{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0328bdd5-f7b9-50d8-83fa-a468e7e87592",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/fast-uri@2.4.3",
      "type": "library",
      "name": "fast-uri",
      "version": "2.4.3",
      "purl": "pkg:npm/fast-uri@2.4.3"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:95c3ff21-1b86-5df2-a9d2-dd7b2b3a9aab",
      "id": "CVE-2026-16221",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-16221 affects version 2.4.3 of fast-uri."
      },
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@2.4.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e04dca99-1d3e-5899-b43e-85cc1362af46",
      "id": "CVE-2026-6321",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-6321 affects version 2.4.3 of fast-uri."
      },
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@2.4.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6f23de6a-df1e-54ad-9498-8e939ccf3df7",
      "id": "CVE-2026-6322",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-6322 does not affect version 2.4.3 of fast-uri. not_affected \u2014 CVE-2026-6322 is NOT present in fast-uri v2.4.3. The vulnerability (percent-encoded authority delimiter decoding causing authority structure changes) has been mitigated by upstream vendor fix in commit 23108bc, which introduced the reescapeHostDelimiters() defense. This fix was authored by Matteo Collina (upstream fast-uri maintainer) and backported to the 2.4.x line in fast-uri v2.4.1, prior t..."
      },
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@2.4.3"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/fast-uri@2.4.3"
    }
  ]
}