{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:96726117-86f4-5c3e-8be8-492ed474a499",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@nuxt/schema",
      "purl": "pkg:npm/%40nuxt/schema@3.21.11",
      "type": "library",
      "bom-ref": "pkg:npm/%40nuxt/schema@3.21.11",
      "version": "3.21.11",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-45669",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/schema@3.21.11"
        }
      ],
      "bom-ref": "urn:uuid:d914e176-98c9-5163-a692-db1ea3c796cb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-45669 does not affect version 3.21.11 of @nuxt/schema. not_affected \u2014 The target repository (nuxt-framework at commit c9741235144c7a93ddbdc7d67281af22c4b62752) is NOT AFFECTED by CVE-2026-45669. The vulnerability pattern described in the CVE\u2014insufficient HTML encoding in `navigateTo()` external redirects allowing XSS via `<`, `>`, `&`, `'` characters\u2014is not present in the target. The upstream vendor fix (commit 17b27b08e by Daniel Roe) is already applied, introdu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-46342",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/schema@3.21.11"
        }
      ],
      "bom-ref": "urn:uuid:93f4f3d8-b07d-5c2d-9193-638940aa70da",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-46342 does not affect version 3.21.11 of @nuxt/schema. not_affected \u2014 The target repository (Nuxt v3.21.11) is not affected by CVE-2026-46342. The vulnerability (missing server-side hash validation for island component requests enabling cache poisoning) was fixed by the upstream Nuxt team in version 3.21.6 via commit 21c110acf authored by Daniel Roe. The current version 3.21.11 inherits this fix. The island handler at packages/nitro-server/src/runtime/handlers/is...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47200",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/schema@3.21.11"
        }
      ],
      "bom-ref": "urn:uuid:75362c80-f0f3-56ea-9366-d7e193d4abc6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47200 does not affect version 3.21.11 of @nuxt/schema. not_affected \u2014 The target repository (Nuxt v3.21.11) is not affected by CVE-2026-47200. The vulnerability fix was already included in the upstream Nuxt v3.21.11 release by vendor commit d152a5e069b7bcd90200e5d6e2e2c5bbae50e683 (authored by Daniel Roe, the upstream Nuxt maintainer). All defensive code is present: (1) the island handler propagates middleware responses via `~renderResponse`, (2) the router plugi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-71316",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/schema@3.21.11"
        }
      ],
      "bom-ref": "urn:uuid:240fa75b-e0ed-5846-a5d9-da3e68d11e5e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-71316 does not affect version 3.21.11 of @nuxt/schema. The target (Nuxt v3.21.11) is not affected by CVE-2026-71316. The vulnerability only affects Nuxt v4.4.0 through v4.5.0, where a runtime payload cache mechanism was introduced that could serve one user's SSR data to another user. The v3.x branch, including v3.21.11, never had this runtime payload cache feature. All payload caching in v3.21.11 is confined to prerender-time only via `import.meta.prerender` guards, and the payloadCache is null at runtime. The vulnerable code pattern (`useStorage('cache:nuxt:payload')` for runtime caching) does not exist in the v3.x codebase.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40nuxt/schema@3.21.11"
    }
  ]
}