{
  "@id": "urn:uuid:025ddf69-db85-4e32-995f-7806e6769fef",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T10:33:58.531689+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.12.0",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.12.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:26:00.101937+00:00",
      "status_notes": "Vulnerability CVE-2024-23340 affects version 1.12.0 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2024-23340"
      },
      "action_statement": "Vulnerability CVE-2024-23340 affects version 1.12.0 of @hono/node-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.12.0",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.12.0"
          }
        }
      ],
      "timestamp": "2026-11-02T10:26:00.101937+00:00",
      "status_notes": "Vulnerability CVE-2024-32652 affects version 1.12.0 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2024-32652"
      },
      "action_statement": "Vulnerability CVE-2024-32652 affects version 1.12.0 of @hono/node-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.12.0",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.12.0"
          }
        }
      ],
      "timestamp": "2026-10-29T01:58:39.079103+00:00",
      "status_notes": "Vulnerability CVE-2026-118663 affects version 1.12.0 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-118663"
      },
      "action_statement": "Vulnerability CVE-2026-118663 affects version 1.12.0 of @hono/node-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.12.0",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.12.0"
          }
        }
      ],
      "timestamp": "2026-11-12T21:50:01.066667+00:00",
      "status_notes": "Vulnerability CVE-2026-126210 affects version 1.12.0 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-126210"
      },
      "action_statement": "Vulnerability CVE-2026-126210 affects version 1.12.0 of @hono/node-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.12.0",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.12.0"
          }
        }
      ],
      "timestamp": "2026-11-14T09:32:00.109802+00:00",
      "status_notes": "Vulnerability CVE-2026-126343 does not affect version 1.12.0 of @hono/node-server. not_affected \u2014 @hono/node-server 1.12.0 has no WebSocket/HTTP upgrade handling. The CVE concerns an upgrade handler that awaits the Hono app without socket error/close listeners. That handler does not exist in this version, so the Brief's Input never reaches the application and the Goal is not reachable. Same product lineage as the advisory, so not a false_positive. No fix commit is present or needed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-126343"
      },
      "impact_statement": "not_affected \u2014 @hono/node-server 1.12.0 has no WebSocket/HTTP upgrade handling. The CVE concerns an upgrade handler that awaits the Hono app without socket error/close listeners. That handler does not exist in this version, so the Brief's Input never reaches the application and the Goal is not reachable. Same product lineage as the advisory, so not a false_positive. No fix commit is present or needed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.12.0",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.12.0"
          }
        }
      ],
      "timestamp": "2026-09-24T15:06:14.563076+00:00",
      "status_notes": "Vulnerability CVE-2026-29087 affects version 1.12.0 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-29087"
      },
      "action_statement": "Vulnerability CVE-2026-29087 affects version 1.12.0 of @hono/node-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.12.0",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.12.0"
          }
        }
      ],
      "timestamp": "2026-09-24T15:06:14.563076+00:00",
      "status_notes": "Vulnerability CVE-2026-39406 affects version 1.12.0 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-39406"
      },
      "action_statement": "Vulnerability CVE-2026-39406 affects version 1.12.0 of @hono/node-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.12.0",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.12.0"
          }
        }
      ],
      "timestamp": "2026-11-14T10:33:58.531689+00:00",
      "status_notes": "Vulnerability CVE-2026-73565 does not affect version 1.12.0 of @hono/node-server. not_affected \u2014 @hono/node-server 1.12.0 has no WebSocket support at all: no upgradeWebSocket helper, no ws integration, and no upgrade handling. The flawed pattern from the CVE, a pending-request map that leaks when the handshake aborts, does not exist in this tree. This is the same product at an older version, so it is not a false_positive.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-73565"
      },
      "impact_statement": "not_affected \u2014 @hono/node-server 1.12.0 has no WebSocket support at all: no upgradeWebSocket helper, no ws integration, and no upgrade handling. The flawed pattern from the CVE, a pending-request map that leaks when the handshake aborts, does not exist in this tree. This is the same product at an older version, so it is not a false_positive."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.12.0",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.12.0"
          }
        }
      ],
      "timestamp": "2026-09-24T15:06:14.563076+00:00",
      "status_notes": "Vulnerability GHSA-frvp-7c67-39w9 affects version 1.12.0 of @hono/node-server.",
      "vulnerability": {
        "name": "GHSA-frvp-7c67-39w9"
      },
      "action_statement": "Vulnerability GHSA-frvp-7c67-39w9 affects version 1.12.0 of @hono/node-server."
    }
  ]
}