{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0880ebcc-b706-5146-b628-f5dc86dc6c48",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "fast-uri",
      "purl": "pkg:npm/fast-uri@3.1.5-tuxcare.4",
      "type": "library",
      "bom-ref": "pkg:npm/fast-uri@3.1.5-tuxcare.4",
      "version": "3.1.5-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "fast-uri",
            "purl": "pkg:npm/fast-uri@3.1.5",
            "type": "library",
            "version": "3.1.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-110095",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:3231f779-8871-5d78-b71a-e952892e09bf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110095 affects version 3.1.5-tuxcare.4 of fast-uri, and is fixed in 3.1.5-tuxcare.5."
      }
    },
    {
      "id": "CVE-2026-110180",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:0a0abff4-aa25-558e-97cf-e6ab5c01c008",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110180 affects version 3.1.5-tuxcare.4 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-110306",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:efed16e3-a30c-5caa-8844-9dd3afa09f10",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110306 affects version 3.1.5-tuxcare.4 of fast-uri, and is fixed in 3.1.5-tuxcare.5."
      }
    },
    {
      "id": "CVE-2026-110725",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:16f2719b-186a-5033-bd25-ae1c90b606cb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110725 affects version 3.1.5-tuxcare.4 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-16221",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:6cb784e7-437f-5fe9-8d50-057be4e7d112",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-16221 does not affect version 3.1.5-tuxcare.4 of fast-uri. The target fast-uri v3.1.5 is not affected by CVE-2026-16221. The vulnerability pattern (literal backslash in URI authority causing host-parsing divergence between fast-uri and Node's WHATWG URL) has been removed by upstream vendor fix commit 2d50fba authored by Matteo Collina. The fix rejects URIs containing literal backslash in the authority component by setting a parse error, preventing the host extraction difference that enables SSRF/redirect bypasses. This is an upstream vendor fix incorporated into v3.1.5, not a TuxCare backport.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-75899",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:2c1355ef-c5ca-5db2-933b-1dce8ebb9938",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-75899 is fixed in version 3.1.5-tuxcare.4 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-75931",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:7d9e28cc-d764-5055-bac4-03019a9d9295",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-75931 is fixed in version 3.1.5-tuxcare.4 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-75975",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b1aabe0c-0179-54ef-be03-3b324960d222",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-75975 is fixed in version 3.1.5-tuxcare.4 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-76172",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:7a39a848-d330-5295-abd6-a82591f9dbb9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-76172 is fixed in version 3.1.5-tuxcare.4 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-84292",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:0ed1a944-9794-57ad-924b-150aad04df07",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-84292 is fixed in version 3.1.5-tuxcare.4 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-86472",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:73e3362c-4009-5d3f-8563-ab64166bd33e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-86472 is fixed in version 3.1.5-tuxcare.4 of fast-uri."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/fast-uri@3.1.5-tuxcare.4"
    }
  ]
}