{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f5e539f9-08cf-57c0-bf9c-3d74defe2cc8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "devalue",
      "purl": "pkg:npm/devalue@5.9.1-tuxcare.3",
      "type": "library",
      "bom-ref": "pkg:npm/devalue@5.9.1-tuxcare.3",
      "version": "5.9.1-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "devalue",
            "purl": "pkg:npm/devalue@5.9.1",
            "type": "library",
            "version": "5.9.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-81176",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:fb8cfa6b-a873-5234-b41b-fdd519eaa997",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-81176 is fixed in version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "CVE-2026-92708",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a3492a5e-e970-530a-9ad9-8c15a82db0ba",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-92708 is fixed in version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "GHSA-4q55-j62x-fr9h",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:858e5807-32db-5d6f-8863-8294d7ad711f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-4q55-j62x-fr9h is fixed in version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "GHSA-hx4r-w6wj-j8fg",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7511a756-bfec-5a32-829d-d87bb9254ec9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-hx4r-w6wj-j8fg is fixed in version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "GHSA-mcm9-63f2-9j32",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5da0a4bd-acf8-5d5d-9183-f8e85d3ef352",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-mcm9-63f2-9j32 does not affect version 5.9.1-tuxcare.3 of devalue. not_affected \u2014 The target version 5.9.1 is NOT affected by GHSA-mcm9-63f2-9j32. The vulnerability (sparse array amplification DoS) was fixed by upstream commit 819f1ac, which is present in version 5.9.1. The fix prevents the scenario where parsing a small serialized sparse array and passing it to uneval() could generate a massive output string by iterating millions of indices. Both stringify.js and uneval.js ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-r9w8-h9r3-54w4",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a6c0dcfa-a806-5ecf-afb4-a0b24a266019",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-r9w8-h9r3-54w4 is fixed in version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "GHSA-wf3x-273g-mvxv",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:3bb36f3b-c2b0-53e7-a609-4b80aaf9bed6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-wf3x-273g-mvxv is fixed in version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "GHSA-x5rw-q4pp-hg5g",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:326ea4c8-bc3e-5ef2-8f29-2dd32ae45fa0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-x5rw-q4pp-hg5g is fixed in version 5.9.1-tuxcare.3 of devalue."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
    }
  ]
}