{
  "@id": "urn:uuid:15fc824e-6c14-4bf6-af27-82877120c59c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T23:21:49.734306+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.2",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101910 affects version 10.7.2 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101910"
      },
      "action_statement": "Vulnerability CVE-2026-101910 affects version 10.7.2 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.2",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101911 affects version 10.7.2 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101911"
      },
      "action_statement": "Vulnerability CVE-2026-101911 affects version 10.7.2 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.2",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101912 affects version 10.7.2 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101912"
      },
      "action_statement": "Vulnerability CVE-2026-101912 affects version 10.7.2 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.2",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101913 affects version 10.7.2 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101913"
      },
      "action_statement": "Vulnerability CVE-2026-101913 affects version 10.7.2 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.2",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.2"
          }
        }
      ],
      "timestamp": "2026-10-28T10:31:39.102974+00:00",
      "status_notes": "Vulnerability CVE-2026-111997 affects version 10.7.2 of ip-address, and is fixed in 10.7.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-111997"
      },
      "action_statement": "Vulnerability CVE-2026-111997 affects version 10.7.2 of ip-address, and is fixed in 10.7.2-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.2",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:50:09.982134+00:00",
      "status_notes": "Vulnerability CVE-2026-42338 does not affect version 10.7.2 of ip-address. not_affected \u2014 The target (ip-address 10.7.2-tuxcare.1) already contains the upstream HTML-escaping fix from d98f88cf (shipped in 10.1.1). The fix was in the upstream release before the first TuxCare commit, so the verdict is not_affected. Escaping covers group(), link(), the leading-zero parseMessage branch and spanAll().",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42338"
      },
      "impact_statement": "not_affected \u2014 The target (ip-address 10.7.2-tuxcare.1) already contains the upstream HTML-escaping fix from d98f88cf (shipped in 10.1.1). The fix was in the upstream release before the first TuxCare commit, so the verdict is not_affected. Escaping covers group(), link(), the leading-zero parseMessage branch and spanAll()."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.2",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.2"
          }
        }
      ],
      "timestamp": "2026-11-13T23:21:49.734306+00:00",
      "status_notes": "Vulnerability CVE-2026-54272 does not affect version 10.7.2 of ip-address. not_affected \u2014 The upstream fix (beaugunderson/ip-address 4a1f613, \"Merge commit from fork\") is already in the target (10.7.2). Address6 has embeddedIPv4() and the classifiers consult it first. isPrivate, isCGNAT and isBroadcast exist, and getType() labels ::ffff:0:0/96 as IPv4-mapped. The fix shipped in the upstream release before any TuxCare commit, so the verdict is not_affected, not already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54272"
      },
      "impact_statement": "not_affected \u2014 The upstream fix (beaugunderson/ip-address 4a1f613, \"Merge commit from fork\") is already in the target (10.7.2). Address6 has embeddedIPv4() and the classifiers consult it first. isPrivate, isCGNAT and isBroadcast exist, and getType() labels ::ffff:0:0/96 as IPv4-mapped. The fix shipped in the upstream release before any TuxCare commit, so the verdict is not_affected, not already_fixed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.2",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.2"
          }
        }
      ],
      "timestamp": "2026-11-13T23:08:29.987361+00:00",
      "status_notes": "Vulnerability CVE-2026-69192 does not affect version 10.7.2 of ip-address. not_affected \u2014 The target (ip-address 10.7.2-tuxcare.1) already contains the upstream fix 56368cb (GHSA-mwp4-54f8-5fhr). Address4.parse rejects leading-zero octets, and RE_ADDRESS no longer matches them. The fix shipped in the upstream 10.7.2 release, authored by Beau Gunderson, so it is not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-69192"
      },
      "impact_statement": "not_affected \u2014 The target (ip-address 10.7.2-tuxcare.1) already contains the upstream fix 56368cb (GHSA-mwp4-54f8-5fhr). Address4.parse rejects leading-zero octets, and RE_ADDRESS no longer matches them. The fix shipped in the upstream 10.7.2 release, authored by Beau Gunderson, so it is not a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.2",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.2"
          }
        }
      ],
      "timestamp": "2026-11-06T12:25:00.055692+00:00",
      "status_notes": "Vulnerability CVE-2026-69198 does not affect version 10.7.2 of ip-address. not_affected \u2014 The fix for CVE-2026-69198 is already in the 10.7.2 upstream release this branch starts from. Upstream commit 488fe9bc added isHostInSubnet, which compares only host bits, and every classifier now uses it. isInSubnet is kept for containment semantics only and no classifier calls it. The fix is upstream-authored, so the verdict is not_affected with no TuxCare attribution.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-69198"
      },
      "impact_statement": "not_affected \u2014 The fix for CVE-2026-69198 is already in the 10.7.2 upstream release this branch starts from. Upstream commit 488fe9bc added isHostInSubnet, which compares only host bits, and every classifier now uses it. isInSubnet is kept for containment semantics only and no classifier calls it. The fix is upstream-authored, so the verdict is not_affected with no TuxCare attribution."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.2",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.2"
          }
        }
      ],
      "timestamp": "2026-10-22T17:10:00.682732+00:00",
      "status_notes": "Vulnerability GHSA-p3hm-x653-5rc6 is a false positive for ip-address 10.7.2.",
      "vulnerability": {
        "name": "GHSA-p3hm-x653-5rc6"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}