{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:074f4a66-a0eb-5aa2-8d04-c2b4050e6679", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@astrojs/webapi", "purl": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10", "version": "2.10.15-tuxcare.10", "pedigree": { "ancestors": [ { "name": "@astrojs/webapi", "purl": "pkg:npm/%40astrojs/webapi@2.10.15", "type": "library", "version": "2.10.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:cc3ce287-89e5-564b-a889-d3937dcce2cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:e6eb079f-1a18-579c-98b3-2ffb73849cd1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:651239cb-f058-553a-b89b-2d21bba28f5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55303 affects version 2.10.15-tuxcare.10 of @astrojs/webapi, and is fixed in 2.10.15-tuxcare.11." } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:6a3c9f91-f556-5181-849b-b208820903db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:3ebe5150-ac04-5a55-b16e-bd20ff23cdc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:478f9b1d-0389-5c3f-8efe-2817644f5f7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:04358b52-c505-594e-ade2-6e3061813956", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:8b8e97cc-ca6c-56b8-8273-108fc2e4531f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:ed652c2d-0028-56ce-a145-1c6106ad4bee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2026-114128", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:a65c2fcb-688e-54a7-a3c9-97cce0e11ead", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114128 affects version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:e13ac55b-0b9e-5f79-bb0d-3e82eb94e83d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33769 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:81bea880-6cc0-543e-a729-f0a3194741e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:fe46b707-90fd-5faa-aa8e-c78139ae2b1a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45028 does not affect version 2.10.15-tuxcare.10 of @astrojs/webapi. not_affected \u2014 Astro version 2.10.14 is not affected by CVE-2026-45028. The server islands feature with encrypted parameter handling does not exist in this version. The vulnerability requires server islands (introduced in later versions) to be present, specifically the encryption/decryption of props and slots parameters via AES-GCM. Version 2.10.14 predates this feature entirely. While the repository contains...", "justification": "code_not_present" } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:42de7a5c-a262-5175-8d19-dae9e26183a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50146 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:aec1ff82-97ac-5a2f-99ca-bef4ea5cc760", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:c986dae3-f094-525a-96d9-26512f60a8fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54299 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2026-59728", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:0588823e-5d26-5c7a-9165-abc9b19c939b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59728 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:cca6e5dc-5b65-5cac-8ee4-ef4e0b4cf1ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:8e8189d1-8a57-520a-b663-cb3de00157cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-73422 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:fc4f460b-e5ba-5d38-b217-6855409e95d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84376 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:414fde16-eb4b-5c20-9838-b07ab35741af", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } }, { "id": "GHSA-4g3v-8h47-v7g6", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ], "bom-ref": "urn:uuid:e47ce8d7-95db-5d11-bf31-d46d8d3baee1", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 is fixed in version 2.10.15-tuxcare.10 of @astrojs/webapi." } } ], "dependencies": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.10" } ] }