{"api_version":"v1","generated_at":"2026-10-07T16:20:00+00:00","product":{"cve_count":7,"evidence_gap_note":"Official registry publication history is linked, but a publisher support or retirement boundary has not been established.","id":"security:cve-cisa-thorium-d1b08074a2f7","lifecycle_state":"evidence_gap","linked_lifecycle_url":"https://lifecycle.blacktree.nl/libraries/npm/thorium","name":"Thorium","next_cursor":null,"observations":[{"affected":"1.0.0 < 6a65a27","affected_versions_present":true,"cve_id":"CVE-2025-35436","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-35436","fixed":"6a65a27","last_modified":"2025-09-30T16:36:16.594Z","patch_url":"https://github.com/mjcarson/thorium/commit/6a65a2711fb2387e8c3eacebc774053741bf5aeb","primary_source":"","published":"2025-09-17T16:53:47.289Z"},{"affected":"1.0.0 < 89101a6","affected_versions_present":true,"cve_id":"CVE-2025-35435","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-35435","fixed":"89101a6","last_modified":"2025-09-30T16:35:00.970Z","patch_url":"https://github.com/cisagov/thorium/commit/7c94a0b9bc2dc55e0c307360452f348bac06820c","primary_source":"","published":"2025-09-17T16:53:22.388Z"},{"affected":"1.0.0 < 1.1.2","affected_versions_present":true,"cve_id":"CVE-2025-35434","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-35434","fixed":"1.1.2","last_modified":"2025-09-30T16:32:05.835Z","patch_url":"https://github.com/cisagov/thorium/releases/tag/1.1.2","primary_source":"","published":"2025-09-17T16:53:08.899Z"},{"affected":"1.0.0 < 1.1.1","affected_versions_present":true,"cve_id":"CVE-2025-35433","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-35433","fixed":"1.1.1","last_modified":"2025-09-30T16:29:21.231Z","patch_url":"https://github.com/cisagov/thorium/commit/7c94a0b9bc2dc55e0c307360452f348bac06820c#diff-57a8b13962b268bcc3690df0f6c0d6ddeca7cbc7b05c3c20903cb07e659330eaR844-R849","primary_source":"","published":"2025-09-17T16:52:53.048Z"},{"affected":"1.0.0 < 1.1.1","affected_versions_present":true,"cve_id":"CVE-2025-35432","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-35432","fixed":"1.1.1","last_modified":"2025-09-30T16:27:11.928Z","patch_url":"https://github.com/cisagov/thorium/commit/7c94a0b9bc2dc55e0c307360452f348bac06820c#diff-bf9baa11b76cd169902a976bd17a5a6ee95a4098b2d3d150ba7d8f85b7e21dc9R281-R334","primary_source":"","published":"2025-09-17T16:52:34.949Z"},{"affected":"1.0.0 < 1.1.1","affected_versions_present":true,"cve_id":"CVE-2025-35431","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-35431","fixed":"1.1.1","last_modified":"2025-09-30T15:27:33.517Z","patch_url":"https://github.com/cisagov/thorium/commit/7c94a0b9bc2dc55e0c307360452f348bac06820c#diff-45e1e58dfb6faacf9efe778c31ead287d8e13ae07c5dad084c792bc4a0605a68R1007-R1008","primary_source":"","published":"2025-09-17T16:52:16.293Z"},{"affected":"1.0.0 < 1.1.2","affected_versions_present":true,"cve_id":"CVE-2025-35430","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-35430","fixed":"1.1.2","last_modified":"2025-09-30T15:26:55.208Z","patch_url":"https://github.com/cisagov/thorium/releases/tag/1.1.2","primary_source":"","published":"2025-09-17T16:51:52.544Z"}],"source_generated_at":"2026-10-07T06:21:30.017Z","vendor":"CISA"}}