{
  "@id": "urn:uuid:e3698e58-7d77-4ba4-bfa3-073b37decd91",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T02:08:31.871982+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/joi@17.13.6",
          "identifiers": {
            "purl": "pkg:npm/joi@17.13.6"
          }
        }
      ],
      "timestamp": "2026-11-04T12:04:58.166699+00:00",
      "status_notes": "Vulnerability CVE-2026-118772 affects version 17.13.6 of joi, and is fixed in 17.13.6-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-118772"
      },
      "action_statement": "Vulnerability CVE-2026-118772 affects version 17.13.6 of joi, and is fixed in 17.13.6-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/joi@17.13.6",
          "identifiers": {
            "purl": "pkg:npm/joi@17.13.6"
          }
        }
      ],
      "timestamp": "2026-11-04T20:39:00.042959+00:00",
      "status_notes": "Vulnerability CVE-2026-122131 affects version 17.13.6 of joi.",
      "vulnerability": {
        "name": "CVE-2026-122131"
      },
      "action_statement": "Vulnerability CVE-2026-122131 affects version 17.13.6 of joi."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@17.13.6",
          "identifiers": {
            "purl": "pkg:npm/joi@17.13.6"
          }
        }
      ],
      "timestamp": "2026-11-13T19:11:23.397689+00:00",
      "status_notes": "Vulnerability CVE-2026-48038 does not affect version 17.13.6 of joi. not_affected \u2014 The fix for hapijs/joi#3113 is already in this tree. Upstream commit 97bd51de (\"chore: backport #3113 to v17\", author nicolas@morel.io) is an ancestor of HEAD and predates the first TuxCare commit, so it shipped in the upstream 17.13.6 release. lib/types/link.js now catches RangeError during recursive link validation and returns a structured 'link.depth' validation error. The vulnerable pattern...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48038"
      },
      "impact_statement": "not_affected \u2014 The fix for hapijs/joi#3113 is already in this tree. Upstream commit 97bd51de (\"chore: backport #3113 to v17\", author nicolas@morel.io) is an ancestor of HEAD and predates the first TuxCare commit, so it shipped in the upstream 17.13.6 release. lib/types/link.js now catches RangeError during recursive link validation and returns a structured 'link.depth' validation error. The vulnerable pattern..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@17.13.6",
          "identifiers": {
            "purl": "pkg:npm/joi@17.13.6"
          }
        }
      ],
      "timestamp": "2026-11-14T02:08:03.403428+00:00",
      "status_notes": "Vulnerability CVE-2026-84367 does not affect version 17.13.6 of joi. not_affected \u2014 Not affected. The upstream fix (reject rename target '__proto__') is already present in lib/types/keys.js. It shipped with the upstream 17.13.6 release, before the first TuxCare commit, and was authored by the upstream maintainer (nicolas@morel.io).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84367"
      },
      "impact_statement": "not_affected \u2014 Not affected. The upstream fix (reject rename target '__proto__') is already present in lib/types/keys.js. It shipped with the upstream 17.13.6 release, before the first TuxCare commit, and was authored by the upstream maintainer (nicolas@morel.io)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@17.13.6",
          "identifiers": {
            "purl": "pkg:npm/joi@17.13.6"
          }
        }
      ],
      "timestamp": "2026-11-14T02:08:31.871982+00:00",
      "status_notes": "Vulnerability CVE-2026-84368 does not affect version 17.13.6 of joi. not_affected \u2014 Not affected. The upstream fix (8d0b808f, \"fix: prevent messages proto injection\", the 17.x backport of 90d07571) is already in the upstream joi 17.13.6 release that TuxCare onboarded. lib/messages.js reuses a language object only if it is an own property of the target, and it rejects `__proto__` as a message code. The commit's author and committer are both nicolas@morel.io, outside the TuxCare...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84368"
      },
      "impact_statement": "not_affected \u2014 Not affected. The upstream fix (8d0b808f, \"fix: prevent messages proto injection\", the 17.x backport of 90d07571) is already in the upstream joi 17.13.6 release that TuxCare onboarded. lib/messages.js reuses a language object only if it is an own property of the target, and it rejects `__proto__` as a message code. The commit's author and committer are both nicolas@morel.io, outside the TuxCare..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/joi@17.13.6",
          "identifiers": {
            "purl": "pkg:npm/joi@17.13.6"
          }
        }
      ],
      "timestamp": "2026-10-06T09:29:00.114006+00:00",
      "status_notes": "Vulnerability CVE-2026-90771 affects version 17.13.6 of joi, and is fixed in 17.13.6-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-90771"
      },
      "action_statement": "Vulnerability CVE-2026-90771 affects version 17.13.6 of joi, and is fixed in 17.13.6-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/joi@17.13.6",
          "identifiers": {
            "purl": "pkg:npm/joi@17.13.6"
          }
        }
      ],
      "timestamp": "2026-09-29T22:01:12.799548+00:00",
      "status_notes": "Vulnerability CVE-2026-92599 affects version 17.13.6 of joi, and is fixed in 17.13.6-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-92599"
      },
      "action_statement": "Vulnerability CVE-2026-92599 affects version 17.13.6 of joi, and is fixed in 17.13.6-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/joi@17.13.6",
          "identifiers": {
            "purl": "pkg:npm/joi@17.13.6"
          }
        }
      ],
      "timestamp": "2026-09-29T18:19:00.149288+00:00",
      "status_notes": "Vulnerability GHSA-6h2x-m376-mqjq affects version 17.13.6 of joi.",
      "vulnerability": {
        "name": "GHSA-6h2x-m376-mqjq"
      },
      "action_statement": "Vulnerability GHSA-6h2x-m376-mqjq affects version 17.13.6 of joi."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@17.13.6",
          "identifiers": {
            "purl": "pkg:npm/joi@17.13.6"
          }
        }
      ],
      "timestamp": "2026-11-04T15:06:15.083779+00:00",
      "status_notes": "Vulnerability GHSA-mrx9-2rrp-rhpx is a false positive for joi 17.13.6.",
      "vulnerability": {
        "name": "GHSA-mrx9-2rrp-rhpx"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}