{
  "@id": "urn:uuid:8369a884-d10b-4a40-9115-15639281fd66",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T01:58:39.079103+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.14",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.14"
          }
        }
      ],
      "timestamp": "2026-10-29T01:58:39.079103+00:00",
      "status_notes": "Vulnerability CVE-2026-118663 affects version 1.19.14 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-118663"
      },
      "action_statement": "Vulnerability CVE-2026-118663 affects version 1.19.14 of @hono/node-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.14",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.14"
          }
        }
      ],
      "timestamp": "2026-10-28T12:30:55.489332+00:00",
      "status_notes": "Vulnerability CVE-2026-73565 does not affect version 1.19.14 of @hono/node-server. not_affected \u2014 Target version 1.19.14 does not contain WebSocket functionality. The vulnerable component (src/websocket.ts and the upgradeWebSocket helper) does not exist in this version. WebSocket support was introduced in v2.0.0 (commit 35c1dfc), which postdates the target version. Since the target cannot process WebSocket upgrade requests, the memory leak vulnerability in WebSocket handshake handling canno...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-73565"
      },
      "impact_statement": "not_affected \u2014 Target version 1.19.14 does not contain WebSocket functionality. The vulnerable component (src/websocket.ts and the upgradeWebSocket helper) does not exist in this version. WebSocket support was introduced in v2.0.0 (commit 35c1dfc), which postdates the target version. Since the target cannot process WebSocket upgrade requests, the memory leak vulnerability in WebSocket handshake handling canno..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.14",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.14"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-9mqv-5hh9-4cgg does not affect version 1.19.14 of @hono/node-server. not_affected \u2014 Target version 1.19.14 is not affected by GHSA-9mqv-5hh9-4cgg. The WebSocket upgrade functionality containing the memory leak vulnerability does not exist in this version. WebSocket support was introduced later in v2.0.0 (commit 35c1dfc, April 6 2026), after the 1.19.14 release. The vulnerable code path (src/websocket.ts, upgradeWebSocket function, waiterMap data structure) is absent from the t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-9mqv-5hh9-4cgg"
      },
      "impact_statement": "not_affected \u2014 Target version 1.19.14 is not affected by GHSA-9mqv-5hh9-4cgg. The WebSocket upgrade functionality containing the memory leak vulnerability does not exist in this version. WebSocket support was introduced later in v2.0.0 (commit 35c1dfc, April 6 2026), after the 1.19.14 release. The vulnerable code path (src/websocket.ts, upgradeWebSocket function, waiterMap data structure) is absent from the t..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.14",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.14"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-frvp-7c67-39w9 affects version 1.19.14 of @hono/node-server.",
      "vulnerability": {
        "name": "GHSA-frvp-7c67-39w9"
      },
      "action_statement": "Vulnerability GHSA-frvp-7c67-39w9 affects version 1.19.14 of @hono/node-server."
    }
  ]
}