{
  "@id": "urn:uuid:942e9a0f-331f-4b26-98b8-7b2d28bc590a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T23:22:24.687612+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.5.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.5.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101910 affects version 10.5.1 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101910"
      },
      "action_statement": "Vulnerability CVE-2026-101910 affects version 10.5.1 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.5.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.5.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:17:00.115696+00:00",
      "status_notes": "Vulnerability CVE-2026-101911 affects version 10.5.1 of ip-address, and is fixed in 10.5.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-101911"
      },
      "action_statement": "Vulnerability CVE-2026-101911 affects version 10.5.1 of ip-address, and is fixed in 10.5.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.5.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.5.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:17:00.115696+00:00",
      "status_notes": "Vulnerability CVE-2026-101912 affects version 10.5.1 of ip-address, and is fixed in 10.5.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-101912"
      },
      "action_statement": "Vulnerability CVE-2026-101912 affects version 10.5.1 of ip-address, and is fixed in 10.5.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.5.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.5.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101913 affects version 10.5.1 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101913"
      },
      "action_statement": "Vulnerability CVE-2026-101913 affects version 10.5.1 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.5.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.5.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:17:00.115696+00:00",
      "status_notes": "Vulnerability CVE-2026-111997 affects version 10.5.1 of ip-address, and is fixed in 10.5.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-111997"
      },
      "action_statement": "Vulnerability CVE-2026-111997 affects version 10.5.1 of ip-address, and is fixed in 10.5.1-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.5.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.5.1"
          }
        }
      ],
      "timestamp": "2026-11-13T22:51:15.235999+00:00",
      "status_notes": "Vulnerability CVE-2026-42338 does not affect version 10.5.1 of ip-address. not_affected \u2014 Not affected. The upstream fix for CVE-2026-42338 (beaugunderson/ip-address commit d98f88c, released as 10.1.1) is already in the upstream 10.5.1 release this TuxCare branch was built from. In this tree, group(), link(), spanAll() and the leading-zero IPv4 error path all HTML-escape attacker-controlled content. The fix author and committer are not TuxCare identities, and the fix predates the fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42338"
      },
      "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2026-42338 (beaugunderson/ip-address commit d98f88c, released as 10.1.1) is already in the upstream 10.5.1 release this TuxCare branch was built from. In this tree, group(), link(), spanAll() and the leading-zero IPv4 error path all HTML-escape attacker-controlled content. The fix author and committer are not TuxCare identities, and the fix predates the fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.5.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.5.1"
          }
        }
      ],
      "timestamp": "2026-11-13T23:22:24.687612+00:00",
      "status_notes": "Vulnerability CVE-2026-54272 does not affect version 10.5.1 of ip-address. not_affected \u2014 Target ip-address 10.5.1 already contains the upstream fix for CVE-2026-54272. Address6 has embeddedIPv4(), and isLoopback/isLinkLocal/isMulticast/isUnspecified/isPrivate/isCGNAT/isBroadcast all consult it first. The upstream commit 4a1f613 (author beau.gunderson@canvasmedical.com) is an ancestor of the first TuxCare commit, so the fix shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54272"
      },
      "impact_statement": "not_affected \u2014 Target ip-address 10.5.1 already contains the upstream fix for CVE-2026-54272. Address6 has embeddedIPv4(), and isLoopback/isLinkLocal/isMulticast/isUnspecified/isPrivate/isCGNAT/isBroadcast all consult it first. The upstream commit 4a1f613 (author beau.gunderson@canvasmedical.com) is an ancestor of the first TuxCare commit, so the fix shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.5.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.5.1"
          }
        }
      ],
      "timestamp": "2026-11-13T22:58:23.343685+00:00",
      "status_notes": "Vulnerability CVE-2026-69192 does not affect version 10.5.1 of ip-address. not_affected \u2014 The upstream fix for CVE-2026-69192 is already in the target. src/ipv4.ts parse() rejects leading-zero octets, and RE_ADDRESS no longer matches them. The fix commit 56368cb is by the upstream author and is part of the 10.5.1 release, before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-69192"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-69192 is already in the target. src/ipv4.ts parse() rejects leading-zero octets, and RE_ADDRESS no longer matches them. The fix commit 56368cb is by the upstream author and is part of the 10.5.1 release, before the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.5.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.5.1"
          }
        }
      ],
      "timestamp": "2026-11-06T12:21:41.924663+00:00",
      "status_notes": "Vulnerability CVE-2026-69198 does not affect version 10.5.1 of ip-address. not_affected \u2014 ip-address 10.5.1 already contains the upstream fix for CVE-2026-69198 (upstream commit 488fe9bc, \"Merge commit from fork\", author beau@beaugunderson.com). All special-use classifiers use the new isHostInSubnet(), which ignores the address's own CIDR suffix. isInSubnet keeps its containment guard and delegates to isHostInSubnet. The fix was in the upstream release before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-69198"
      },
      "impact_statement": "not_affected \u2014 ip-address 10.5.1 already contains the upstream fix for CVE-2026-69198 (upstream commit 488fe9bc, \"Merge commit from fork\", author beau@beaugunderson.com). All special-use classifiers use the new isHostInSubnet(), which ignores the address's own CIDR suffix. isInSubnet keeps its containment guard and delegates to isHostInSubnet. The fix was in the upstream release before the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.5.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.5.1"
          }
        }
      ],
      "timestamp": "2026-10-22T17:10:00.682732+00:00",
      "status_notes": "Vulnerability GHSA-p3hm-x653-5rc6 is a false positive for ip-address 10.5.1.",
      "vulnerability": {
        "name": "GHSA-p3hm-x653-5rc6"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}