{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0b75997a-2ed8-5b82-9328-e7902828845f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxt@3.12.3-tuxcare.7", "type": "library", "name": "nuxt", "version": "3.12.3-tuxcare.7", "purl": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:3cbfa3ff-e720-52e9-a0e0-ac6a9f392e46", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for nuxt 3.12.3-tuxcare.7. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:10b23237-d5b3-5c23-b731-7497fd7da52c", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b99a4edd-59dc-5902-95a5-af8d2da5abf5", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:beca5add-1181-5622-a8ee-cb2c4f7b4f3c", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:27bdc04c-b23c-5f75-a95b-6708075e0bce", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:06f8521b-be7a-5e76-afd8-53f3593db711", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:30ce4f72-4881-52c4-ba9e-a109bef30a8d", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:5bff08e5-31f0-5de7-b5f2-127d83e0206b", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:dc4378cd-1acd-5dd9-a6f8-33686f535ebc", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 3.12.3-tuxcare.7. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:ebfdf280-4089-5e6d-bdc4-009a562c3b94", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:67afe20e-0c11-5c84-b7ae-5dff6038a716", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:cdd09034-1772-5072-89f4-84546c7de09b", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:eef56c8c-d45d-59a2-94f5-8ccfac03f78b", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b8c9bd74-109e-5a4c-a930-7d2950b02886", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:d6233611-227d-5406-b1c4-abbdf04e3b82", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:67dd157e-38cf-5226-a96b-1aca797de11f", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b581ff31-97c8-5c0d-a21a-86541caf1f1d", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.7 of nuxt. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:3cae3fdd-8166-586d-b063-a3ad17bd87b2", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:294633d2-6d3e-59fb-91e9-f6a64305a176", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:528f62a6-98a7-516b-9651-31b70cce6a3c", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:fd001b30-80c6-5d09-9c22-8a030258999e", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.7 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:fc034394-8fa1-5ac9-8c1e-1f2b9af50f4c", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.7 of nuxt. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] } ], "dependencies": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.7" } ] }