{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e8e3aac6-aae7-595a-9a2b-3150c15a0c66",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@ai-sdk/provider-utils",
      "purl": "pkg:npm/%40ai-sdk/provider-utils@5.0.57",
      "type": "library",
      "bom-ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.57",
      "version": "5.0.57",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-8769",
      "affects": [
        {
          "ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.57"
        }
      ],
      "bom-ref": "urn:uuid:2af55f0b-721c-5e16-af0a-340a501762ee",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8769 does not affect version 5.0.57 of @ai-sdk/provider-utils. not_affected \u2014 CVE-2026-8769 describes uncontrolled resource consumption in @ai-sdk/provider-utils where createJsonResponseHandler, createJsonErrorResponseHandler, and createStatusCodeErrorResponseHandler read response bodies without size limits. The target version 5.0.57 is NOT vulnerable. The vulnerable code pattern (unbounded response.text() calls) has been replaced with readResponseWithSizeLimit(), which ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.57"
    }
  ]
}