{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:73241c97-d3f6-52fd-9eb7-15bc9f677d0c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "fast-uri",
      "purl": "pkg:npm/fast-uri@3.1.7",
      "type": "library",
      "bom-ref": "pkg:npm/fast-uri@3.1.7",
      "version": "3.1.7",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-110095",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.7"
        }
      ],
      "bom-ref": "urn:uuid:0eb4eac6-d531-5644-9f87-de7e78fe2cf5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110095 affects version 3.1.7 of fast-uri, and is fixed in 3.1.7-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-110180",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.7"
        }
      ],
      "bom-ref": "urn:uuid:5e50ee32-f815-5623-9168-dc19e7a1d131",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110180 affects version 3.1.7 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-110306",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.7"
        }
      ],
      "bom-ref": "urn:uuid:1b037ea1-145b-53c4-abd7-a0319abad887",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110306 affects version 3.1.7 of fast-uri, and is fixed in 3.1.7-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-110725",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.7"
        }
      ],
      "bom-ref": "urn:uuid:bc3142bf-7e71-5dcd-a282-af508b3d331d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-110725 affects version 3.1.7 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-16221",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.7"
        }
      ],
      "bom-ref": "urn:uuid:c221d770-9897-5a22-8a10-650bc734dad2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-16221 does not affect version 3.1.7 of fast-uri. The target fast-uri v3.1.7 is NOT AFFECTED by CVE-2026-16221. The upstream vendor (Matteo Collina) already fixed this URL parser desync vulnerability in the v3.1.4 release, which is included in the target version. The fix (commit 2d50fba) is present in index.js at lines 422-426, where it rejects URIs containing literal backslashes in the authority component with the error \"URI authority must not contain a literal backslash.\" This prevents the parser desync where fast-uri would extract a different host than Node's WHATWG URL parser. The fix is confirmed by regression tests in test/security.test.js that verify all CVE-described attack inputs are rejected.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-86472",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@3.1.7"
        }
      ],
      "bom-ref": "urn:uuid:0079d8cc-4f3c-5f25-b277-16514997ae27",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-86472 affects version 3.1.7 of fast-uri, and is fixed in 3.1.7-tuxcare.1."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/fast-uri@3.1.7"
    }
  ]
}