{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:05037ce8-8ef5-588d-901d-7e9bbf0c2143",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@nuxt/webpack-builder",
      "purl": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8",
      "type": "library",
      "bom-ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8",
      "version": "4.0.3-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "@nuxt/webpack-builder",
            "purl": "pkg:npm/%40nuxt/webpack-builder@4.0.3",
            "type": "library",
            "version": "4.0.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-25852",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c9cb270b-1040-58be-95b1-7d1b0adc15e4",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/webpack-builder 4.0.3-tuxcare.8. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match."
      }
    },
    {
      "id": "CVE-2025-59414",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:2d99bfeb-e3cf-5236-84aa-e18e2ee43816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-25128",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:15a91bc4-90c8-5657-a779-db133c06827e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-41305",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f8ba8759-aa1c-5207-bafe-c13b57d336e5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-42338",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:383a54d5-7c6b-53a3-a3d9-c7868cc7774b",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/webpack-builder 4.0.3-tuxcare.8. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match."
      }
    },
    {
      "id": "CVE-2026-44372",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:e0ec0536-e653-59c2-85cf-4a6b96d14319",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44372 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-45669",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d19b0f4c-ab8e-5624-a003-0ee944de5d36",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-45670",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:56e7d855-4aa1-54cb-8833-1e3978982b92",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-45736",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:40f43b29-0200-5ee6-8fb8-95eefd91cf0a",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-45736 is a false positive for @nuxt/webpack-builder 4.0.3-tuxcare.8. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..."
      }
    },
    {
      "id": "CVE-2026-46342",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:7bf50de7-0b12-5455-98e3-6dd36d726093",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-47200",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:47f91579-0a18-576d-a5d6-f950964a0c85",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47200 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-49993",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:46087ffb-eb01-5dee-94d5-404121beb8ec",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-53721",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:8d14eae6-bce3-5c54-802d-1cb2e757698b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-53722",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:1e8740f6-f0e9-5723-9236-dd23b5adb527",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-56301",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:e6eeb232-80c7-566b-a581-b20f86c7b3a4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-56301 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-56317",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:e42fd8aa-a71d-5e77-8d04-0e362d63e83f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-56317 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-56326",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:7c6d7ee1-223a-52a6-9a36-6aee9c9771ce",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-71314",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:95ddf3d8-c68c-5077-ab22-4f335e607375",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71314 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-71316",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:b0aaa42d-922c-5b27-a9db-06704aa9acbc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.8 of @nuxt/webpack-builder. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3.",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-71318",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:82e614c1-2520-54d4-97e8-7a2414b1fe3d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71318 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-71320",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0efc89d9-38a2-524d-bf42-d19cb9bfd58a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71320 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "CVE-2026-71321",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:6738582a-e72e-504d-bff0-2400f19b0e7b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71321 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "GHSA-2x6f-57hp-86fx",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:57cee005-74f4-5ae4-aa65-38f4055cc1ba",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-2x6f-57hp-86fx is a false positive for @nuxt/webpack-builder 4.0.3-tuxcare.8."
      }
    },
    {
      "id": "GHSA-534h-c3cw-v3h9",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:bfbeecc1-ff66-59b5-a95d-6338294e5364",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "GHSA-c9cv-mq2m-ppp3",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:7bdbd1d3-c667-555a-b72f-c9dcad639599",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "GHSA-m3q2-p4fw-w38m",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:fca9e921-2a81-5821-b58d-d7476ab05eef",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "GHSA-rq7w-g337-39qq",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0d680f89-02fc-5271-8032-effe1cc723b2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.8 of @nuxt/webpack-builder."
      }
    },
    {
      "id": "GHSA-xppm-jmw6-fhmf",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:5e3418d8-658b-550e-bfd4-ab43747d2cce",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/webpack-builder 4.0.3-tuxcare.8."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.8"
    }
  ]
}