{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6680d77b-f392-5a67-b65d-ff332ccc204e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@ai-sdk/provider-utils",
      "purl": "pkg:npm/%40ai-sdk/provider-utils@3.0.41",
      "type": "library",
      "bom-ref": "pkg:npm/%40ai-sdk/provider-utils@3.0.41",
      "version": "3.0.41",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-8769",
      "affects": [
        {
          "ref": "pkg:npm/%40ai-sdk/provider-utils@3.0.41"
        }
      ],
      "bom-ref": "urn:uuid:4a64ae16-5e2e-55a0-920c-ee43aa443d10",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8769 does not affect version 3.0.41 of @ai-sdk/provider-utils. not_affected \u2014 The target version 3.0.41 is not affected by CVE-2026-8769. The vulnerability (unbounded response body reads causing memory exhaustion) has been fixed by upstream commit b85c4fbc60, which modified all three vulnerable functions (createJsonResponseHandler, createJsonErrorResponseHandler, createStatusCodeErrorResponseHandler) to use readResponseWithSizeLimit() instead of unbounded response.text()...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40ai-sdk/provider-utils@3.0.41"
    }
  ]
}