{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:042ef591-3e71-5c81-bac9-86c9bd0bd04e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@next/font", "purl": "pkg:npm/%40next/font@13.5.11-tuxcare.20", "type": "library", "bom-ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20", "version": "13.5.11-tuxcare.20", "pedigree": { "ancestors": [ { "name": "@next/font", "purl": "pkg:npm/%40next/font@13.5.11", "type": "library", "version": "13.5.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "AIKIDO-2024-10173", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:bba65c21-e669-515c-8e94-704e8d7cd698", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2024-10173 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "AIKIDO-2025-10936", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:947f7259-4834-54b5-aa4c-cfb0ec3a3c17", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2025-10936 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2024-34351", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:83623cf8-f5e4-5952-9041-30241598501c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34351 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2024-47831", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:6e07aca2-aa33-5ed6-a056-4f205d04922b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47831 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2024-51479", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:a2f279b5-680a-5cf0-84cf-38080fef9357", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-51479 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2025-32421", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:52627814-9177-5862-8f6b-b94e30817062", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32421 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2025-48068", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:bbafeed8-307e-599d-97d5-de6befbb15d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48068 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2025-55173", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:97dc6439-e6c1-507c-8daa-37f95551d4c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55173 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2025-55183", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:4c418a6f-171f-5887-b5ed-0eb5e6d63330", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55183 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2025-55184", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:4e9ba2bd-dbcf-59c7-a7b0-a06bda32a290", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55184 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2025-57752", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:562e2745-9c8c-5c03-991e-ab306f454b98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57752 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2025-57822", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:919383f0-7fe5-5e1f-9bdf-aef615b7e361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57822 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2025-59471", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:714707b1-716e-52bd-9ee7-9b8a8ebe3ca6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59471 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2025-59472", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:b2269476-25b7-5ef7-bdbf-eff29e294680", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59472 does not affect version 13.5.11-tuxcare.20 of @next/font. not_affected \u2014 Version 13.5.11-tuxcare.13 is not affected by CVE-2025-59472. The vulnerable PPR (Partial Prerendering) resume endpoint feature does not exist in this version. The resume endpoint handler that processes `Next-Resume: 1` headers, the postponed-state processing logic, and the resume-data-cache decompression code were all introduced in much later Next.js versions (v16.3.0+). Version 13.5.11 predat...", "justification": "code_not_present" } }, { "id": "CVE-2025-67779", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:784349df-12f9-5013-bd22-f7eb24c4dd74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-67779 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-27980", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:2ef1d482-ce7f-5802-a34d-47b2d667affb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27980 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-29057", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:adfa615f-e0cc-5d4d-82a4-e5c2dd69ca4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29057 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-44572", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:d655c233-026b-5025-b8da-fde78b555d07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44572 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-44573", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:2ef5b105-0585-5fe2-a1ae-633dbb0dfed8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44573 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-44577", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:fc0bb4c4-a00c-52af-a2b3-5f05bd39288b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44577 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-44578", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:def5e243-dd99-5c0e-ae6c-a0a4b055495e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44578 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-44580", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:fc2ac36f-59ee-5508-a485-42f7bd2fe825", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44580 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-44581", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:cc19e265-5de8-5fcf-9738-303a04dd7963", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44581 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-44582", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:5a35b719-5c6b-57fc-8d98-66cec446f2a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44582 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-64641", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:6193dcb3-3704-5e70-b089-cbc3a6581e22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64641 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-64643", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:bd8853a3-8384-5eb1-9e8e-ba9333d78bad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64643 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-64645", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:f586b45c-f3a6-595b-9466-7cc378e99b77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64645 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-64646", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:aa9128ea-adeb-5add-9c89-df2f9fa9263a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64646 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-64647", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:073d6129-c1d8-52da-953c-14b61b92262c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64647 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-64648", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:deaf024e-d63c-5a55-83b3-3f57951a0b88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64648 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-75604", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:f551ae7a-9e3b-53e8-a721-855de1686df3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75604 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "CVE-2026-94482", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:0c775d5f-db73-5731-a899-7e226efa5a49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94482 affects version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "GHSA-2464-fhr4-w9xw", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:eb3392b7-13d4-505c-bc40-75ebd348a416", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-2464-fhr4-w9xw does not affect version 13.5.11-tuxcare.20 of @next/font. not_affected \u2014 Next.js 13.5.11-tuxcare.18 is not affected by GHSA-2464-fhr4-w9xw because the vulnerable code (memory-related RCE in sharp library) is not present in the Next.js repository. Sharp is not bundled, vendored, or declared as a dependency in this version. The vulnerability only manifests when users separately install a vulnerable version of sharp (< 0.35.5). Later Next.js versions (lts-active, 16.3....", "justification": "requires_dependency" } }, { "id": "GHSA-2xp9-vwfh-vxw4", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:8c3b84ad-6cc5-5dc2-bd9d-9a33922348f1", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-2xp9-vwfh-vxw4 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "GHSA-5j59-xgg2-r9c4", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:ca93a191-c558-531c-82cb-fb2772cb9a9a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5j59-xgg2-r9c4 is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "GHSA-8h8q-6873-q5fj", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:5b56dd1f-4066-50ce-ad4f-25efba2b5c19", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-8h8q-6873-q5fj is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "GHSA-h25m-26qc-wcjf", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:9dd8baf6-f321-5780-9095-a4f8f4b88bc4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h25m-26qc-wcjf is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "GHSA-mwv6-3258-q52c", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:df0b2092-fdbe-53d7-8c4b-eea21deb8694", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mwv6-3258-q52c is fixed in version 13.5.11-tuxcare.20 of @next/font." } }, { "id": "GHSA-q4gf-8mx6-v5v3", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ], "bom-ref": "urn:uuid:a0f31448-fca0-5fa0-a7e2-eeaad8255b10", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q4gf-8mx6-v5v3 is fixed in version 13.5.11-tuxcare.20 of @next/font." } } ], "dependencies": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.20" } ] }