{
  "@id": "urn:uuid:d2ee435c-7af9-406c-8cf8-1fc6ebce180b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T01:58:39.079103+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.17",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.17"
          }
        }
      ],
      "timestamp": "2026-10-29T01:58:39.079103+00:00",
      "status_notes": "Vulnerability CVE-2026-118663 affects version 1.19.17 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-118663"
      },
      "action_statement": "Vulnerability CVE-2026-118663 affects version 1.19.17 of @hono/node-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.17",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.17"
          }
        }
      ],
      "timestamp": "2026-10-28T12:32:00.106633+00:00",
      "status_notes": "Vulnerability CVE-2026-73565 does not affect version 1.19.17 of @hono/node-server. not_affected \u2014 The target version 1.19.17 does not contain the vulnerable WebSocket functionality. The websocket feature (src/websocket.ts, upgradeWebSocket) was introduced in v2.0.0-rc.2 on the v2.x branch, while this target is on the v1.x maintenance branch. Exhaustive searches confirm zero websocket-related code exists in the repository at this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-73565"
      },
      "impact_statement": "not_affected \u2014 The target version 1.19.17 does not contain the vulnerable WebSocket functionality. The websocket feature (src/websocket.ts, upgradeWebSocket) was introduced in v2.0.0-rc.2 on the v2.x branch, while this target is on the v1.x maintenance branch. Exhaustive searches confirm zero websocket-related code exists in the repository at this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.17",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.17"
          }
        }
      ],
      "timestamp": "2026-10-28T12:27:22.621973+00:00",
      "status_notes": "Vulnerability GHSA-9mqv-5hh9-4cgg does not affect version 1.19.17 of @hono/node-server. not_affected \u2014 The target version 1.19.17 does not contain WebSocket functionality. The vulnerable code in src/websocket.ts and the upgradeWebSocket helper were introduced in version 2.0.0-rc.2 (commit 35c1dfc), which is after this version. The vulnerability fix was applied in v2.0.10 (commit 3a21938). Since the entire WebSocket feature doesn't exist in 1.19.17, the memory leak vulnerability cannot occur.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-9mqv-5hh9-4cgg"
      },
      "impact_statement": "not_affected \u2014 The target version 1.19.17 does not contain WebSocket functionality. The vulnerable code in src/websocket.ts and the upgradeWebSocket helper were introduced in version 2.0.0-rc.2 (commit 35c1dfc), which is after this version. The vulnerability fix was applied in v2.0.10 (commit 3a21938). Since the entire WebSocket feature doesn't exist in 1.19.17, the memory leak vulnerability cannot occur."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.17",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.17"
          }
        }
      ],
      "timestamp": "2026-10-28T12:25:14.970763+00:00",
      "status_notes": "Vulnerability GHSA-frvp-7c67-39w9 does not affect version 1.19.17 of @hono/node-server. not_affected \u2014 The target @hono/node-server version 1.19.17 is NOT AFFECTED by GHSA-frvp-7c67-39w9 (Windows path traversal via encoded backslash). The vulnerability pattern is not present because the upstream vendor (Yusuke Wada) already applied the fix in commit 84cb2ee on July 24, 2026, before TuxCare onboarded the package on August 21, 2026. The current code at src/serve-static.ts:114 contains the backslas...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-frvp-7c67-39w9"
      },
      "impact_statement": "not_affected \u2014 The target @hono/node-server version 1.19.17 is NOT AFFECTED by GHSA-frvp-7c67-39w9 (Windows path traversal via encoded backslash). The vulnerability pattern is not present because the upstream vendor (Yusuke Wada) already applied the fix in commit 84cb2ee on July 24, 2026, before TuxCare onboarded the package on August 21, 2026. The current code at src/serve-static.ts:114 contains the backslas..."
    }
  ]
}