{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8080f839-34e2-5995-a5e9-46a1f7033efb", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6", "type": "library", "name": "@nuxt/rspack-builder", "version": "4.0.3-tuxcare.6", "purl": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:a130bca2-4a89-5ceb-9e8a-87815cd15696", "id": "CVE-2022-21670", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-21670 is fixed in version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1e7278e4-84eb-5fb9-a3a0-a0853f82638e", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/rspack-builder 4.0.3-tuxcare.6. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bf7aea06-b70e-5cc0-b265-bf94a38a7acb", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e46873bd-15a6-57b0-9949-8034618cb6b9", "id": "CVE-2026-25128", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dc3eda31-5332-56e6-a442-842aaded42bc", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0d3ce00b-ae89-5004-abd2-9f926655715a", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/rspack-builder 4.0.3-tuxcare.6. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:28fa8c7e-4dcd-5af7-a776-38607a750bde", "id": "CVE-2026-44372", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44372 is fixed in version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:118b8ec4-894d-5861-8b42-a6c012bccaec", "id": "CVE-2026-45669", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e648c4cc-a3ef-53ff-823e-557c74af3ae9", "id": "CVE-2026-45670", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:435c1ce5-8d70-528e-8bca-f8160c3fed5b", "id": "CVE-2026-45736", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-45736 is a false positive for @nuxt/rspack-builder 4.0.3-tuxcare.6. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ffd06cdf-0f44-5d65-b9ea-f6185f4f8c5c", "id": "CVE-2026-46342", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4e08e8c1-ccb3-53f4-860e-c4562b3489e6", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0ec89f09-f1b7-57ad-a397-d9549dc584d7", "id": "CVE-2026-49993", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f4a0c598-d477-5573-b8a6-4a6f04e18d83", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:64d5ff72-0ba7-5d22-bd6c-2b1eb081d36f", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:61144466-e218-502a-b8bd-3133848c2f54", "id": "CVE-2026-56326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4279e690-a56b-55ce-8397-b8ff3c290281", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b126b305-78d4-51b4-85e9-965eb9b43962", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.6 of @nuxt/rspack-builder. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4342051a-da2d-53c4-8ffe-3d1c58058faf", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dfaaf12d-40f5-541b-9589-ab9d70b67ec3", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d897fb97-d93d-5fb3-893c-4e64daac5f0a", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8b5108a0-460f-571e-82bf-969f9729471d", "id": "GHSA-534h-c3cw-v3h9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:01ab1eb1-450a-5e0e-85a4-04e8d3029d1e", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7204c536-7ea2-5827-9f61-db50f17742cc", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:080ea3d7-f6c3-58ca-bfe3-700d00765082", "id": "GHSA-rq7w-g337-39qq", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.6 of @nuxt/rspack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.6" } ] }