{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:043b12f1-050d-5a43-9532-181175365205", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@next/env", "purl": "pkg:npm/%40next/env@13.5.11-tuxcare.20", "type": "library", "bom-ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20", "version": "13.5.11-tuxcare.20", "pedigree": { "ancestors": [ { "name": "@next/env", "purl": "pkg:npm/%40next/env@13.5.11", "type": "library", "version": "13.5.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "AIKIDO-2024-10173", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:d5d78b4a-55fe-5eb9-b728-f727af265bda", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2024-10173 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "AIKIDO-2025-10936", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:48ceec7b-f720-5b47-9d02-94f1366ed13e", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2025-10936 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2024-34351", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:b6bf25a9-46ff-5b17-a9ea-f7d03bc031d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34351 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2024-47831", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:bbbaa6aa-4f93-557f-a1d3-ed767df64781", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47831 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2024-51479", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:8773e44b-f8b0-5d71-96a7-596f65c4c3e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-51479 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2025-32421", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:ae11e36c-a202-5351-9e06-3832cb905bc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32421 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2025-48068", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:d110c912-4d7e-5a2c-bd3e-2e4e48738166", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48068 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2025-55173", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:8b508194-38b9-5e7b-9b2f-1fbf9ebe177c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55173 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2025-55183", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:bb336825-3837-551a-90cb-cfbabbc07b1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55183 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2025-55184", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:d665a44d-4903-5cc1-b534-147613917864", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55184 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2025-57752", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:1228c08b-c729-515d-aca4-808416f6030d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57752 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2025-57822", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:c0bad2d8-6ca5-5067-a13f-4e978813e9a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57822 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2025-59471", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:ae56df2f-1ed2-5966-9da6-48f8cf305562", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59471 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2025-59472", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:57efa33d-c89b-535a-9bd5-2d502681afb4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59472 does not affect version 13.5.11-tuxcare.20 of @next/env. not_affected \u2014 Version 13.5.11-tuxcare.13 is not affected by CVE-2025-59472. The vulnerable PPR (Partial Prerendering) resume endpoint feature does not exist in this version. The resume endpoint handler that processes `Next-Resume: 1` headers, the postponed-state processing logic, and the resume-data-cache decompression code were all introduced in much later Next.js versions (v16.3.0+). Version 13.5.11 predat...", "justification": "code_not_present" } }, { "id": "CVE-2025-67779", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:c05a48d2-9b3f-5108-a65b-aa694dd88873", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-67779 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-27980", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:019e0cc1-519f-510b-b0b3-5a0fae679ce9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27980 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-29057", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:e325f11d-bee5-5694-9718-9696d9bc3dfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29057 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-44572", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:0a6f32b5-239e-53e4-a2b7-6c59e6760b80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44572 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-44573", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:ae3b74dc-fdf3-57a0-a943-b921077cfeba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44573 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-44577", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:363ab5e6-000d-5058-aa9e-c8be98fe3f17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44577 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-44578", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:d0bd8760-d59b-5d38-ad16-6a20f2b21b92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44578 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-44580", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:ee4b7615-c78b-59a6-aea2-d51dd5edda82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44580 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-44581", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:82d797cb-5c25-5148-94de-bf187c77dc66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44581 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-44582", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:5148f8ca-23c0-5604-a54f-e41650cfba63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44582 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-64641", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:d9d9d67f-33c4-51b9-b63e-859f06725868", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64641 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-64643", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:6d365824-683c-5389-a2cf-fe07499e6bc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64643 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-64645", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:c3da3757-2566-5e85-9b86-1031d6a709fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64645 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-64646", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:2a805c95-61ea-5424-9785-1e2b86bec594", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64646 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-64647", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:f9252be3-22d8-517d-b26c-8e6701a20589", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64647 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-64648", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:25341765-7200-55b7-9f7c-b5fda079f4e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64648 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-75604", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:a9f12bb6-ceb1-5f75-a849-c381cd909be0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75604 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "CVE-2026-94482", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:ae91593e-51fa-5509-b5e3-5c4c9cbf664f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94482 affects version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "GHSA-2464-fhr4-w9xw", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:32a2f0d5-8a99-5874-85e7-ebd9a17129e9", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-2464-fhr4-w9xw does not affect version 13.5.11-tuxcare.20 of @next/env. not_affected \u2014 Next.js 13.5.11-tuxcare.18 is not affected by GHSA-2464-fhr4-w9xw because the vulnerable code (memory-related RCE in sharp library) is not present in the Next.js repository. Sharp is not bundled, vendored, or declared as a dependency in this version. The vulnerability only manifests when users separately install a vulnerable version of sharp (< 0.35.5). Later Next.js versions (lts-active, 16.3....", "justification": "requires_dependency" } }, { "id": "GHSA-2xp9-vwfh-vxw4", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:a1eaf797-30e8-53e8-9305-9584185fffba", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-2xp9-vwfh-vxw4 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "GHSA-5j59-xgg2-r9c4", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:3a2ab685-8437-5788-9988-f3b4b95a1118", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5j59-xgg2-r9c4 is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "GHSA-8h8q-6873-q5fj", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:4c02fb16-654a-5ffb-b9ce-200e5ff3315a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-8h8q-6873-q5fj is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "GHSA-h25m-26qc-wcjf", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:cdd4c335-7ee4-5b62-9f20-e53515bc525d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h25m-26qc-wcjf is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "GHSA-mwv6-3258-q52c", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:112833e3-cc9e-5252-9810-451186291567", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mwv6-3258-q52c is fixed in version 13.5.11-tuxcare.20 of @next/env." } }, { "id": "GHSA-q4gf-8mx6-v5v3", "affects": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:5a279b38-deb6-5b76-bb7c-c070b229df6f", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q4gf-8mx6-v5v3 is fixed in version 13.5.11-tuxcare.20 of @next/env." } } ], "dependencies": [ { "ref": "pkg:npm/%40next/env@13.5.11-tuxcare.20" } ] }