{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7904e250-3c7c-5d23-9874-8b05e41c59ce",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@hono/node-server",
      "purl": "pkg:npm/%40hono/node-server@1.19.10",
      "type": "library",
      "bom-ref": "pkg:npm/%40hono/node-server@1.19.10",
      "version": "1.19.10",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-23340",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.10"
        }
      ],
      "bom-ref": "urn:uuid:b84b8e50-8cc4-5cb2-96d7-2b10975e4d6d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23340 does not affect version 1.19.10 of @hono/node-server. not_affected \u2014 CVE-2024-23340 affected @hono/node-server v1.3.0-v1.4.0 where the Request.url property did not resolve \"..\" sequences, enabling path traversal. The fix was introduced in upstream v1.4.1 (Jan 21, 2024, commit dd9b9a9) by Yusuke Wada. The target version 1.19.10 (released Mar 3, 2026) already includes this fix - the code uses Node.js URL constructor which automatically normalizes paths. Additional...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-32652",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.10"
        }
      ],
      "bom-ref": "urn:uuid:7fca58c7-6cf0-5842-80c8-a18c5bc2b086",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-32652 does not affect version 1.19.10 of @hono/node-server. not_affected \u2014 CVE-2024-32652 is NOT present in @hono/node-server v1.19.10-tuxcare.2. The vulnerability (application crash on malformed Host header) was fixed by upstream commit 306d98f authored by Taku Amano, which shipped in upstream v1.19.10 before TuxCare onboarded it. The fix includes: (1) RequestError class for structured error handling, (2) try-catch wrapper around newRequest() in listener.ts, (3) erro...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-118663",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.10"
        }
      ],
      "bom-ref": "urn:uuid:43747543-a955-571e-a8bf-86367a827f3a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-118663 affects version 1.19.10 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-29087",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.10"
        }
      ],
      "bom-ref": "urn:uuid:a342443c-6e00-5b4b-be0f-c8b870dde487",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-29087 affects version 1.19.10 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-39406",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.10"
        }
      ],
      "bom-ref": "urn:uuid:d2c51bad-1f3e-5a0a-b6be-9c2d87278423",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-39406 affects version 1.19.10 of @hono/node-server, and is fixed in 1.19.10-tuxcare.1."
      }
    },
    {
      "id": "CVE-2026-73565",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.10"
        }
      ],
      "bom-ref": "urn:uuid:96161fdb-7fbe-5516-b320-dfdf449106c5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-73565 does not affect version 1.19.10 of @hono/node-server. not_affected \u2014 The target repository version 1.19.10 is not affected by CVE-2026-73565. The vulnerability exists in the WebSocket upgrade handling code (src/websocket.ts), which was introduced in version 2.x of @hono/node-server. Version 1.19.10 predates this feature entirely - it contains no WebSocket support, no upgradeWebSocket function, no ws dependency, and no upgrade event handling. The vulnerable code ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-frvp-7c67-39w9",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.10"
        }
      ],
      "bom-ref": "urn:uuid:56d832bd-a514-5263-85a6-cb5f0d008fdb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-frvp-7c67-39w9 affects version 1.19.10 of @hono/node-server, and is fixed in 1.19.10-tuxcare.2."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40hono/node-server@1.19.10"
    }
  ]
}