{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c1d85784-9045-5e02-b40c-a0758f4b32f2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@nuxt/kit", "purl": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8", "version": "4.0.3-tuxcare.8", "pedigree": { "ancestors": [ { "name": "@nuxt/kit", "purl": "pkg:npm/%40nuxt/kit@4.0.3", "type": "library", "version": "4.0.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25852", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:484973b5-c5b1-50e7-b6a4-7c32c404a493", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/kit 4.0.3-tuxcare.8. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:91d8ac3e-f730-58ce-a6b7-7772e09b06a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-25128", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:6519f5fe-ab9e-5ac8-ac00-30973676ec41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-41305", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:d3972f36-c318-5db5-a6b3-f247df6b79bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-42338", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:3b71de0d-29c7-5807-8016-7d86288b45ab", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/kit 4.0.3-tuxcare.8. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match." } }, { "id": "CVE-2026-44372", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:c633b6ee-76d4-5c37-8b45-91fa2c789cd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44372 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:c911792d-4cf7-5761-a4c1-91e43f4c396a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-45670", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:ac0b69e3-97fb-5e02-a56f-712929eefcc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-45736", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:89e89f28-9034-51df-832b-1abf42eb9870", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-45736 is a false positive for @nuxt/kit 4.0.3-tuxcare.8. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:1507ff3b-a591-50b0-b689-cf5678f11e37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:59492d09-6af1-5f81-805a-94ddd7436792", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47200 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-49993", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:e578bb8a-2b95-5a32-8b27-464af67972c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:678c1f04-8b48-504a-9739-e877ba6da033", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:e5b0798c-0fad-59b1-9fc1-dcf9a644b819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-56301", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:d72ed9b5-c72e-568f-9a3b-62e660d0c152", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56301 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:5242e12e-12f3-5de1-8f53-84a5e32df1da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:82782253-51bb-58c9-85bb-811d03f20774", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:e7482c18-1af2-5115-862d-5a9e4cf036b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71314 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:26e996e0-87c3-5f4c-8986-eba66ddd4bee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.8 of @nuxt/kit. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:e6854063-ad67-58d8-922b-1899fb3fe794", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71318 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:de7971ed-fdc1-5784-a8e1-6a353a214340", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71320 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:4aa6acc7-e56a-5214-8e65-cedda4149e3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71321 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "GHSA-2x6f-57hp-86fx", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:fca89579-a013-5296-bb30-c4bbba0c3326", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-2x6f-57hp-86fx is a false positive for @nuxt/kit 4.0.3-tuxcare.8." } }, { "id": "GHSA-534h-c3cw-v3h9", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:700b6958-8f38-5198-a225-71283c0d38ee", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:17d37e42-a3db-54c9-95d1-8bd7915a7fc6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:a6016693-af8e-5f39-ad97-b99cb817aaa7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "GHSA-rq7w-g337-39qq", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:a00691f5-27a1-5b2a-9831-68c08cda47e3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.8 of @nuxt/kit." } }, { "id": "GHSA-xppm-jmw6-fhmf", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:f63e3988-4183-5d1f-b1a3-2296c961c612", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/kit 4.0.3-tuxcare.8." } } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.8" } ] }