{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7f1e7884-8836-56db-a635-8b1032f4e413", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@nuxt/vite-builder", "purl": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10", "version": "3.12.3-tuxcare.10", "pedigree": { "ancestors": [ { "name": "@nuxt/vite-builder", "purl": "pkg:npm/%40nuxt/vite-builder@3.12.3", "type": "library", "version": "3.12.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25852", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:d16dcddf-05d8-5281-b969-6a844596cc30", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/vite-builder 3.12.3-tuxcare.10. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." } }, { "id": "CVE-2024-34343", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:1a8a71dc-c01f-50a2-b791-4eb587ba5290", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2024-34344", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:43310ef8-4b19-5cbc-8875-2e11f6690bf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2025-24360", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:2f8ec571-4de5-5386-a668-0c733439f344", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2025-24361", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:8931f204-55a6-5802-a7bd-bf161c97efe5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2025-27415", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:bf824b70-bec4-5ca8-81fa-eecd13ef679c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:2a15e110-7013-5779-8d10-5f3f3256057c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2026-41305", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:30c309d6-3773-55cf-9633-73334fa2df15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2026-42338", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:2db12a48-bae8-54d5-8593-780e1c541fb2", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/vite-builder 3.12.3-tuxcare.10. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:b221b20a-d78b-5583-b887-d43f701d217a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:08eaebaf-fba4-51f8-ac2d-d3d43d000a79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:3fcfdfb5-0501-5b4e-8dc4-c3dc90c35ad8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47200 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:ce44f7d3-8e22-5efa-85a5-de007bd005d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:203b29d7-8460-5453-a968-58efd7da54ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:9cdecbae-20f7-536c-aa83-a7bb274cece4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:aa04fa5a-8d37-53a9-a275-1c6510d70ed0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:d63ea764-748a-5aaa-a7e3-f9feceb0e694", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71314 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:d8a1ef2b-e119-5600-8390-68b4e56db800", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.10 of @nuxt/vite-builder. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:fad47d4b-bc3d-554c-90f0-a6c756d6136b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71318 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:bb01cdfc-7c31-5831-b908-3db600a4e95a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71320 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:92da83e6-a3ca-5d9c-a76b-f9505d0bcd37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71321 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:ebe9b7d6-1478-5af0-ba78-3b12a3100226", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.10 of @nuxt/vite-builder." } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:439714b7-10b1-56f7-8785-54f16ea65ec2", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.10 of @nuxt/vite-builder. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur...", "justification": "code_not_present" } }, { "id": "GHSA-xppm-jmw6-fhmf", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:abec1e30-d076-5e9b-9868-5277a26f0d08", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/vite-builder 3.12.3-tuxcare.10." } } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.10" } ] }