{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8cf274da-0b9d-5554-8f40-94c07754ad1c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@ai-sdk/provider-utils",
      "purl": "pkg:npm/%40ai-sdk/provider-utils@3.0.36",
      "type": "library",
      "bom-ref": "pkg:npm/%40ai-sdk/provider-utils@3.0.36",
      "version": "3.0.36",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-8769",
      "affects": [
        {
          "ref": "pkg:npm/%40ai-sdk/provider-utils@3.0.36"
        }
      ],
      "bom-ref": "urn:uuid:c6db6b47-d1a3-5934-8292-53d6b2e1a5bd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8769 does not affect version 3.0.36 of @ai-sdk/provider-utils. not_affected \u2014 Target version 3.0.36 is NOT AFFECTED by CVE-2026-8769. The vulnerability (unbounded memory consumption when reading oversized HTTP response bodies without size validation) was fixed by upstream vendor commit b85c4fbc60. All three vulnerable functions (createJsonErrorResponseHandler, createJsonResponseHandler, createStatusCodeErrorResponseHandler) now use readResponseWithSizeLimit, which valida...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40ai-sdk/provider-utils@3.0.36"
    }
  ]
}