{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:913dae3f-20e7-5bff-91b6-a536031a4d20",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@nuxt/vite-builder",
      "purl": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8",
      "type": "library",
      "bom-ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8",
      "version": "4.0.3-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "@nuxt/vite-builder",
            "purl": "pkg:npm/%40nuxt/vite-builder@4.0.3",
            "type": "library",
            "version": "4.0.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-25852",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:5939e7fb-6fb4-5fd4-be83-65a1396454b7",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/vite-builder 4.0.3-tuxcare.8. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match."
      }
    },
    {
      "id": "CVE-2025-59414",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f1e6c6ec-15f4-5e23-829a-e244b86a67f4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-25128",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:ff382054-40ec-5cd4-a83d-2930c77754a7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-41305",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d000c8f3-088d-553f-958e-5a544883a859",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-42338",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:533d0958-27b2-540e-acb7-6a91d1b17789",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/vite-builder 4.0.3-tuxcare.8. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match."
      }
    },
    {
      "id": "CVE-2026-44372",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:ecffebb8-d9bd-5266-971f-1e9f4e2f6cde",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44372 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-45669",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d3f5e9ec-13a9-52d7-b370-146dc935a94a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-45670",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:92e0605c-f570-504f-b54e-1c3b8ace4e5c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-45736",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:1c5172e5-61da-597d-929d-aaad4718bcd5",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-45736 is a false positive for @nuxt/vite-builder 4.0.3-tuxcare.8. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..."
      }
    },
    {
      "id": "CVE-2026-46342",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:5adc28d3-f302-557c-ba5c-025d35c7ab81",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-47200",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f3905462-ac4d-59a8-bfe6-ee9fee64341c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47200 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-49993",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:75a61bf1-d69e-5c46-87d2-88590e195412",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-53721",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:cae215cf-d87d-5e53-9da1-df8e853bf13b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-53722",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c4011b3d-7549-52aa-98a6-bc934a298620",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-56301",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:e2c7b81a-b84b-5f91-9fb7-36507353947a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-56301 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-56317",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:4a6de76c-c426-55f4-8456-d3e352f86dc0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-56317 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-56326",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0f56c0c6-cb44-58ab-8df1-39544d038a8c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-71314",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:00f89460-da88-5285-a616-f69fbe8806dd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71314 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-71316",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:70fa7c53-98b7-5b75-b594-0285d4063464",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.8 of @nuxt/vite-builder. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3.",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-71318",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c1b4780f-2139-5d16-8278-e72e90b96b28",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71318 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-71320",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:4018b7fd-a8fc-5c2b-b39b-d1b13067d8c8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71320 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "CVE-2026-71321",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c664b159-0e3e-5d79-b4af-f52edcf82f17",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71321 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "GHSA-2x6f-57hp-86fx",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f244abed-51f2-5d01-bba5-dd608d034535",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-2x6f-57hp-86fx is a false positive for @nuxt/vite-builder 4.0.3-tuxcare.8."
      }
    },
    {
      "id": "GHSA-534h-c3cw-v3h9",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:42faf1c6-90ea-547f-b485-3a58b17e3ff2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "GHSA-c9cv-mq2m-ppp3",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:9977ad47-30b3-58e3-ba46-0d46314359e7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "GHSA-m3q2-p4fw-w38m",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:a839fb00-11e6-5d98-ab3a-6e71e5dfa4ed",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "GHSA-rq7w-g337-39qq",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:9eb7f9d2-9f8b-5796-b24f-efcdc819691a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "GHSA-xppm-jmw6-fhmf",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:7524ca22-ef2e-5cfc-9dfe-1eb1b8fc94fb",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/vite-builder 4.0.3-tuxcare.8."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
    }
  ]
}