{
  "@id": "urn:uuid:eed2e126-d6ef-4eaf-9ef9-a976a8f7be3f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T23:23:34.366179+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.0",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.0"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101910 affects version 10.7.0 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101910"
      },
      "action_statement": "Vulnerability CVE-2026-101910 affects version 10.7.0 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.0",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.0"
          }
        }
      ],
      "timestamp": "2026-10-01T13:26:37.692920+00:00",
      "status_notes": "Vulnerability CVE-2026-101911 affects version 10.7.0 of ip-address, and is fixed in 10.7.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-101911"
      },
      "action_statement": "Vulnerability CVE-2026-101911 affects version 10.7.0 of ip-address, and is fixed in 10.7.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.0",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.0"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability CVE-2026-101912 affects version 10.7.0 of ip-address, and is fixed in 10.7.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-101912"
      },
      "action_statement": "Vulnerability CVE-2026-101912 affects version 10.7.0 of ip-address, and is fixed in 10.7.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.0",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.0"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101913 affects version 10.7.0 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101913"
      },
      "action_statement": "Vulnerability CVE-2026-101913 affects version 10.7.0 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.0",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.0"
          }
        }
      ],
      "timestamp": "2026-10-28T17:04:00.130139+00:00",
      "status_notes": "Vulnerability CVE-2026-111997 affects version 10.7.0 of ip-address, and is fixed in 10.7.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-111997"
      },
      "action_statement": "Vulnerability CVE-2026-111997 affects version 10.7.0 of ip-address, and is fixed in 10.7.0-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.0",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.0"
          }
        }
      ],
      "timestamp": "2026-11-13T22:46:33.576650+00:00",
      "status_notes": "Vulnerability CVE-2026-42338 does not affect version 10.7.0 of ip-address. not_affected \u2014 Target ip-address 10.7.0 already contains the upstream fix for CVE-2026-42338 (upstream commit d98f88c, released in 10.1.1). Zone text is no longer embedded raw. group(), link(), spanAll() and the leading-zero parseMessage all HTML-escape attacker-controlled content. The fix reached HEAD through the upstream 10.7.0 release, before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42338"
      },
      "impact_statement": "not_affected \u2014 Target ip-address 10.7.0 already contains the upstream fix for CVE-2026-42338 (upstream commit d98f88c, released in 10.1.1). Zone text is no longer embedded raw. group(), link(), spanAll() and the leading-zero parseMessage all HTML-escape attacker-controlled content. The fix reached HEAD through the upstream 10.7.0 release, before the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.0",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.0"
          }
        }
      ],
      "timestamp": "2026-11-13T23:23:34.366179+00:00",
      "status_notes": "Vulnerability CVE-2026-54272 does not affect version 10.7.0 of ip-address. not_affected \u2014 Target ip-address 10.7.0 already contains the upstream fix for CVE-2026-54272 (upstream commit 4a1f613, merged before the first TuxCare commit). Address6 normalizes IPv4-mapped and NAT64 addresses via embeddedIPv4() before classification, and has isPrivate/isCGNAT/isBroadcast. The vulnerable pattern is absent.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54272"
      },
      "impact_statement": "not_affected \u2014 Target ip-address 10.7.0 already contains the upstream fix for CVE-2026-54272 (upstream commit 4a1f613, merged before the first TuxCare commit). Address6 normalizes IPv4-mapped and NAT64 addresses via embeddedIPv4() before classification, and has isPrivate/isCGNAT/isBroadcast. The vulnerable pattern is absent."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.0",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.0"
          }
        }
      ],
      "timestamp": "2026-11-13T22:59:40.658110+00:00",
      "status_notes": "Vulnerability CVE-2026-69192 does not affect version 10.7.0 of ip-address. not_affected \u2014 Target ip-address 10.7.0 already contains the upstream fix (beaugunderson 56368cb, GHSA-mwp4-54f8-5fhr). Address4.parse rejects leading-zero octets and RE_ADDRESS no longer matches them. The fix shipped in the upstream 10.7.0 release, before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-69192"
      },
      "impact_statement": "not_affected \u2014 Target ip-address 10.7.0 already contains the upstream fix (beaugunderson 56368cb, GHSA-mwp4-54f8-5fhr). Address4.parse rejects leading-zero octets and RE_ADDRESS no longer matches them. The fix shipped in the upstream 10.7.0 release, before the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.0",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.0"
          }
        }
      ],
      "timestamp": "2026-11-06T12:24:00.032209+00:00",
      "status_notes": "Vulnerability CVE-2026-69198 does not affect version 10.7.0 of ip-address. not_affected \u2014 The target (ip-address 10.7.0) already contains the upstream fix for CVE-2026-69198. Classification methods use the new isHostInSubnet(), which ignores the address's own CIDR suffix. isInSubnet keeps its containment guard but is no longer used for classification. The fix is upstream commit 488fe9bc (author beau@beaugunderson.com), which is shipped in the upstream 10.7.0 release, before the firs...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-69198"
      },
      "impact_statement": "not_affected \u2014 The target (ip-address 10.7.0) already contains the upstream fix for CVE-2026-69198. Classification methods use the new isHostInSubnet(), which ignores the address's own CIDR suffix. isInSubnet keeps its containment guard but is no longer used for classification. The fix is upstream commit 488fe9bc (author beau@beaugunderson.com), which is shipped in the upstream 10.7.0 release, before the firs..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.0",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.0"
          }
        }
      ],
      "timestamp": "2026-10-22T17:10:00.682732+00:00",
      "status_notes": "Vulnerability GHSA-p3hm-x653-5rc6 is a false positive for ip-address 10.7.0.",
      "vulnerability": {
        "name": "GHSA-p3hm-x653-5rc6"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}