{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e37d44b8-8baf-59fb-ae54-2da780d61f09", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@nuxt/schema", "purl": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10", "version": "3.12.3-tuxcare.10", "pedigree": { "ancestors": [ { "name": "@nuxt/schema", "purl": "pkg:npm/%40nuxt/schema@3.12.3", "type": "library", "version": "3.12.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25852", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:5d91566d-7ebe-58e8-be20-6f9d21128f53", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/schema 3.12.3-tuxcare.10. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." } }, { "id": "CVE-2024-34343", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:38eec3c3-6817-5298-9853-f4802792cf50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2024-34344", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:cc5a3fac-4d97-50e2-b71f-56edc68e6305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2025-24360", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:4b78499c-b524-56a2-a4ed-33c4b96a39a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2025-24361", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:fae87c07-9bc7-500f-96fd-48b5a692751f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2025-27415", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:60fc8fac-760f-54f1-966c-a010bc9ce7b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:ba1285b5-11ff-52a1-b35a-d3136df4583e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2026-41305", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:9dc27735-6bc4-5359-9dba-897ab0e538bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2026-42338", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:3a78dd92-9ba0-57fc-a6aa-872d27658553", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/schema 3.12.3-tuxcare.10. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:700024fe-8573-52fc-921b-239e5697a059", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:fc5fbd4b-f071-582a-a903-fb6855c60a27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:c7a649ff-dae2-5166-bc66-df604d075a59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47200 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:415b2fd4-1a50-5c4b-ad1f-b1d6ddeae282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:96b5a37e-62e2-5c6c-9dd0-417a01bb4164", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:f88e8d98-b4e3-5293-8632-25bce0dd3b59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:c9bc21ea-601b-5aa7-a45a-ef84c80a1909", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:df74fad8-fa17-53d4-8340-96c51b9b9d3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71314 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:eeeaf8e7-8779-5983-8d17-f99e10a4e739", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.10 of @nuxt/schema. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:7c43aeb2-092b-5446-adc0-5158ac749b93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71318 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:d0f9e68f-2fa1-56f3-8155-ebbf2b6cf590", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71320 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:f69b61fc-eecf-541c-9213-0f89bb073fd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71321 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:7592cf53-0094-5a5b-a104-73f28fb39fe8", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.10 of @nuxt/schema." } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:9109171e-1e11-564f-b5d1-0de604776bfb", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.10 of @nuxt/schema. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur...", "justification": "code_not_present" } }, { "id": "GHSA-xppm-jmw6-fhmf", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:f890e04d-5741-5f2f-8cd1-f94db2a4261d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/schema 3.12.3-tuxcare.10." } } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.10" } ] }