{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f4b5b983-b368-523d-8a6b-af8fe0354c32",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@hono/node-server",
      "purl": "pkg:npm/%40hono/node-server@1.19.13",
      "type": "library",
      "bom-ref": "pkg:npm/%40hono/node-server@1.19.13",
      "version": "1.19.13",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-23340",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.13"
        }
      ],
      "bom-ref": "urn:uuid:6546bf93-d3b5-5e32-be40-406788a6be84",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23340 does not affect version 1.19.13 of @hono/node-server. not_affected \u2014 CVE-2024-23340 describes a path traversal vulnerability where the Request.url property does not resolve double dots (..) in URLs, allowing unresolved paths to reach file-serving logic. The target repository (@hono/node-server v1.19.13) is NOT AFFECTED because the upstream fix was already present when TuxCare onboarded this version. The fix (commit dd9b9a9, later refactored to 37bee15) was appli...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-32652",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.13"
        }
      ],
      "bom-ref": "urn:uuid:892d1e21-5f1c-5061-8239-f5b6309590fa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-32652 does not affect version 1.19.13 of @hono/node-server. not_affected \u2014 CVE-2024-32652 is NOT present in @hono/node-server version 1.19.13. The vulnerability (application crash/hang from malformed Host headers) was fixed by upstream commits d847e60 and 306d98f (April 2024), which added comprehensive host header validation and error handling. These fixes shipped in upstream versions 1.10.1/1.11.0 and are present in the current version 1.19.13. The fixes were authore...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-118663",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.13"
        }
      ],
      "bom-ref": "urn:uuid:406da91d-e008-5305-9ac3-ffd4d703279d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-118663 affects version 1.19.13 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-29087",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.13"
        }
      ],
      "bom-ref": "urn:uuid:1b4a4f16-2e29-569d-8529-a71f71f2e98d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-29087 affects version 1.19.13 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-39406",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.13"
        }
      ],
      "bom-ref": "urn:uuid:98ba3c7a-8339-5223-9f13-4fd70adf06cd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-39406 does not affect version 1.19.13 of @hono/node-server. not_affected \u2014 The target @hono/node-server v1.19.13 is not affected by CVE-2026-39406. The vulnerability (path traversal via repeated slashes bypassing middleware) was fixed in upstream commit 025c30f by adding regex detection for repeated slashes in serveStatic. This fix shipped in upstream release v1.19.13, which TuxCare then onboarded. The vulnerable pattern is not present in the target code.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-73565",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.13"
        }
      ],
      "bom-ref": "urn:uuid:9d16ba7e-5d2a-58e7-bf5e-1c1b28cf8d4c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-73565 does not affect version 1.19.13 of @hono/node-server. not_affected \u2014 Version 1.19.13 is not affected by CVE-2026-73565 because it does not contain any WebSocket support code. The vulnerable `upgradeWebSocket` function and the entire `src/websocket.ts` file containing the memory leak were introduced in version 2.0.0-rc.1 (commit 35c1dfc, dated 2026-04-06), which was added to the v2 development branch. The target version 1.19.13 (commit fd64e65, dated 2026-04-07) ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-frvp-7c67-39w9",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.13"
        }
      ],
      "bom-ref": "urn:uuid:c456aee9-8242-5663-8056-159dba4939e6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-frvp-7c67-39w9 affects version 1.19.13 of @hono/node-server."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40hono/node-server@1.19.13"
    }
  ]
}