{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:72b7cebc-a8fb-5387-b0bd-1e4f0bf9ecc4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@astrojs/webapi", "purl": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11", "type": "library", "bom-ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11", "version": "2.10.15-tuxcare.11", "pedigree": { "ancestors": [ { "name": "@astrojs/webapi", "purl": "pkg:npm/%40astrojs/webapi@2.10.15", "type": "library", "version": "2.10.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:bdb89f77-d901-5e1b-b47b-7bd5075887ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:727aa3a5-ae1f-53c5-9470-d5e2201efaba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:0348fb28-acea-54e0-bb58-445162418ee9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55303 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:11ee004e-c4d6-56b0-9449-6a7edcbb0175", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:b4d69138-c22a-5e10-be7f-ad9940cfa9ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:2c79f563-7352-5c5b-adf7-9c5ceed0da04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:a4f2a7df-e3dd-5809-be73-0a0f5eebdb69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:03258ad4-482c-5ba6-b047-d21f0acb8f47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:cedf313a-db42-5bff-90ce-6c435ea65880", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2026-114128", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:7c3490c7-d465-5788-bf06-16d788bd5707", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114128 affects version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:32fdc0d7-b286-5b83-a4bb-4f4110511874", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33769 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:0871f7fc-2b31-5690-b9be-114b561dacbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:f0ee4986-b9a8-5035-9f93-f3e427e23007", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45028 does not affect version 2.10.15-tuxcare.11 of @astrojs/webapi. not_affected \u2014 Astro version 2.10.14 is not affected by CVE-2026-45028. The server islands feature with encrypted parameter handling does not exist in this version. The vulnerability requires server islands (introduced in later versions) to be present, specifically the encryption/decryption of props and slots parameters via AES-GCM. Version 2.10.14 predates this feature entirely. While the repository contains...", "justification": "code_not_present" } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:10ae27cd-cf1f-5080-96ac-9e703295a6dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50146 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:90b58665-0130-5d31-938e-5948560ef902", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:432d34b5-4a1c-551c-9a7a-3b1aae2b5bd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54299 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2026-59728", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:d2efe52e-c846-5c17-afee-f533765a3d09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59728 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:2f7cebb3-228c-52e4-8932-e67c0da136b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:39449eb5-f445-5ab8-ab76-f099035325ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-73422 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:b03c016e-5e01-57b4-94b7-8c71b7b6a02c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84376 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:3b202ac9-0ba8-59e9-8760-4a77f7190e80", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } }, { "id": "GHSA-4g3v-8h47-v7g6", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ], "bom-ref": "urn:uuid:dade7d0b-c669-5086-85e5-942f022d6fbf", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 is fixed in version 2.10.15-tuxcare.11 of @astrojs/webapi." } } ], "dependencies": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.11" } ] }