{
  "@id": "urn:uuid:167b1b91-f1f7-4836-a23b-ce3d3db2f363",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T03:22:00.074884+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:00.165420+00:00",
      "status_notes": "Vulnerability CVE-2018-3711 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2018-3711"
      },
      "action_statement": "Vulnerability CVE-2018-3711 affects version 5.9.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:00.165420+00:00",
      "status_notes": "Vulnerability CVE-2020-8192 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2020-8192"
      },
      "action_statement": "Vulnerability CVE-2020-8192 affects version 5.9.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:00.165420+00:00",
      "status_notes": "Vulnerability CVE-2022-39288 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2022-39288"
      },
      "action_statement": "Vulnerability CVE-2022-39288 affects version 5.9.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2022-41919 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2022-41919"
      },
      "action_statement": "Vulnerability CVE-2022-41919 affects version 5.9.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2025-32442 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2025-32442"
      },
      "action_statement": "Vulnerability CVE-2025-32442 affects version 5.9.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2026-107832 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-107832"
      },
      "action_statement": "Vulnerability CVE-2026-107832 affects version 5.9.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-11-02T11:21:38.011707+00:00",
      "status_notes": "Vulnerability CVE-2026-120216 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-120216"
      },
      "action_statement": "Vulnerability CVE-2026-120216 affects version 5.9.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-16732 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-16732"
      },
      "action_statement": "Vulnerability CVE-2026-16732 affects version 5.9.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-18504 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-18504"
      },
      "action_statement": "Vulnerability CVE-2026-18504 affects version 5.9.0 of fastify."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-11-14T03:22:00.074884+00:00",
      "status_notes": "Vulnerability CVE-2026-25223 does not affect version 5.9.0 of fastify. not_affected \u2014 The target is Fastify 5.8.5. The upstream fix commit 32d7b6add (James Sumners, \"Updated content-type header parsing\", #6414) is already an ancestor of HEAD and was in the upstream release before the first TuxCare commit. Validation and parsing now use one strict ContentType object, and a Content-Type with a tab followed by junk is rejected with 415 before it reaches validation or the parser. I ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-25223"
      },
      "impact_statement": "not_affected \u2014 The target is Fastify 5.8.5. The upstream fix commit 32d7b6add (James Sumners, \"Updated content-type header parsing\", #6414) is already an ancestor of HEAD and was in the upstream release before the first TuxCare commit. Validation and parsing now use one strict ContentType object, and a Content-Type with a tab followed by junk is rejected with 415 before it reaches validation or the parser. I ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-11-14T03:21:00.067138+00:00",
      "status_notes": "Vulnerability CVE-2026-25224 does not affect version 5.9.0 of fastify. not_affected \u2014 The upstream backpressure fix for CVE-2026-25224 (eb11156, Matteo Collina) is already in the target. sendWebStream in lib/reply.js stops reading when res.write() returns false and resumes on 'drain', so memory stays bounded for a slow client.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-25224"
      },
      "impact_statement": "not_affected \u2014 The upstream backpressure fix for CVE-2026-25224 (eb11156, Matteo Collina) is already in the target. sendWebStream in lib/reply.js stops reading when res.write() returns false and resumes on 'drain', so memory stays bounded for a slow client."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2026-33806 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-33806"
      },
      "action_statement": "Vulnerability CVE-2026-33806 affects version 5.9.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:49:53.224717+00:00",
      "status_notes": "Vulnerability CVE-2026-3419 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-3419"
      },
      "action_statement": "Vulnerability CVE-2026-3419 affects version 5.9.0 of fastify."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-11-14T03:22:00.074884+00:00",
      "status_notes": "Vulnerability CVE-2026-3635 does not affect version 5.9.0 of fastify. not_affected \u2014 Not affected. The request.host and request.protocol getters in lib/request.js only honor X-Forwarded-Host / X-Forwarded-Proto when the trust function approves the immediate peer (proxyFn(socket.remoteAddress, 0)). This is the upstream fix (4e1db5bd, plus follow-up 21b4c3c1), and it is already part of the upstream 5.8.5 release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-3635"
      },
      "impact_statement": "not_affected \u2014 Not affected. The request.host and request.protocol getters in lib/request.js only honor X-Forwarded-Host / X-Forwarded-Proto when the trust function approves the immediate peer (proxyFn(socket.remoteAddress, 0)). This is the upstream fix (4e1db5bd, plus follow-up 21b4c3c1), and it is already part of the upstream 5.8.5 release that TuxCare onboarded."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-09-30T23:54:00.098505+00:00",
      "status_notes": "Vulnerability CVE-2026-76169 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-76169"
      },
      "action_statement": "Vulnerability CVE-2026-76169 affects version 5.9.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-09-30T23:54:00.098505+00:00",
      "status_notes": "Vulnerability CVE-2026-84428 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-84428"
      },
      "action_statement": "Vulnerability CVE-2026-84428 affects version 5.9.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-09-30T23:54:00.098505+00:00",
      "status_notes": "Vulnerability CVE-2026-84469 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-84469"
      },
      "action_statement": "Vulnerability CVE-2026-84469 affects version 5.9.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-09-30T23:54:00.098505+00:00",
      "status_notes": "Vulnerability CVE-2026-84504 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-84504"
      },
      "action_statement": "Vulnerability CVE-2026-84504 affects version 5.9.0 of fastify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fastify@5.9.0",
          "identifiers": {
            "purl": "pkg:npm/fastify@5.9.0"
          }
        }
      ],
      "timestamp": "2026-10-01T00:02:00.286191+00:00",
      "status_notes": "Vulnerability CVE-2026-92081 affects version 5.9.0 of fastify.",
      "vulnerability": {
        "name": "CVE-2026-92081"
      },
      "action_statement": "Vulnerability CVE-2026-92081 affects version 5.9.0 of fastify."
    }
  ]
}