{
  "@id": "urn:uuid:a445572c-198e-46f8-8028-fd7530756e35",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-15T06:49:33.827526+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:00.165420+00:00",
      "status_notes": "Vulnerability CVE-2018-3711 affects version 5.8.4 of fastify.",
      "vulnerability": {
        "name": "CVE-2018-3711"
      },
      "action_statement": "Vulnerability CVE-2018-3711 affects version 5.8.4 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:00.165420+00:00",
      "status_notes": "Vulnerability CVE-2020-8192 affects version 5.8.4 of fastify.",
      "vulnerability": {
        "name": "CVE-2020-8192"
      },
      "action_statement": "Vulnerability CVE-2020-8192 affects version 5.8.4 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:00.165420+00:00",
      "status_notes": "Vulnerability CVE-2022-39288 affects version 5.8.4 of fastify.",
      "vulnerability": {
        "name": "CVE-2022-39288"
      },
      "action_statement": "Vulnerability CVE-2022-39288 affects version 5.8.4 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2022-41919 affects version 5.8.4 of fastify.",
      "vulnerability": {
        "name": "CVE-2022-41919"
      },
      "action_statement": "Vulnerability CVE-2022-41919 affects version 5.8.4 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:00.165420+00:00",
      "status_notes": "Vulnerability CVE-2025-32442 affects version 5.8.4 of fastify.",
      "vulnerability": {
        "name": "CVE-2025-32442"
      },
      "action_statement": "Vulnerability CVE-2025-32442 affects version 5.8.4 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2026-107832 affects version 5.8.4 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-107832"
      },
      "action_statement": "Vulnerability CVE-2026-107832 affects version 5.8.4 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-11-02T11:21:38.011707+00:00",
      "status_notes": "Vulnerability CVE-2026-120216 affects version 5.8.4 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-120216"
      },
      "action_statement": "Vulnerability CVE-2026-120216 affects version 5.8.4 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16732 affects version 5.8.4 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-16732"
      },
      "action_statement": "Vulnerability CVE-2026-16732 affects version 5.8.4 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-18504 affects version 5.8.4 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-18504"
      },
      "action_statement": "Vulnerability CVE-2026-18504 affects version 5.8.4 of fastify."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-11-14T03:22:00.074884+00:00",
      "status_notes": "Vulnerability CVE-2026-25223 does not affect version 5.8.4 of fastify. not_affected \u2014 Fastify 5.8.4 already contains the upstream fix (commit 32d7b6a, \"Updated content-type header parsing\", #6414), which shipped in the upstream release before any TuxCare commit. A header like \"application/json\\ta\" is now rejected with 415 before validation or parsing, so the schema bypass is not possible.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-25223"
      },
      "impact_statement": "not_affected \u2014 Fastify 5.8.4 already contains the upstream fix (commit 32d7b6a, \"Updated content-type header parsing\", #6414), which shipped in the upstream release before any TuxCare commit. A header like \"application/json\\ta\" is now rejected with 415 before validation or parsing, so the schema bypass is not possible."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-11-14T03:21:00.067138+00:00",
      "status_notes": "Vulnerability CVE-2026-25224 does not affect version 5.8.4 of fastify. not_affected \u2014 Fastify 5.8.4 already contains the upstream fix for CVE-2026-25224 (fixed in 5.7.3). sendWebStream in lib/reply.js honors backpressure. It stops reading the web stream when res.write() returns false and resumes only on the 'drain' event. The fix commit eb11156 is upstream-authored and ships in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-25224"
      },
      "impact_statement": "not_affected \u2014 Fastify 5.8.4 already contains the upstream fix for CVE-2026-25224 (fixed in 5.7.3). sendWebStream in lib/reply.js honors backpressure. It stops reading the web stream when res.write() returns false and resumes only on the 'drain' event. The fix commit eb11156 is upstream-authored and ships in the upstream release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33806 affects version 5.8.4 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-33806"
      },
      "action_statement": "Vulnerability CVE-2026-33806 affects version 5.8.4 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2026-3419 affects version 5.8.4 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-3419"
      },
      "action_statement": "Vulnerability CVE-2026-3419 affects version 5.8.4 of fastify."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-11-14T03:22:00.074884+00:00",
      "status_notes": "Vulnerability CVE-2026-3635 does not affect version 5.8.4 of fastify. not_affected \u2014 Target v5.8.4 already contains the upstream fix (commit 4e1db5bd, \"gate host and protocol getters on proxy trust function\"). It shipped in the upstream release, before the first TuxCare commit. The host and protocol getters in lib/request.js now call the trust function on the socket's remote address before honoring X-Forwarded-Host or X-Forwarded-Proto.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-3635"
      },
      "impact_statement": "not_affected \u2014 Target v5.8.4 already contains the upstream fix (commit 4e1db5bd, \"gate host and protocol getters on proxy trust function\"). It shipped in the upstream release, before the first TuxCare commit. The host and protocol getters in lib/request.js now call the trust function on the socket's remote address before honoring X-Forwarded-Host or X-Forwarded-Proto."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-09-30T23:54:00.098505+00:00",
      "status_notes": "Vulnerability CVE-2026-76169 affects version 5.8.4 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-76169"
      },
      "action_statement": "Vulnerability CVE-2026-76169 affects version 5.8.4 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-11-15T06:49:33.827526+00:00",
      "status_notes": "Vulnerability CVE-2026-84428 affects version 5.8.4 of fastify, and is fixed in 5.8.4-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-84428"
      },
      "action_statement": "Vulnerability CVE-2026-84428 affects version 5.8.4 of fastify, and is fixed in 5.8.4-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-09-30T23:54:00.098505+00:00",
      "status_notes": "Vulnerability CVE-2026-84469 affects version 5.8.4 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-84469"
      },
      "action_statement": "Vulnerability CVE-2026-84469 affects version 5.8.4 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-11-15T06:49:33.827526+00:00",
      "status_notes": "Vulnerability CVE-2026-84504 affects version 5.8.4 of fastify, and is fixed in 5.8.4-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-84504"
      },
      "action_statement": "Vulnerability CVE-2026-84504 affects version 5.8.4 of fastify, and is fixed in 5.8.4-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.8.4",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.8.4"
          }
        }
      ],
      "timestamp": "2026-11-15T06:49:33.827526+00:00",
      "status_notes": "Vulnerability CVE-2026-92081 affects version 5.8.4 of fastify, and is fixed in 5.8.4-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-92081"
      },
      "action_statement": "Vulnerability CVE-2026-92081 affects version 5.8.4 of fastify, and is fixed in 5.8.4-tuxcare.1."
    }
  ]
}