{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8fdc0f9e-a1c8-5ed0-b5c2-6586b07692e7",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/qs@0.6.6-tuxcare.4",
      "type": "library",
      "name": "qs",
      "version": "0.6.6-tuxcare.4",
      "purl": "pkg:npm/qs@0.6.6-tuxcare.4"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:172a193b-0085-5a93-9ae5-e07f08cc7274",
      "id": "CVE-2014-10064",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-10064 does not affect version 0.6.6-tuxcare.4 of qs. already_fixed \u2014 CVE-2014-10064 has been fixed in this version via TuxCare backport. The target code contains all necessary defenses against DoS attacks from deeply nested query strings: depth limiting (max 5 levels), parameter count limiting (max 1000), and array index limiting."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.6.6-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bab7190e-7e79-5e35-810a-dc74c34c793a",
      "id": "CVE-2014-7191",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-7191 does not affect version 0.6.6-tuxcare.4 of qs. already_fixed \u2014 CVE-2014-7191 has been fixed in this repository through TuxCare backports. The target version 0.6.6-tuxcare.5 contains all three defense mechanisms from the upstream patches: (1) array index limit of 20, (2) parameter limit of 1000, and (3) recursive sparse array compaction. These defenses prevent attackers from creating large sparse arrays that cause memory exhaustion. Git history confirms exp..."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.6.6-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cc60a0aa-c630-5979-9555-c4516fe3e319",
      "id": "CVE-2016-10538",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2016-10538 is fixed in version 0.6.6-tuxcare.4 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.6.6-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:485c2552-2427-5c30-b730-7da7590bcf78",
      "id": "CVE-2017-1000048",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-1000048 does not affect version 0.6.6-tuxcare.4 of qs. already_fixed \u2014 The target repository qs v0.6.6-tuxcare.5 already contains the complete fix for CVE-2017-1000048 (Prototype Pollution via bracket notation bypass). TuxCare applied the fix in commit a9869d5 on 2026-01-13, which adds the isPrototypeKey() function and comprehensive validation checks throughout the parsing logic to prevent Object.prototype property modification."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.6.6-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:47d927d0-1c5a-551a-8102-d493f84f5725",
      "id": "CVE-2022-24999",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-24999 does not affect version 0.6.6-tuxcare.4 of qs. already_fixed \u2014 The target repository (qs version 0.6.6-tuxcare.5 at SHA 4721edbb) already contains a comprehensive fix for CVE-2022-24999. The vulnerability, which allows attackers to cause Node process hangs via __proto__ key prototype pollution, has been mitigated through the isPrototypeKey() function that blocks __proto__, constructor, and prototype keys throughout the parsing chain. This protection is fun..."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.6.6-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7b8a816c-cf4f-551f-81ea-be84f1ec9693",
      "id": "CVE-2025-15284",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-15284 does not affect version 0.6.6-tuxcare.4 of qs. already_fixed \u2014 The target repository (qs version 0.6.6-tuxcare.5) already contains the fix for CVE-2025-15284. The vulnerability was addressed via TuxCare backport commit 3d13e12 on January 14, 2026, which added arrayLimit enforcement for bracket notation parameters. The fix is present in the current codebase at SHA 4721edb."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.6.6-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:86b5d5b7-4af0-5791-8c32-1a95ddb3b66d",
      "id": "CVE-2026-2391",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-2391 does not affect version 0.6.6-tuxcare.4 of qs. not_affected \u2014 Version 0.6.6 does not have the comma parsing feature required for this vulnerability. CVE-2026-2391 exploits a bypass in the arrayLimit enforcement when comma-separated values are parsed as arrays via the `comma: true` option. This version lacks both the comma parsing feature and the options system entirely, using only a hardcoded defaults object. All array-creation mechanisms that do exist (b..."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.6.6-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9239405a-eda5-546a-a564-aa1dfac054c4",
      "id": "CVE-2026-8723",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8723 does not affect version 0.6.6-tuxcare.4 of qs. not_affected \u2014 Target version 0.6.6 uses a fundamentally different architecture that predates the vulnerable code pattern. The arrayFormat: 'comma' and encodeValuesOnly options do not exist. Arrays with null/undefined are safely handled via String() coercion before encoding."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.6.6-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:78d82eab-af31-555b-af53-7204d8a6987f",
      "id": "GHSA-crvj-3gj9-gm2p",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 0.6.6-tuxcare.4."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.6.6-tuxcare.4"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/qs@0.6.6-tuxcare.4"
    }
  ]
}