{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6c54dad8-2a62-58d3-b500-4ecf0f7c226c",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/qs@2.3.3",
      "type": "library",
      "name": "qs",
      "version": "2.3.3",
      "purl": "pkg:npm/qs@2.3.3"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:6fb23a2d-7129-597f-af71-b9af058456ef",
      "id": "CVE-2026-2391",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-2391 does not affect version 2.3.3 of qs. Version 2.3.3 is not vulnerable. Summary: The target repository (qs v2.3.3-tuxcare.1) is not vulnerable to CVE-2026-2391 because it predates the introduction of the comma option feature. The vulnerability requires the 'comma: true' configuration option, which does not exist in this version. [terminalized not_affected from patch_application_manual/not_vulnerable]"
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@2.3.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:120f587d-0adb-56e7-bcf4-9f1b2f9c91cb",
      "id": "CVE-2026-82417",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-82417 affects version 2.3.3 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@2.3.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7971e717-e31f-5450-8ce0-20b2eaf82a75",
      "id": "CVE-2026-8723",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8723 does not affect version 2.3.3 of qs. not_affected \u2014 Version 2.3.3-tuxcare.1 is not affected by CVE-2026-8723. The vulnerability requires `arrayFormat: 'comma'` and `encodeValuesOnly: true` configuration options which were introduced in version 6.11.1 (January 2023) via commit 4c4b23d. Version 2.3.3 (circa 2014) uses a fundamentally different stringify architecture that only supports `indices` and `delimiter` options. The vulnerable code path (`u..."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@2.3.3"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/qs@2.3.3"
    }
  ]
}