{
  "@id": "urn:uuid:13353d7a-ad5f-43fe-90d7-f59a8e4be498",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T01:58:39.079103+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.11",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.11"
          }
        }
      ],
      "timestamp": "2026-10-29T01:58:39.079103+00:00",
      "status_notes": "Vulnerability CVE-2026-118663 affects version 1.19.11 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-118663"
      },
      "action_statement": "Vulnerability CVE-2026-118663 affects version 1.19.11 of @hono/node-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.11",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.11"
          }
        }
      ],
      "timestamp": "2026-10-28T12:41:20.251568+00:00",
      "status_notes": "Vulnerability CVE-2026-39406 affects version 1.19.11 of @hono/node-server, and is fixed in 1.19.11-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-39406"
      },
      "action_statement": "Vulnerability CVE-2026-39406 affects version 1.19.11 of @hono/node-server, and is fixed in 1.19.11-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.11",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.11"
          }
        }
      ],
      "timestamp": "2026-10-28T12:30:18.874926+00:00",
      "status_notes": "Vulnerability CVE-2026-73565 does not affect version 1.19.11 of @hono/node-server. not_affected \u2014 The target version 1.19.11 does not contain the WebSocket functionality that is affected by CVE-2026-73565. The WebSocket feature (including the vulnerable waiter-map cleanup logic) was introduced upstream in version 2.0.0 via commit 35c1dfc. The target predates this feature entirely. The file src/websocket.ts does not exist, no WebSocket dependencies are present, and no code processes WebSocke...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-73565"
      },
      "impact_statement": "not_affected \u2014 The target version 1.19.11 does not contain the WebSocket functionality that is affected by CVE-2026-73565. The WebSocket feature (including the vulnerable waiter-map cleanup logic) was introduced upstream in version 2.0.0 via commit 35c1dfc. The target predates this feature entirely. The file src/websocket.ts does not exist, no WebSocket dependencies are present, and no code processes WebSocke..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.11",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.11"
          }
        }
      ],
      "timestamp": "2026-10-28T12:29:00.086581+00:00",
      "status_notes": "Vulnerability GHSA-9mqv-5hh9-4cgg does not affect version 1.19.11 of @hono/node-server. not_affected \u2014 Target version 1.19.11 is not affected by GHSA-9mqv-5hh9-4cgg. The vulnerability exists in the WebSocket upgrade handling code (src/websocket.ts), but this file and all WebSocket functionality were first introduced in version 2.0.0-rc.2 (commit 35c1dfc). Version 1.19.11 predates WebSocket support entirely and contains no code to receive or process WebSocket upgrade requests. Rule 5 Type A1 sati...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-9mqv-5hh9-4cgg"
      },
      "impact_statement": "not_affected \u2014 Target version 1.19.11 is not affected by GHSA-9mqv-5hh9-4cgg. The vulnerability exists in the WebSocket upgrade handling code (src/websocket.ts), but this file and all WebSocket functionality were first introduced in version 2.0.0-rc.2 (commit 35c1dfc). Version 1.19.11 predates WebSocket support entirely and contains no code to receive or process WebSocket upgrade requests. Rule 5 Type A1 sati..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.11",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.11"
          }
        }
      ],
      "timestamp": "2026-10-28T12:41:20.251568+00:00",
      "status_notes": "Vulnerability GHSA-frvp-7c67-39w9 affects version 1.19.11 of @hono/node-server, and is fixed in 1.19.11-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-frvp-7c67-39w9"
      },
      "action_statement": "Vulnerability GHSA-frvp-7c67-39w9 affects version 1.19.11 of @hono/node-server, and is fixed in 1.19.11-tuxcare.1."
    }
  ]
}