{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:94945859-3d21-5862-b302-8228f2b3818b",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/node-fetch@1.7.3",
      "type": "library",
      "name": "node-fetch",
      "version": "1.7.3",
      "purl": "pkg:npm/node-fetch@1.7.3"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:192317a2-5b72-56d8-b859-93fe1868c75f",
      "id": "CVE-2020-15168",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-15168 does not affect version 1.7.3 of node-fetch. not_affected \u2014 node-fetch v1.7.3-tuxcare.2 is NOT AFFECTED by CVE-2020-15168. The vulnerability pattern that affected v2/v3 (omitting 'size' from explicitly constructed redirect options) does not apply to v1.7.3's architecture. v1.7.3 passes the entire Request object during redirects, and the Request constructor preserves the size limit via 'init.size' extraction (request.js:55). Size validation is enforced d..."
      },
      "affects": [
        {
          "ref": "pkg:npm/node-fetch@1.7.3"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/node-fetch@1.7.3"
    }
  ]
}