{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d1bdcd68-0811-5e09-bfc2-c39cee1fdf32",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "fast-uri",
      "purl": "pkg:npm/fast-uri@2.4.7",
      "type": "library",
      "bom-ref": "pkg:npm/fast-uri@2.4.7",
      "version": "2.4.7",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-110095",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@2.4.7"
        }
      ],
      "bom-ref": "urn:uuid:85e43128-51eb-5d8f-b92c-90fcf0ac462f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110095 affects version 2.4.7 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-110180",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@2.4.7"
        }
      ],
      "bom-ref": "urn:uuid:86852be7-8c54-532a-aca3-0f7ec4c2144c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110180 affects version 2.4.7 of fast-uri, and is fixed in 2.4.7-tuxcare.1."
      }
    },
    {
      "id": "CVE-2026-110306",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@2.4.7"
        }
      ],
      "bom-ref": "urn:uuid:205454a3-f306-5743-8447-b0d43d402bba",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110306 affects version 2.4.7 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-110725",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@2.4.7"
        }
      ],
      "bom-ref": "urn:uuid:2a096fec-f84b-5c10-a626-98b4b15037c7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110725 affects version 2.4.7 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-16221",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@2.4.7"
        }
      ],
      "bom-ref": "urn:uuid:a192cd95-a552-5f5a-8c19-e03e59a2bb41",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-16221 does not affect version 2.4.7 of fast-uri. Target fast-uri v2.4.7 is NOT AFFECTED. The vulnerability (CVE-2026-16221) involves literal backslash handling in URI authority components that could cause host-based security policy bypass. The upstream vendor (Matteo Collina) fixed this in commit 9438266d released in v2.4.3. Since the target is v2.4.7 (later than v2.4.3), the fix is already present. The fix detects literal backslashes in the authority component and marks such URIs as malformed, preventing the parser desync between fast-uri and Node's native URL parser.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-6321",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@2.4.7"
        }
      ],
      "bom-ref": "urn:uuid:86269173-a30a-55cb-bea8-3efefc666d8a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-6321 does not affect version 2.4.7 of fast-uri. The target repository (fast-uri v2.4.7 at SHA 4c4f89ba8f6bfbe29da640eca6a232e6afd1fcd0) is NOT affected by CVE-2026-6321. The vulnerability pattern\u2014decoding percent-encoded path separators (%2F) and dot segments (%2E) before normalization, allowing path traversal\u2014is absent from the target. Upstream vendor commit 30951f83b874bfa0490477b322f7e0d8b7a11685 by Matteo Collina (hello@matteocollina.com) already applied the fix before version 2.4.7 was released. The fix introduces normalizePathEncoding() which preserves %2F and %2E during parsing and normalization, preventing them from being interpreted as live path syntax. Manual testing and code review confirm the defense is active: normalize('http://example.com/public/%2e%2e/admin') returns 'http://example.com/public/%2E%2E/admin' (encoded form preserved), and equal() correctly treats encoded and decoded paths as distinct URIs.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-6322",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@2.4.7"
        }
      ],
      "bom-ref": "urn:uuid:f48a91c0-29d6-54b8-9b86-5c190b9de503",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-6322 does not affect version 2.4.7 of fast-uri. The target repository (fast-uri v2.4.7 at commit 4c4f89b) is NOT affected by CVE-2026-6322. The vulnerability pattern has been removed by an upstream vendor fix present in commit 23108bcef6fda275510b46222e33c24595bf482c, authored by Matteo Collina (hello@matteocollina.com). The fix introduces the `reescapeHostDelimiters()` function that re-encodes authority delimiter characters (@, :, /, ?, #) after decoding, preventing percent-encoded delimiters from being serialized as live delimiters that would change the URI authority structure. All attribution checks (A1-A4) failed: the author domain is not in the TuxCare allowlist, no merge commit with TuxCare committer exists, no GitLab profile match, and no Jira reference. This is an upstream fix, not a TuxCare backport, therefore verdict is not_affected rather than already_fixed.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/fast-uri@2.4.7"
    }
  ]
}