{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ccc58a24-6512-5acf-ad92-fceb449ddcb7",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/js-yaml@3.15.0",
      "type": "library",
      "name": "js-yaml",
      "version": "3.15.0",
      "purl": "pkg:npm/js-yaml@3.15.0"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:2ef960fc-57e6-503c-ae1f-116568a049af",
      "id": "CVE-2026-53550",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-53550 does not affect version 3.15.0 of js-yaml. not_affected \u2014 The target (js-yaml v3.15.0 at SHA c34b6c4) does not contain the deduplication fix from CVE-2026-53550 Patch 1, but it has an upstream-authored mitigation (`maxTotalMergeKeys = 10000`) that prevents the CPU exhaustion attack. While the vulnerable code pattern (looping through merge arrays without deduplication) exists at lib/js-yaml/loader.js:344-347, the `maxTotalMergeKeys` limit caps total me..."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.15.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b0adfa62-9942-5b3c-bf95-9eac4159c801",
      "id": "CVE-2026-59868",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59868 does not affect version 3.15.0 of js-yaml. not_affected \u2014 The target repository (js-yaml v3.15.0) already contains the fix for CVE-2026-59868. The upstream maintainer (Vitaly Puzrin) backported the maxTotalMergeKeys defense from v5 to v3.15.0 on 2026-06-27, just before the 3.15.0 release. This fix limits the total number of merge keys processed per parse call to 10,000 by default, preventing the quadratic CPU consumption attack described in the CVE."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.15.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f0a4bee1-5cad-5848-b8b0-6dc715cf1e24",
      "id": "CVE-2026-73643",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-73643 does not affect version 3.15.0 of js-yaml. The target js-yaml v3.15.0 uses a fundamentally different parsing architecture than the vulnerable v5.x versions. The exponential reparsing vulnerability was introduced in commit fa4f1f7 (\"New event parser\", June 2026) which rewrote the parser from direct AST construction to event-based parsing with state snapshots. The target branched from v3.14.0 (common ancestor 34e5072f) and continued with the v3.x JavaScript architecture, while upstream evolved to v5.x TypeScript with the vulnerable event-based parser. The vulnerable code pattern (restoreState + parseNode reparsing) does not exist in v3.15.0. Empirical testing confirms linear-time parsing (3ms for 60 levels of nesting vs. \"minutes\" described in the CVE for v5.x)."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.15.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0c52e253-2a7f-5b1b-bbde-dbabba448904",
      "id": "GHSA-5p4m-2wfm-xmqj",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-5p4m-2wfm-xmqj affects version 3.15.0 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.15.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6c2a63f9-4e56-555b-94cf-fe0035725034",
      "id": "GHSA-pm4m-ph32-ghv5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-pm4m-ph32-ghv5 does not affect version 3.15.0 of js-yaml. not_affected \u2014 The target repository js-yaml version 3.15.0 is not affected by GHSA-pm4m-ph32-ghv5. The vulnerability exists in js-yaml v4.x and later versions that use a TypeScript-based parser architecture with state restoration and re-parsing logic. Version 3.15.0 uses a JavaScript-based parser implementation that parses flow collection entries only once, avoiding the exponential time complexity issue. PoC..."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.15.0"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/js-yaml@3.15.0"
    }
  ]
}