{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f0480887-6e73-58cd-bc0d-e43288b62b35", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@next/env", "purl": "pkg:npm/%40next/env@13.5.11-tuxcare.19", "type": "library", "bom-ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19", "version": "13.5.11-tuxcare.19", "pedigree": { "ancestors": [ { "name": "@next/env", "purl": "pkg:npm/%40next/env@13.5.11", "type": "library", "version": "13.5.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "AIKIDO-2024-10173", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:1690a3f7-9874-580a-84be-7c5e6352c1f5", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2024-10173 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "AIKIDO-2025-10936", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:bb28b1cb-833c-5415-88b5-507b47a1da9c", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2025-10936 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2024-34351", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:0362444d-66ef-5cc4-9253-ad93dc5762ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34351 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2024-47831", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:62080df1-33fe-5140-bbb9-e49db8c2fa67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47831 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2024-51479", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:48f51aa5-2158-56c8-9646-214f3df00b2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-51479 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2025-32421", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:fa2b5643-a989-55cc-9161-4caa93e84e7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32421 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2025-48068", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:9bf450f3-ef00-57c2-a4b6-ab3ff704f29f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48068 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2025-55173", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:0f5974d8-5fe3-54e5-bb45-f7303692bc1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55173 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2025-55183", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:e1fed52f-0c7e-53d1-b299-f1cda4f0b847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55183 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2025-55184", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:d57e786c-e76d-55f7-b1ab-d901c2fd07d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55184 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2025-57752", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:99c32215-b45d-5efb-ad9e-4b8244f1e172", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57752 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2025-57822", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:70abc8a0-334a-5893-90a2-35805b360792", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57822 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2025-59471", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:3fd99229-9883-5108-b030-d94ef20a2b06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59471 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2025-59472", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:bd60ae34-27e3-56ea-8a04-420020ee709d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59472 does not affect version 13.5.11-tuxcare.19 of @next/env. not_affected \u2014 Version 13.5.11-tuxcare.13 is not affected by CVE-2025-59472. The vulnerable PPR (Partial Prerendering) resume endpoint feature does not exist in this version. The resume endpoint handler that processes `Next-Resume: 1` headers, the postponed-state processing logic, and the resume-data-cache decompression code were all introduced in much later Next.js versions (v16.3.0+). Version 13.5.11 predat...", "justification": "code_not_present" } }, { "id": "CVE-2025-67779", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:ffb34e00-cf2d-5efd-9fdd-ddaf3c96755c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-67779 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-27980", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:62818d05-fa15-5cb3-8ae8-8f610fc2ad94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27980 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-29057", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:18a50e7f-acf9-5bea-a9c4-e0e7750523fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29057 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-44572", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:ba1290a5-d66b-5521-96e8-3eae29d711d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44572 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-44573", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:bf7a0476-cf80-53ba-93bd-b926d56a7a75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44573 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-44577", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:f8470e0b-9ff2-5a4a-900e-b8fe49b285c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44577 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-44578", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:ce59fd98-61ea-5101-8a2d-b93b753faa75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44578 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-44580", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:fb6949db-1c9a-529d-8f89-956d74b2b605", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44580 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-44581", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:9eabfdce-a5a4-5f36-ac9d-3535e09b8a81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44581 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-44582", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:9e4ddff8-e23a-5c18-88e4-1403d5bed97a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44582 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-64641", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:b8b0a716-919c-5d59-91cc-5e18ac0d06c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64641 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-64643", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:21d29412-0eff-5331-aa02-fc2b4773a5f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64643 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-64645", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:bfbdc9ca-7677-53a1-91d1-be0a571a50e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64645 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-64646", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:6b54cced-6135-5325-b63c-75d341bc7996", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64646 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-64647", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:2d63df65-249e-508c-bba3-365b685868fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64647 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-64648", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:1d7be9e4-f61a-5f6f-8e62-6d55e60406a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64648 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-75604", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:49cdd661-095b-5c53-aba5-286c53b257c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75604 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "CVE-2026-94482", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:1e3d1a82-8e9f-5ca8-b997-708d08e14047", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94482 affects version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "GHSA-2464-fhr4-w9xw", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:a3bcf340-de5d-5fb8-b36b-695d5654b7a0", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-2464-fhr4-w9xw does not affect version 13.5.11-tuxcare.19 of @next/env. not_affected \u2014 Next.js 13.5.11-tuxcare.18 is not affected by GHSA-2464-fhr4-w9xw because the vulnerable code (memory-related RCE in sharp library) is not present in the Next.js repository. Sharp is not bundled, vendored, or declared as a dependency in this version. The vulnerability only manifests when users separately install a vulnerable version of sharp (< 0.35.5). Later Next.js versions (lts-active, 16.3....", "justification": "requires_dependency" } }, { "id": "GHSA-2xp9-vwfh-vxw4", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:21bd4963-b307-5398-838f-93179a9bcf93", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-2xp9-vwfh-vxw4 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "GHSA-5j59-xgg2-r9c4", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:ffa0d4ea-89a0-5d49-bca0-dd015179b205", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5j59-xgg2-r9c4 is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "GHSA-8h8q-6873-q5fj", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:12c5bc80-ac0d-518f-8527-bda3ffac9e12", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-8h8q-6873-q5fj is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "GHSA-h25m-26qc-wcjf", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:c9f1377e-5430-5d33-8fed-04906e57f72c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h25m-26qc-wcjf is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "GHSA-mwv6-3258-q52c", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:330c1cbe-e943-51fc-a277-741aa7c5c240", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mwv6-3258-q52c is fixed in version 13.5.11-tuxcare.19 of @next/env." } }, { "id": "GHSA-q4gf-8mx6-v5v3", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:a2e99841-b7b7-5032-9957-73b2fbf4f5a4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q4gf-8mx6-v5v3 is fixed in version 13.5.11-tuxcare.19 of @next/env." } } ], "dependencies": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.19" } ] }