{
  "@id": "urn:uuid:ca4cc332-029b-4de7-b402-0cefa4990476",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-14T14:21:03.410496+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-34601 is fixed in version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-34601"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-41672 is fixed in version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-41672"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-41673 is fixed in version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-41673"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-41674 is fixed in version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-41674"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-41675 is fixed in version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-41675"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-83605 is fixed in version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-83605"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-83606 does not affect version 0.7.13-tuxcare.2 of @xmldom/xmldom. Version 0.7.13 is NOT affected by CVE-2026-83606. The vulnerable code (lib/grammar.js with the quadratic-backtracking PI regex) does not exist in this version. Version 0.7.13 uses a different, safe PI parsing code path (parseInstruction in lib/sax.js:591-604) that bounds the search with indexOf('?>') BEFORE applying any regex, preventing the quadratic behavior. The CVE explicitly states that versions \u22640.8.13 use the indexOf-bounded path and are not affected. Testing confirms: the same 32KB unterminated PI input that causes >1000ms stall in vulnerable 0.9.x versions processes in 0.078ms in version 0.7.13.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-83606"
      },
      "impact_statement": "Version 0.7.13 is NOT affected by CVE-2026-83606. The vulnerable code (lib/grammar.js with the quadratic-backtracking PI regex) does not exist in this version. Version 0.7.13 uses a different, safe PI parsing code path (parseInstruction in lib/sax.js:591-604) that bounds the search with indexOf('?>') BEFORE applying any regex, preventing the quadratic behavior. The CVE explicitly states that versions \u22640.8.13 use the indexOf-bounded path and are not affected. Testing confirms: the same 32KB unterminated PI input that causes >1000ms stall in vulnerable 0.9.x versions processes in 0.078ms in version 0.7.13."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-83607 is fixed in version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-83607"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-83608 is fixed in version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-83608"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-83609 affects version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-83609"
      },
      "action_statement": "Vulnerability CVE-2026-83609 affects version 0.7.13-tuxcare.2 of @xmldom/xmldom."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-83610 is fixed in version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-83610"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-83611 is fixed in version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-83611"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-83612 does not affect version 0.7.13-tuxcare.2 of @xmldom/xmldom. CVE-2026-83612 describes a quadratic HTML raw-text output amplification vulnerability affecting xmldom 0.9.x (0.9.0-beta.1 through 0.9.11). The target version 0.7.13 is NOT affected. Empirical testing confirms no amplification occurs (1.0x ratio, linear growth), and architectural analysis shows the vulnerable code pattern does not exist in this version. The CVE explicitly states \"Only the 0.9.x line is affected\" and \"The 0.8.x line is **not** affected\" \u2014 0.7.13 predates 0.8.x and uses an older parseHtmlSpecialContent implementation that lacks the unconditional text emission mechanism introduced in the 0.9.0-beta.1 refactoring.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-83612"
      },
      "impact_statement": "CVE-2026-83612 describes a quadratic HTML raw-text output amplification vulnerability affecting xmldom 0.9.x (0.9.0-beta.1 through 0.9.11). The target version 0.7.13 is NOT affected. Empirical testing confirms no amplification occurs (1.0x ratio, linear growth), and architectural analysis shows the vulnerable code pattern does not exist in this version. The CVE explicitly states \"Only the 0.9.x line is affected\" and \"The 0.8.x line is **not** affected\" \u2014 0.7.13 predates 0.8.x and uses an older parseHtmlSpecialContent implementation that lacks the unconditional text emission mechanism introduced in the 0.9.0-beta.1 refactoring."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-83613 is fixed in version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-83613"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-83614 is fixed in version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-83614"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-83615 is fixed in version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-83615"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-83616 is fixed in version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-83616"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-83618 does not affect version 0.7.13-tuxcare.2 of @xmldom/xmldom. Version 0.7.13 is not affected by CVE-2026-83618. The vulnerability requires the `requireWellFormed` serializer feature and the `lib/grammar.js` module with m-flagged regexp validators, both introduced in version 0.9.10 (969 commits after 0.7.13). The CVE explicitly scopes to \"Only @xmldom/xmldom 0.9.x\" and describes a bypass of the GHSA-f6ww-3ggp-fr8h mitigation that does not exist in 0.7.13. Version 0.7.13 performs spec-compliant verbatim serialization without validation, which is the expected default behavior per W3C DOM Parsing specification.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-83618"
      },
      "impact_statement": "Version 0.7.13 is not affected by CVE-2026-83618. The vulnerability requires the `requireWellFormed` serializer feature and the `lib/grammar.js` module with m-flagged regexp validators, both introduced in version 0.9.10 (969 commits after 0.7.13). The CVE explicitly scopes to \"Only @xmldom/xmldom 0.9.x\" and describes a bypass of the GHSA-f6ww-3ggp-fr8h mitigation that does not exist in 0.7.13. Version 0.7.13 performs spec-compliant verbatim serialization without validation, which is the expected default behavior per W3C DOM Parsing specification."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40xmldom/xmldom@0.7.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:21:03.410496+00:00",
      "status_notes": "Vulnerability CVE-2026-83619 is fixed in version 0.7.13-tuxcare.2 of @xmldom/xmldom.",
      "vulnerability": {
        "name": "CVE-2026-83619"
      }
    }
  ]
}