{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:12a8933a-6a8b-591d-bc54-e32b1f95ad6d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@nuxt/rspack-builder",
      "purl": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7",
      "type": "library",
      "bom-ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7",
      "version": "4.0.3-tuxcare.7",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-25852",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:444cb5d1-3049-5c07-848f-d8c3650f437b",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/rspack-builder 4.0.3-tuxcare.7. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match."
      }
    },
    {
      "id": "CVE-2025-59414",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:28357181-5a01-5629-95d1-a60fbfb54dc1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-25128",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:5e5dbb37-4e44-5bbf-b993-f3ac2c8374f7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-41305",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:63b29218-9a3b-57ff-90e0-fb508d4af69a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-42338",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e244e574-7546-533f-97a7-936eac275d68",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/rspack-builder 4.0.3-tuxcare.7. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match."
      }
    },
    {
      "id": "CVE-2026-44372",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:49e969a4-d7c9-52d3-9082-726a60ae8e1f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44372 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-45669",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9de74997-1db6-5613-b73a-4691768b83d9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-45670",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ec6e953a-e1d2-5370-bf49-88ccfb3946e0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-45736",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:77846006-55ee-52e3-8725-1c08c51efedf",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-45736 is a false positive for @nuxt/rspack-builder 4.0.3-tuxcare.7. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..."
      }
    },
    {
      "id": "CVE-2026-46342",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:4cce93dd-e8e4-52fb-b329-63dc6e2a1872",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-47200",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:969b21b3-0aeb-5300-bf21-9ddcac5151a0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47200 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-49993",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:67163d60-18bb-57f0-891f-e20b32069ff0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-53721",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:491e3ebf-8393-5279-a117-a62aa7d5b2af",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-53722",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:6ae273c4-0544-5412-a2fb-da2e976e7563",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-56301",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:f50cc917-0861-5d00-b03b-331e49fd515b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-56301 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-56317",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:c8b917ef-ba5b-550c-a0fd-69aaaa0195e4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-56317 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-56326",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b74760b6-80cd-5775-b33f-2527b3e29531",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-71314",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:508668a1-d67d-5320-ad4e-fda5413dd7af",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71314 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-71316",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:32f0604d-f065-5bcc-a81c-8ba27ba785d1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.7 of @nuxt/rspack-builder. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3.",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-71318",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:8d7c3630-e1a4-550a-b9ce-301e091b7eea",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71318 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-71320",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:97e091e9-d702-5b83-9b79-991700a42671",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71320 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-71321",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:6926e0b3-9e8b-5989-a724-80e1d7c00565",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71321 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "GHSA-534h-c3cw-v3h9",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0515e2ba-037d-5e27-80b3-8e46bef3cacf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "GHSA-c9cv-mq2m-ppp3",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:139b641d-81f4-5d3b-9bdc-513760f0b0db",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "GHSA-m3q2-p4fw-w38m",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b52bd823-31bc-54d1-8985-87560383620f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "GHSA-rq7w-g337-39qq",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:512ae8f7-ac78-5ba6-a191-3803737714fb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.7 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "GHSA-xppm-jmw6-fhmf",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:36cc350f-f14e-5817-aa3c-71491b846909",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/rspack-builder 4.0.3-tuxcare.7."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.7"
    }
  ]
}