{
  "@id": "urn:uuid:254942d7-bd89-4a59-8547-3ddeeb90d776",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T23:22:24.687612+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101910 affects version 10.7.1 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101910"
      },
      "action_statement": "Vulnerability CVE-2026-101910 affects version 10.7.1 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101911 affects version 10.7.1 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101911"
      },
      "action_statement": "Vulnerability CVE-2026-101911 affects version 10.7.1 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101912 affects version 10.7.1 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101912"
      },
      "action_statement": "Vulnerability CVE-2026-101912 affects version 10.7.1 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101913 affects version 10.7.1 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101913"
      },
      "action_statement": "Vulnerability CVE-2026-101913 affects version 10.7.1 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.1"
          }
        }
      ],
      "timestamp": "2026-10-28T11:40:53.853080+00:00",
      "status_notes": "Vulnerability CVE-2026-111997 affects version 10.7.1 of ip-address, and is fixed in 10.7.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-111997"
      },
      "action_statement": "Vulnerability CVE-2026-111997 affects version 10.7.1 of ip-address, and is fixed in 10.7.1-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.1"
          }
        }
      ],
      "timestamp": "2026-11-13T22:45:11.501462+00:00",
      "status_notes": "Vulnerability CVE-2026-42338 does not affect version 10.7.1 of ip-address. not_affected \u2014 Target (ip-address 10.7.1) already contains the upstream fix for CVE-2026-42338 (upstream commit d98f88c, author beau@beaugunderson.com). The fix shipped in the upstream 10.7.1 release before the first TuxCare commit. group(), link(), the parse4in6 leading-zero error path and spanAll() all HTML-escape attacker-controlled content.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42338"
      },
      "impact_statement": "not_affected \u2014 Target (ip-address 10.7.1) already contains the upstream fix for CVE-2026-42338 (upstream commit d98f88c, author beau@beaugunderson.com). The fix shipped in the upstream 10.7.1 release before the first TuxCare commit. group(), link(), the parse4in6 leading-zero error path and spanAll() all HTML-escape attacker-controlled content."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.1"
          }
        }
      ],
      "timestamp": "2026-11-13T23:22:24.687612+00:00",
      "status_notes": "Vulnerability CVE-2026-54272 does not affect version 10.7.1 of ip-address. not_affected \u2014 The target (ip-address 10.7.1) already contains the upstream fix for CVE-2026-54272. Address6 has embeddedIPv4(), and the special-property checks consult it first. The fix shipped in the upstream release that TuxCare onboarded: commit 4a1f613 by the upstream author predates the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54272"
      },
      "impact_statement": "not_affected \u2014 The target (ip-address 10.7.1) already contains the upstream fix for CVE-2026-54272. Address6 has embeddedIPv4(), and the special-property checks consult it first. The fix shipped in the upstream release that TuxCare onboarded: commit 4a1f613 by the upstream author predates the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.1"
          }
        }
      ],
      "timestamp": "2026-11-13T23:12:01.384820+00:00",
      "status_notes": "Vulnerability CVE-2026-69192 does not affect version 10.7.1 of ip-address. not_affected \u2014 The fix is already present in the shipped upstream 10.7.1 release. Address4.parse rejects any octet with a leading zero followed by more digits, and RE_ADDRESS no longer matches zero-padded octets. The fix is upstream commit 56368cb (GHSA-mwp4-54f8-5fhr, author beau@beaugunderson.com). It is an ancestor of HEAD and predates the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-69192"
      },
      "impact_statement": "not_affected \u2014 The fix is already present in the shipped upstream 10.7.1 release. Address4.parse rejects any octet with a leading zero followed by more digits, and RE_ADDRESS no longer matches zero-padded octets. The fix is upstream commit 56368cb (GHSA-mwp4-54f8-5fhr, author beau@beaugunderson.com). It is an ancestor of HEAD and predates the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.1"
          }
        }
      ],
      "timestamp": "2026-11-06T12:25:00.055692+00:00",
      "status_notes": "Vulnerability CVE-2026-69198 does not affect version 10.7.1 of ip-address. not_affected \u2014 Not affected. This repo is ip-address 10.7.1-tuxcare.1, which already contains the upstream fix (beaugunderson commit 488fe9bc) for CVE-2026-69198. Every special-use classifier uses the new isHostInSubnet(), which ignores the address's own CIDR suffix. isInSubnet() keeps its containment guard and is no longer used for classification. The fix shipped in the upstream 10.7.1 release, before any Tu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-69198"
      },
      "impact_statement": "not_affected \u2014 Not affected. This repo is ip-address 10.7.1-tuxcare.1, which already contains the upstream fix (beaugunderson commit 488fe9bc) for CVE-2026-69198. Every special-use classifier uses the new isHostInSubnet(), which ignores the address's own CIDR suffix. isInSubnet() keeps its containment guard and is no longer used for classification. The fix shipped in the upstream 10.7.1 release, before any Tu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.1",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.1"
          }
        }
      ],
      "timestamp": "2026-10-22T17:10:00.682732+00:00",
      "status_notes": "Vulnerability GHSA-p3hm-x653-5rc6 is a false positive for ip-address 10.7.1.",
      "vulnerability": {
        "name": "GHSA-p3hm-x653-5rc6"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}