{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:88a5fc99-8270-540e-ab22-5692c55252aa",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "fast-uri",
      "purl": "pkg:npm/fast-uri@3.1.6-tuxcare.2",
      "type": "library",
      "bom-ref": "pkg:npm/fast-uri@3.1.6-tuxcare.2",
      "version": "3.1.6-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "fast-uri",
            "purl": "pkg:npm/fast-uri@3.1.6",
            "type": "library",
            "version": "3.1.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-110095",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cd47324e-7cd7-5101-8fcf-f8956738fed1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110095 affects version 3.1.6-tuxcare.2 of fast-uri, and is fixed in 3.1.6-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-110180",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e41bef70-8880-5fa7-982b-a7086cfedb0e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110180 affects version 3.1.6-tuxcare.2 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-110306",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:969996d9-6d20-5e8b-9e52-486e20492e7a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110306 affects version 3.1.6-tuxcare.2 of fast-uri, and is fixed in 3.1.6-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-110725",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5765e70b-bd6d-5147-ad29-a83bd5bcfb58",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110725 affects version 3.1.6-tuxcare.2 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-16221",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ec9bcadc-cf51-5141-bb36-65a39060e995",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-16221 does not affect version 3.1.6-tuxcare.2 of fast-uri. Target fast-uri v3.1.6 is not affected by CVE-2026-16221. The vulnerability (host-confusion via literal backslash in URI authority allowing policy bypass) has been fixed by upstream vendor commit 2d50fbabc80e4d0884fe0f6a98fe118ce6faa353 authored by Matteo Collina (fastify/fast-uri maintainer). The fix is present at index.js:410-414, which rejects URIs containing literal backslash (U+005C) in the authority component with error \"URI authority must not contain a literal backslash.\" This prevents the parser divergence where fast-uri would extract host \"allowed.com\" from \"http://evil.com\\@allowed.com\" while Node's WHATWG URL would request \"evil.com\". Attribution analysis per A1\u2192A4 ladder shows no TuxCare signals (author domain matteocollina.com not in allowlist, no merge by TuxCare engineer, no GitLab profile, no Jira reference), confirming this is an upstream fix, not a TuxCare backport. Verdict: not_affected with justification code_not_present (vulnerable pattern removed by vendor fix).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-84292",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ef90a88e-1486-5f0c-9af0-2d7463a51354",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-84292 is fixed in version 3.1.6-tuxcare.2 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-84394",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f0b33642-cb2a-5044-9038-8e5240034d89",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-84394 is fixed in version 3.1.6-tuxcare.2 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-86472",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f1f12a40-28d4-5808-9134-6e320521c279",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-86472 is fixed in version 3.1.6-tuxcare.2 of fast-uri."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/fast-uri@3.1.6-tuxcare.2"
    }
  ]
}