{
  "@id": "urn:uuid:338161fd-23fb-4184-9e0d-594bb4257789",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T23:27:00.042596+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.3",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101910 affects version 10.7.3 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101910"
      },
      "action_statement": "Vulnerability CVE-2026-101910 affects version 10.7.3 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.3",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101911 affects version 10.7.3 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101911"
      },
      "action_statement": "Vulnerability CVE-2026-101911 affects version 10.7.3 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.3",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101912 affects version 10.7.3 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101912"
      },
      "action_statement": "Vulnerability CVE-2026-101912 affects version 10.7.3 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.3",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2026-101913 affects version 10.7.3 of ip-address.",
      "vulnerability": {
        "name": "CVE-2026-101913"
      },
      "action_statement": "Vulnerability CVE-2026-101913 affects version 10.7.3 of ip-address."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.3",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.3"
          }
        }
      ],
      "timestamp": "2026-10-28T09:49:00.078115+00:00",
      "status_notes": "Vulnerability CVE-2026-111997 affects version 10.7.3 of ip-address, and is fixed in 10.7.3-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-111997"
      },
      "action_statement": "Vulnerability CVE-2026-111997 affects version 10.7.3 of ip-address, and is fixed in 10.7.3-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.3",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.3"
          }
        }
      ],
      "timestamp": "2026-11-13T22:53:40.501241+00:00",
      "status_notes": "Vulnerability CVE-2026-42338 does not affect version 10.7.3 of ip-address. not_affected \u2014 Target ip-address 10.7.3 already contains the upstream fix for CVE-2026-42338 (upstream commit d98f88c, fixed in 10.1.1). All four affected surfaces escape their content: group()/simpleGroup, link(), the leading-zero parseMessage in parse4in6(), and spanAll(). The fix shipped in the upstream release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42338"
      },
      "impact_statement": "not_affected \u2014 Target ip-address 10.7.3 already contains the upstream fix for CVE-2026-42338 (upstream commit d98f88c, fixed in 10.1.1). All four affected surfaces escape their content: group()/simpleGroup, link(), the leading-zero parseMessage in parse4in6(), and spanAll(). The fix shipped in the upstream release that TuxCare onboarded."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.3",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.3"
          }
        }
      ],
      "timestamp": "2026-11-13T23:27:00.042596+00:00",
      "status_notes": "Vulnerability CVE-2026-54272 does not affect version 10.7.3 of ip-address. not_affected \u2014 The target (ip-address 10.7.3-tuxcare.1) already contains the upstream fix for CVE-2026-54272. Address6.embeddedIPv4() normalizes IPv4-mapped and NAT64 well-known addresses, and the special-property checks delegate to it. Upstream author Beau Gunderson added this in commit 4a1f613, which is in the upstream 10.7.3 release before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54272"
      },
      "impact_statement": "not_affected \u2014 The target (ip-address 10.7.3-tuxcare.1) already contains the upstream fix for CVE-2026-54272. Address6.embeddedIPv4() normalizes IPv4-mapped and NAT64 well-known addresses, and the special-property checks delegate to it. Upstream author Beau Gunderson added this in commit 4a1f613, which is in the upstream 10.7.3 release before the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.3",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.3"
          }
        }
      ],
      "timestamp": "2026-11-13T23:12:01.384820+00:00",
      "status_notes": "Vulnerability CVE-2026-69192 does not affect version 10.7.3 of ip-address. not_affected \u2014 Not affected. The upstream fix (beaugunderson/ip-address 56368cb, GHSA-mwp4-54f8-5fhr) is already in the 10.7.3 release this branch is built from. Address4.parse rejects any octet with a leading zero, and RE_ADDRESS no longer matches zero-padded octets.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-69192"
      },
      "impact_statement": "not_affected \u2014 Not affected. The upstream fix (beaugunderson/ip-address 56368cb, GHSA-mwp4-54f8-5fhr) is already in the 10.7.3 release this branch is built from. Address4.parse rejects any octet with a leading zero, and RE_ADDRESS no longer matches zero-padded octets."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.3",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.3"
          }
        }
      ],
      "timestamp": "2026-11-06T12:22:40.044403+00:00",
      "status_notes": "Vulnerability CVE-2026-69198 does not affect version 10.7.3 of ip-address. not_affected \u2014 The target (ip-address 10.7.3-tuxcare.1) already contains the upstream fix for CVE-2026-69198. Classifiers use the new isHostInSubnet, which ignores the address's own CIDR suffix. The upstream fix commit 488fe9b is in the upstream 10.7.3 release, before any TuxCare commit, so the verdict is not_affected and not already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-69198"
      },
      "impact_statement": "not_affected \u2014 The target (ip-address 10.7.3-tuxcare.1) already contains the upstream fix for CVE-2026-69198. Classifiers use the new isHostInSubnet, which ignores the address's own CIDR suffix. The upstream fix commit 488fe9b is in the upstream 10.7.3 release, before any TuxCare commit, so the verdict is not_affected and not already_fixed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/ip-address@10.7.3",
          "identifiers": {
            "purl": "pkg:npm/ip-address@10.7.3"
          }
        }
      ],
      "timestamp": "2026-10-22T17:10:00.682732+00:00",
      "status_notes": "Vulnerability GHSA-p3hm-x653-5rc6 is a false positive for ip-address 10.7.3.",
      "vulnerability": {
        "name": "GHSA-p3hm-x653-5rc6"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}