{
  "@id": "urn:uuid:b53d9d01-5b6a-4852-b28c-a8b766ed23d0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-09-24T09:31:26.931840+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40unhead/dom@1.11.20-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40unhead/dom@1.11.20-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-31860 is fixed in version 1.11.20-tuxcare.3 of @unhead/dom.",
      "vulnerability": {
        "name": "CVE-2026-31860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40unhead/dom@1.11.20-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40unhead/dom@1.11.20-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-31873 is fixed in version 1.11.20-tuxcare.3 of @unhead/dom.",
      "vulnerability": {
        "name": "CVE-2026-31873"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40unhead/dom@1.11.20-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40unhead/dom@1.11.20-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-39315 is fixed in version 1.11.20-tuxcare.3 of @unhead/dom.",
      "vulnerability": {
        "name": "CVE-2026-39315"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40unhead/dom@1.11.20-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40unhead/dom@1.11.20-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-x7mm-9vvv-64w8 does not affect version 1.11.20-tuxcare.3 of @unhead/dom. not_affected \u2014 The target (unhead v1.11.20) is not affected by GHSA-x7mm-9vvv-64w8. The vulnerable streaming SSR functionality with configurable `streamKey` was introduced in v3.x of unhead. Version 1.11.20 is on the v1.x branch which predates this feature. The v1.x branch uses a completely different SSR implementation (`renderSSRHead` with structured tag rendering) that does not have the vulnerable pattern o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-x7mm-9vvv-64w8"
      },
      "impact_statement": "not_affected \u2014 The target (unhead v1.11.20) is not affected by GHSA-x7mm-9vvv-64w8. The vulnerable streaming SSR functionality with configurable `streamKey` was introduced in v3.x of unhead. Version 1.11.20 is on the v1.x branch which predates this feature. The v1.x branch uses a completely different SSR implementation (`renderSSRHead` with structured tag rendering) that does not have the vulnerable pattern o..."
    }
  ]
}