{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d44f5fad-c855-5c22-88ea-f21e2190da22", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@nuxt/kit", "purl": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10", "version": "3.12.3-tuxcare.10", "pedigree": { "ancestors": [ { "name": "@nuxt/kit", "purl": "pkg:npm/%40nuxt/kit@3.12.3", "type": "library", "version": "3.12.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25852", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:332f2f21-aefb-5880-aeb8-67c7c5735b23", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/kit 3.12.3-tuxcare.10. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." } }, { "id": "CVE-2024-34343", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:47234e0e-6fd2-5cda-a911-d30b5c6386d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2024-34344", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:b7f61f1c-75da-594c-aa83-897c8d152ed8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2025-24360", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:cf6a645d-ec13-5115-8759-4524d78807c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2025-24361", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:3c7fb3e6-186d-5b64-a320-f5d6f5ad7cef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2025-27415", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:6a2a1c0a-eeb5-57d5-9208-7e41479ca739", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:906ebbbf-276b-5350-8a6d-433203f92fe5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2026-41305", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:c6e248ac-a70b-54e5-bdbb-79c2bf1efced", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2026-42338", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:9f89c749-e5cd-5988-8510-4d89dcadfb5e", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/kit 3.12.3-tuxcare.10. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:5df3b865-bd76-50e3-9d8f-9e0e991de1e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:576df39e-3ca3-5c15-bf15-281cf4345464", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:2773d5d5-8f38-5fcc-aa12-a3d040d88247", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47200 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:9eaacafc-6bd2-5ae0-ba4a-478e02023c56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:33342129-28d7-535f-aa45-4c7afbd85f34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:8fca4a56-9df7-5d23-98cb-f0f5ae151eff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:1e9e79fd-2d9c-5a91-a695-752a5b438d9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:640097f9-8bb7-5fa7-9fa2-bf8447f48644", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71314 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:95030907-a7ec-5984-b189-40aaf20f7d90", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.10 of @nuxt/kit. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:e53b9546-4526-56f2-853b-01889cdb5354", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71318 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:dd059cf7-e492-56ed-a07a-704e7033a7d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71320 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:a643d4c6-5b61-53ef-b0a2-9a546326d84f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71321 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:d678b08c-473a-5cf3-b053-7a03d687fa4c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.10 of @nuxt/kit." } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:c61178b9-f0b3-567c-97cf-8332f4ea27d9", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.10 of @nuxt/kit. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur...", "justification": "code_not_present" } }, { "id": "GHSA-xppm-jmw6-fhmf", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:333719c1-eee0-5b40-9cca-2929e400113c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/kit 3.12.3-tuxcare.10." } } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.10" } ] }