{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2fc74558-8376-5229-9ba3-c42f1b8d4dab",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@grpc/grpc-js",
      "purl": "pkg:npm/%40grpc/grpc-js@1.14.6",
      "type": "library",
      "bom-ref": "pkg:npm/%40grpc/grpc-js@1.14.6",
      "version": "1.14.6",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-7768",
      "affects": [
        {
          "ref": "pkg:npm/%40grpc/grpc-js@1.14.6"
        }
      ],
      "bom-ref": "urn:uuid:c94f7373-43a4-5e3f-b7fb-fc6959f066d1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-7768 affects version 1.14.6 of @grpc/grpc-js."
      }
    },
    {
      "id": "CVE-2024-37168",
      "affects": [
        {
          "ref": "pkg:npm/%40grpc/grpc-js@1.14.6"
        }
      ],
      "bom-ref": "urn:uuid:92ae88a8-5929-5ce2-992c-7ffce9df181b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-37168 does not affect version 1.14.6 of @grpc/grpc-js. not_affected \u2014 CVE-2024-37168 is not present in @grpc/grpc-js version 1.14.6. The vulnerability involves two memory exhaustion paths: (1) buffering oversized wire messages entirely before checking size limits, and (2) decompressing messages without incremental size checking, allowing decompressed size to exceed grpc.max_receive_message_length. The upstream fix (commit 674f4e35 by mlumish@google.com, dated 202...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-101915",
      "affects": [
        {
          "ref": "pkg:npm/%40grpc/grpc-js@1.14.6"
        }
      ],
      "bom-ref": "urn:uuid:707de1e4-0187-5a1d-9ca5-6297ceb164a2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-101915 does not affect version 1.14.6 of @grpc/grpc-js. not_affected \u2014 The target repository @grpc/grpc-js version 1.14.6 is NOT AFFECTED by CVE-2026-101915. The vulnerability (error messages from crashed method handlers leaking sensitive data to clients) has been fixed by the upstream vendor prior to this release. The fix is present in commit 7c5c5181159c6ddd292805881ef2cdec29bb475f authored by mlumish@google.com, which predates all TuxCare commits on this branch...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-101916",
      "affects": [
        {
          "ref": "pkg:npm/%40grpc/grpc-js@1.14.6"
        }
      ],
      "bom-ref": "urn:uuid:621a104f-c575-54df-ab67-fd6a874ca0c3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101916 affects version 1.14.6 of @grpc/grpc-js."
      }
    },
    {
      "id": "CVE-2026-48068",
      "affects": [
        {
          "ref": "pkg:npm/%40grpc/grpc-js@1.14.6"
        }
      ],
      "bom-ref": "urn:uuid:29e3619d-5aec-5b3a-96a9-ef4b51728c3c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48068 affects version 1.14.6 of @grpc/grpc-js."
      }
    },
    {
      "id": "CVE-2026-48069",
      "affects": [
        {
          "ref": "pkg:npm/%40grpc/grpc-js@1.14.6"
        }
      ],
      "bom-ref": "urn:uuid:e98f4d6c-90ae-5a84-84a2-ced59a09eb04",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48069 affects version 1.14.6 of @grpc/grpc-js."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40grpc/grpc-js@1.14.6"
    }
  ]
}