{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3b3dd929-e9d8-5ef7-a463-04945b725931", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxt@4.0.3-tuxcare.6", "type": "library", "name": "nuxt", "version": "4.0.3-tuxcare.6", "purl": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:50c71951-ee84-590d-8d82-c785bd3d866a", "id": "CVE-2022-21670", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-21670 is fixed in version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b71c89a8-766a-578b-ae55-011285dbf0c6", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for nuxt 4.0.3-tuxcare.6. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:153d0c7a-e1fe-537f-bd33-2e35c7321fb4", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:be20f729-f868-59c7-b396-26049913b475", "id": "CVE-2026-25128", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fd4c84ca-7a7d-5333-bd46-5d35a564f1dc", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:de0dd400-46b6-5f17-8186-d675cbc0742d", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 4.0.3-tuxcare.6. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:febf4980-0eb4-5729-9a6d-99f75fe23e38", "id": "CVE-2026-44372", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44372 is fixed in version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e360645d-706f-54c2-a0cb-312ea3c1a387", "id": "CVE-2026-45669", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d73d94d9-7a32-5dd9-b887-1c16836d8983", "id": "CVE-2026-45670", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dc8f85e7-f1d0-5ac8-bad6-60bf16219398", "id": "CVE-2026-45736", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-45736 is a false positive for nuxt 4.0.3-tuxcare.6. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dc779430-8f25-57f6-85a5-b59241fbd76c", "id": "CVE-2026-46342", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ecc97ff5-9ef7-532e-8d34-8c8f95577c4a", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:76b5d13d-37a8-5a9a-8c21-a66766f60d22", "id": "CVE-2026-49993", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5f8f552b-1dc8-5b53-b202-38255c2916b2", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5cdc13be-4e7a-5976-b22e-917b58e97d0e", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:219fef82-9a98-501f-b030-b248835a6263", "id": "CVE-2026-56326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c267bbd7-5bed-5eb6-b66f-4f26a7a5e858", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2b7f15a0-6688-548b-844d-dffab5980977", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.6 of nuxt. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c7822961-0289-522b-89ae-382b8ed8ba09", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:96a5abe0-62fc-56cb-8a54-c308267b054d", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d5d5f2a1-9825-5162-9a8d-f00eb88410b3", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:43261d52-4ad3-5cc3-ab74-3e49a0f252ac", "id": "GHSA-534h-c3cw-v3h9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:998b5c23-abb9-56a5-9c37-ec7321a7604e", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8151e091-8ef4-5d46-a59b-10b3ea4c215c", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5104dd0f-577d-548f-a873-e98f16a249ed", "id": "GHSA-rq7w-g337-39qq", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.6" } ] }