": "Vulnerability CVE-2026-76169 affects version 5.10.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-09-30T23:54:00.098505+00:00",
      "status_notes": "Vulnerability CVE-2026-84428 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-84428"
      },
      "action_statement": "Vulnerability CVE-2026-84428 affects version 5.10.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-09-30T23:54:00.098505+00:00",
      "status_notes": "Vulnerability CVE-2026-84469 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-84469"
      },
      "action_statement": "Vulnerability CVE-2026-84469 affects version 5.10.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-09-30T23:54:00.098505+00:00",
      "status_notes": "Vulnerability CVE-2026-84504 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-84504"
      },
      "action_statement": "Vulnerability CVE-2026-84504 affects version 5.10.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.10.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.10.0"
          }
        }
      ],
      "timestamp": "2026-10-01T00:02:00.286191+00:00",
      "status_notes": "Vulnerability CVE-2026-92081 affects version 5.10.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-92081"
      },
      "action_statement": "Vulnerability CVE-2026-92081 affects version 5.10.0 of fastify."
    }
  ]
}