{
  "@id": "urn:uuid:a39bf50c-f1fe-49b5-8569-612024c8c53c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T10:37:00.106793+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.13.7",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.13.7"
          }
        }
      ],
      "timestamp": "2026-11-02T10:26:00.101937+00:00",
      "status_notes": "Vulnerability CVE-2024-23340 affects version 1.13.7 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2024-23340"
      },
      "action_statement": "Vulnerability CVE-2024-23340 affects version 1.13.7 of @hono/node-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.13.7",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.13.7"
          }
        }
      ],
      "timestamp": "2026-11-02T10:26:00.101937+00:00",
      "status_notes": "Vulnerability CVE-2024-32652 affects version 1.13.7 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2024-32652"
      },
      "action_statement": "Vulnerability CVE-2024-32652 affects version 1.13.7 of @hono/node-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.13.7",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.13.7"
          }
        }
      ],
      "timestamp": "2026-10-29T01:58:39.079103+00:00",
      "status_notes": "Vulnerability CVE-2026-118663 affects version 1.13.7 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-118663"
      },
      "action_statement": "Vulnerability CVE-2026-118663 affects version 1.13.7 of @hono/node-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.13.7",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.13.7"
          }
        }
      ],
      "timestamp": "2026-11-12T21:50:01.066667+00:00",
      "status_notes": "Vulnerability CVE-2026-126210 affects version 1.13.7 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-126210"
      },
      "action_statement": "Vulnerability CVE-2026-126210 affects version 1.13.7 of @hono/node-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.13.7",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.13.7"
          }
        }
      ],
      "timestamp": "2026-11-14T09:32:05.411711+00:00",
      "status_notes": "Vulnerability CVE-2026-126343 does not affect version 1.13.7 of @hono/node-server. not_affected \u2014 @hono/node-server 1.13.7 has no WebSocket or HTTP upgrade handling. The vulnerable pattern is an upgrade handler that awaits the app before attaching socket error and close listeners. That handler does not exist in this version, so the CVE does not apply. Type A1 (input absent).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-126343"
      },
      "impact_statement": "not_affected \u2014 @hono/node-server 1.13.7 has no WebSocket or HTTP upgrade handling. The vulnerable pattern is an upgrade handler that awaits the app before attaching socket error and close listeners. That handler does not exist in this version, so the CVE does not apply. Type A1 (input absent)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.13.7",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.13.7"
          }
        }
      ],
      "timestamp": "2026-10-15T12:49:59.116477+00:00",
      "status_notes": "Vulnerability CVE-2026-29087 affects version 1.13.7 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-29087"
      },
      "action_statement": "Vulnerability CVE-2026-29087 affects version 1.13.7 of @hono/node-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.13.7",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.13.7"
          }
        }
      ],
      "timestamp": "2026-10-15T12:49:59.116477+00:00",
      "status_notes": "Vulnerability CVE-2026-39406 affects version 1.13.7 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-39406"
      },
      "action_statement": "Vulnerability CVE-2026-39406 affects version 1.13.7 of @hono/node-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.13.7",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.13.7"
          }
        }
      ],
      "timestamp": "2026-11-14T10:37:00.106793+00:00",
      "status_notes": "Vulnerability CVE-2026-73565 is a false positive for @hono/node-server 1.13.7. false_positive \u2014 Wrong-project match. The advisory concerns the WebSocket helper (upgradeWebSocket, which keeps an internal map of IncomingMessage objects and uses the `ws` library). This repository is @hono/node-server v1.13.7, a plain HTTP adapter. It has no WebSocket code, no `ws` dependency and no vendored copy of the affected component.",
      "vulnerability": {
        "name": "CVE-2026-73565"
      },
      "impact_statement": "false_positive \u2014 Wrong-project match. The advisory concerns the WebSocket helper (upgradeWebSocket, which keeps an internal map of IncomingMessage objects and uses the `ws` library). This repository is @hono/node-server v1.13.7, a plain HTTP adapter. It has no WebSocket code, no `ws` dependency and no vendored copy of the affected component."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.13.7",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.13.7"
          }
        }
      ],
      "timestamp": "2026-10-15T12:49:59.116477+00:00",
      "status_notes": "Vulnerability GHSA-frvp-7c67-39w9 affects version 1.13.7 of @hono/node-server.",
      "vulnerability": {
        "name": "GHSA-frvp-7c67-39w9"
      },
      "action_statement": "Vulnerability GHSA-frvp-7c67-39w9 affects version 1.13.7 of @hono/node-server."
    }
  ]
}