{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a1342054-6876-546a-97cf-a7bee350cc67", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "astro", "purl": "pkg:npm/astro@3.6.5-tuxcare.11", "type": "library", "bom-ref": "pkg:npm/astro@3.6.5-tuxcare.11", "version": "3.6.5-tuxcare.11", "pedigree": { "ancestors": [ { "name": "astro", "purl": "pkg:npm/astro@3.6.5", "type": "library", "version": "3.6.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-47885", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:5f79e865-ed67-5d6f-a7da-fcb8432ff271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47885 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:d23082cb-d917-5643-97ac-33e7fca7643f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:0dd9314f-5802-532c-96cf-fc17a5172679", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:634fcf8f-5674-5cd9-8e4a-15ae182d5934", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55303 affects version 3.6.5-tuxcare.11 of astro, and is fixed in 3.6.5-tuxcare.12." } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:2f15fb09-4240-57bc-bd90-e1fd2fb6349a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2025-64525", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:3d656cfb-5e44-5a71-8708-b76747c31bae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64525 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:908647b5-70e1-5b6a-b537-64e28b7f68b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-64757 affects version 3.6.5-tuxcare.11 of astro, and is fixed in 3.6.5-tuxcare.12." } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:a96290b6-c947-525c-8dfb-66c15eb89b42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:f957c15a-f270-5713-a89d-52f040750afe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:f9daa12f-fe23-5616-97bc-584e60a621a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:0047ddbf-17f2-5b1c-b40c-87952efb297e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2026-114128", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:54c724c6-20c8-58dc-b44f-c4528e0abb45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114128 affects version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:f16fc81e-c0a4-54d4-9d8a-4297375eed69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33769 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:6207e55d-0918-51e0-82ff-e44682c62178", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:bb692335-4896-5d9f-9e54-ecd6e3a3057f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45028 does not affect version 3.6.5-tuxcare.11 of astro. not_affected \u2014 Astro version 3.6.5 is NOT AFFECTED by CVE-2026-45028. The vulnerability concerns server islands encryption (AES-GCM ciphertext replay between props and slots), but server islands functionality does not exist in version 3.6.5. The feature was introduced in later versions (~May 2025, v5.x/6.x), and the vulnerability was fixed in v6.1.10 (April 2026). Exhaustive search across 327 source files con...", "justification": "code_not_present" } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:25ea2b34-d35d-5fd7-9668-0035af4aa7ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50146 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:3daef958-2ab2-5154-b1d2-0e33f65bb62e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:d22fbcf6-2eda-5bfc-b471-3b03204b6b0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54299 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2026-59728", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:f5369420-7312-5e63-aedd-4ece94c704e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59728 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:8b79049a-6013-5b60-96b1-a789f1f0d9a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:e9ca00d8-9022-5647-9b23-a40874acbca4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-73422 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:b22e9e6f-28c7-5383-8243-ddf3a9e83e4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84376 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:9189ecd8-a1ed-5333-abe9-1e006c991cbb", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 is fixed in version 3.6.5-tuxcare.11 of astro." } }, { "id": "GHSA-4g3v-8h47-v7g6", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ], "bom-ref": "urn:uuid:3cafa03f-204a-5295-9e45-f02cc1f42730", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 is fixed in version 3.6.5-tuxcare.11 of astro." } } ], "dependencies": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.11" } ] }