{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:12ef270a-a706-5d51-a519-9661bdcd256e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@nuxt/schema", "purl": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8", "version": "4.0.3-tuxcare.8", "pedigree": { "ancestors": [ { "name": "@nuxt/schema", "purl": "pkg:npm/%40nuxt/schema@4.0.3", "type": "library", "version": "4.0.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25852", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:1ac6aa9d-750a-5bee-a275-d4aa518d6388", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/schema 4.0.3-tuxcare.8. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:8221b7e9-5d16-573e-8838-587ca92b8e0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-25128", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:11a0bcf9-893e-5d00-97d4-40f99b60dfca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-41305", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:23a8c5b5-5491-5914-88ec-07c1edfb5af9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-42338", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:1c431cc0-ca86-51ca-ab4b-0b921bc69a0b", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/schema 4.0.3-tuxcare.8. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match." } }, { "id": "CVE-2026-44372", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:99472c26-50ed-5832-b954-f4ccad046d5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44372 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:b5efe23f-6c4e-5d04-a380-24b88213914c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-45670", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:42b9c5e3-9bc8-5fb6-be06-c7baf3861e1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-45736", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:53850a74-c9be-5a06-8ad1-33028cdfe21c", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-45736 is a false positive for @nuxt/schema 4.0.3-tuxcare.8. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:2c52c9e3-6eaf-5f95-88e5-acce87a499d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:3af6be46-5883-5666-8106-623b1b51917e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47200 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-49993", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:3be026b5-4441-5c29-b47d-311fe01c5f72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:e148f6b5-7e0f-5a4d-b876-a42a77b1c502", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:9bfa0a3a-f958-5ad1-98e6-81dc016f1a0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-56301", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:2619b38d-ffdc-56c4-bd47-eabce0ad661f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56301 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:7e418031-2059-5955-a525-edc556034cee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:8144ee5b-a435-5e20-8e49-20f6db24b110", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:54e64c64-c2c4-5201-969b-664619e50c92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71314 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:040541af-d030-55e2-a605-8ade328bc9f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.8 of @nuxt/schema. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:0e420dc5-809e-57db-902c-1d71fa4c8194", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71318 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:e4bba498-c4ed-586e-854b-bb58f3b7d737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71320 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:d4fc085b-3b2d-5888-8ecf-ebcce517e280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71321 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "GHSA-2x6f-57hp-86fx", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:cea374cd-de17-5edf-afad-dcd36146a61a", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-2x6f-57hp-86fx is a false positive for @nuxt/schema 4.0.3-tuxcare.8." } }, { "id": "GHSA-534h-c3cw-v3h9", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:75d4589d-9264-51e2-9c7a-51ab9cd0248b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:c898142d-4043-5467-9623-b100904e07b9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:c39c5981-a78b-5c9d-8001-0440d1880c35", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "GHSA-rq7w-g337-39qq", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:babd141d-daf9-5d2e-a6b4-99bde35a07ec", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.8 of @nuxt/schema." } }, { "id": "GHSA-xppm-jmw6-fhmf", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:de3f64c6-7e82-5047-a955-25d103d7df9d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/schema 4.0.3-tuxcare.8." } } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.8" } ] }