{
  "@id": "urn:uuid:e4c26496-2007-43c3-8b6f-247befb4b180",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T03:22:00.074884+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:00.165420+00:00",
      "status_notes": "Vulnerability CVE-2018-3711 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2018-3711"
      },
      "action_statement": "Vulnerability CVE-2018-3711 affects version 5.8.3 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:00.165420+00:00",
      "status_notes": "Vulnerability CVE-2020-8192 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2020-8192"
      },
      "action_statement": "Vulnerability CVE-2020-8192 affects version 5.8.3 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:00.165420+00:00",
      "status_notes": "Vulnerability CVE-2022-39288 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2022-39288"
      },
      "action_statement": "Vulnerability CVE-2022-39288 affects version 5.8.3 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2022-41919 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2022-41919"
      },
      "action_statement": "Vulnerability CVE-2022-41919 affects version 5.8.3 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:00.165420+00:00",
      "status_notes": "Vulnerability CVE-2025-32442 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2025-32442"
      },
      "action_statement": "Vulnerability CVE-2025-32442 affects version 5.8.3 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2026-107832 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-107832"
      },
      "action_statement": "Vulnerability CVE-2026-107832 affects version 5.8.3 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-11-02T11:21:38.011707+00:00",
      "status_notes": "Vulnerability CVE-2026-120216 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-120216"
      },
      "action_statement": "Vulnerability CVE-2026-120216 affects version 5.8.3 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16732 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-16732"
      },
      "action_statement": "Vulnerability CVE-2026-16732 affects version 5.8.3 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-18504 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-18504"
      },
      "action_statement": "Vulnerability CVE-2026-18504 affects version 5.8.3 of fastify."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-11-14T03:22:00.074884+00:00",
      "status_notes": "Vulnerability CVE-2026-25223 does not affect version 5.8.3 of fastify. not_affected \u2014 Target (fastify 5.8.3) already contains upstream fix commit 32d7b6ad (\"Updated content-type header parsing\", James Sumners, 2026-01-26). The strict ContentType parser rejects `application/json\\ta` as an invalid media type before any parser or validation runs, so the validation bypass does not occur. The fix shipped in the upstream release onboarded by TuxCare.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-25223"
      },
      "impact_statement": "not_affected \u2014 Target (fastify 5.8.3) already contains upstream fix commit 32d7b6ad (\"Updated content-type header parsing\", James Sumners, 2026-01-26). The strict ContentType parser rejects `application/json\\ta` as an invalid media type before any parser or validation runs, so the validation bypass does not occur. The fix shipped in the upstream release onboarded by TuxCare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-11-14T03:21:00.067138+00:00",
      "status_notes": "Vulnerability CVE-2026-25224 does not affect version 5.8.3 of fastify. not_affected \u2014 Target (fastify 5.8.3) already contains the upstream backpressure fix for CVE-2026-25224. sendWebStream in lib/reply.js stops reading from the ReadableStream when res.write() returns false and resumes only on 'drain'. The fix is commit eb11156396f6, authored upstream by hello@matteocollina.com. It is in the upstream release that TuxCare onboarded, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-25224"
      },
      "impact_statement": "not_affected \u2014 Target (fastify 5.8.3) already contains the upstream backpressure fix for CVE-2026-25224. sendWebStream in lib/reply.js stops reading from the ReadableStream when res.write() returns false and resumes only on 'drain'. The fix is commit eb11156396f6, authored upstream by hello@matteocollina.com. It is in the upstream release that TuxCare onboarded, so the verdict is not_affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33806 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-33806"
      },
      "action_statement": "Vulnerability CVE-2026-33806 affects version 5.8.3 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2026-3419 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-3419"
      },
      "action_statement": "Vulnerability CVE-2026-3419 affects version 5.8.3 of fastify."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-11-14T03:22:00.074884+00:00",
      "status_notes": "Vulnerability CVE-2026-3635 does not affect version 5.8.3 of fastify. not_affected \u2014 The target (fastify 5.8.3 per package.json) already contains the upstream fix, commit 4e1db5bd, which gates the request.host and request.protocol getters on the trust function for the connecting socket address. That commit was authored upstream (lzhao61@jh.edu, committed by hello@matteocollina.com). It is already in the upstream release TuxCare onboarded: the first TuxCare commit in HEAD's hist...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-3635"
      },
      "impact_statement": "not_affected \u2014 The target (fastify 5.8.3 per package.json) already contains the upstream fix, commit 4e1db5bd, which gates the request.host and request.protocol getters on the trust function for the connecting socket address. That commit was authored upstream (lzhao61@jh.edu, committed by hello@matteocollina.com). It is already in the upstream release TuxCare onboarded: the first TuxCare commit in HEAD's hist..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-09-30T23:54:00.098505+00:00",
      "status_notes": "Vulnerability CVE-2026-76169 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-76169"
      },
      "action_statement": "Vulnerability CVE-2026-76169 affects version 5.8.3 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-09-30T23:54:00.098505+00:00",
      "status_notes": "Vulnerability CVE-2026-84428 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-84428"
      },
      "action_statement": "Vulnerability CVE-2026-84428 affects version 5.8.3 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-09-30T23:54:00.098505+00:00",
      "status_notes": "Vulnerability CVE-2026-84469 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-84469"
      },
      "action_statement": "Vulnerability CVE-2026-84469 affects version 5.8.3 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-09-30T23:54:00.098505+00:00",
      "status_notes": "Vulnerability CVE-2026-84504 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-84504"
      },
      "action_statement": "Vulnerability CVE-2026-84504 affects version 5.8.3 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.3",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.3"
          }
        }
      ],
      "timestamp": "2026-10-01T00:02:00.286191+00:00",
      "status_notes": "Vulnerability CVE-2026-92081 affects version 5.8.3 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-92081"
      },
      "action_statement": "Vulnerability CVE-2026-92081 affects version 5.8.3 of fastify."
    }
  ]
}