{"api_version":"v1","generated_at":"2026-10-09T17:15:00+00:00","product":{"cve_count":6,"evidence_gap_note":"Official registry publication history is linked, but a publisher support or retirement boundary has not been established.","id":"security:cve-flavorjones-loofah-1520c45bd2f5","lifecycle_state":"evidence_gap","linked_lifecycle_url":"https://lifecycle.blacktree.nl/libraries/npm/loofah","name":"loofah","next_cursor":null,"observations":[{"affected":">= 2.25.0, < 2.25.2","affected_versions_present":true,"cve_id":"CVE-2026-73492","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-73492","fixed":"2.25.2.","last_modified":"2026-08-14T22:18:10.839Z","patch_url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2","primary_source":"","published":"2026-08-12T21:00:24.679Z"},{"affected":">= 2.25.0, < 2.25.2","affected_versions_present":true,"cve_id":"CVE-2026-73491","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-73491","fixed":"2.25.2.","last_modified":"2026-08-13T13:49:22.724Z","patch_url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv","primary_source":"","published":"2026-08-12T20:59:18.589Z"},{"affected":"< 2.25.2","affected_versions_present":true,"cve_id":"CVE-2026-73490","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-73490","fixed":"2.25.2.","last_modified":"2026-08-13T13:01:57.912Z","patch_url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf","primary_source":"","published":"2026-08-12T20:58:12.219Z"},{"affected":">= 2.2.0, < 2.19.1","affected_versions_present":true,"cve_id":"CVE-2022-23516","cve_url":"https://cve.blacktree.nl/cve/CVE-2022-23516","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2025-11-03T21:45:56.014Z","patch_url":"","primary_source":"","published":"2022-12-14T13:26:11.741Z"},{"affected":">= 2.1.0, < 2.19.1","affected_versions_present":true,"cve_id":"CVE-2022-23515","cve_url":"https://cve.blacktree.nl/cve/CVE-2022-23515","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2025-11-03T21:45:54.553Z","patch_url":"","primary_source":"","published":"2022-12-14T13:23:02.054Z"},{"affected":"< 2.19.1","affected_versions_present":true,"cve_id":"CVE-2022-23514","cve_url":"https://cve.blacktree.nl/cve/CVE-2022-23514","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2025-11-03T21:45:53.018Z","patch_url":"","primary_source":"","published":"2022-12-14T13:19:25.943Z"}],"source_generated_at":"2026-10-09T06:17:25.511Z","vendor":"flavorjones"}}