{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:07a8acc5-ad10-5cbb-91b2-75308bff894f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@nuxt/webpack-builder", "purl": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10", "version": "3.12.3-tuxcare.10", "pedigree": { "ancestors": [ { "name": "@nuxt/webpack-builder", "purl": "pkg:npm/%40nuxt/webpack-builder@3.12.3", "type": "library", "version": "3.12.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25852", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:e35cd968-d1ac-57a8-b305-443257ca0aa4", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/webpack-builder 3.12.3-tuxcare.10. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." } }, { "id": "CVE-2024-34343", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:c97d7c86-1888-5de8-9adc-a7e8f4c13094", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2024-34344", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:e1735de2-7763-5767-800a-05e5691f0edb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2025-24360", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:6918b8a1-b478-5648-baa1-6871e2c81d74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2025-24361", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:8b5687c3-cc7a-5010-b5f0-650ea2abfc4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2025-27415", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:88dc7fd2-3f97-568a-908a-093660459aa4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:b80fe796-019f-5194-a51b-e97df7f320af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-41305", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:e7a01763-9bab-54b5-a58c-6f8a7eb013d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-42338", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:a5ea2974-a825-5fb9-bdff-8a6e1a424684", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/webpack-builder 3.12.3-tuxcare.10. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:80861976-7ce9-5569-ab69-9aec6f1d2b5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:290f4035-79ac-53e7-8a9d-937862b2fdb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:f31751da-a6c1-5072-bc77-1c4cc53a3354", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47200 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:5b6fbbe7-cec2-50f4-916d-fdcaf9075436", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:efc45390-a946-5f2b-9a49-fab0cc56fa6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:24ea45c5-7106-5b65-b104-64568e8883f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:dafec7f4-acaa-5d82-9fa3-c515db803074", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:22107d07-3781-572f-a755-13a2916abb8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71314 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:dcbcd53a-1039-55a1-9663-64e49b74090d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.10 of @nuxt/webpack-builder. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:d1affd98-b2b6-5780-86ba-57ec962027f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71318 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:e67199c7-5292-5d6c-a83a-a8068a78f81c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71320 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:65c1e561-c701-5e77-9b99-9675ef5ee871", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71321 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:7f27e905-bd75-509c-b617-874025d590e7", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.10 of @nuxt/webpack-builder." } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:46dd4181-85aa-5bbd-a37b-b943a0b63377", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.10 of @nuxt/webpack-builder. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur...", "justification": "code_not_present" } }, { "id": "GHSA-xppm-jmw6-fhmf", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:bc927f9b-13cc-5ed5-9584-2766206cd666", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/webpack-builder 3.12.3-tuxcare.10." } } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.10" } ] }