{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8eac1eb2-3085-541c-865d-c9bd7dac1f9f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@nuxt/schema", "purl": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7", "version": "4.0.3-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25852", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:1ec6ca84-f2f4-5a97-a448-b3e31e33e319", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/schema 4.0.3-tuxcare.7. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:d11d460c-5fa4-530c-87bf-28d1f363cd62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-25128", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:d9612a0e-45db-5f53-8b0c-78bfb1a450c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-41305", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:839be583-2687-54a2-a14d-14aa9f5f3397", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-42338", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:a6f55c40-51ec-583f-90e9-d9ead9c44014", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/schema 4.0.3-tuxcare.7. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match." } }, { "id": "CVE-2026-44372", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:469b730a-edc7-564a-89e6-b2687a16079e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44372 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:7f5fc719-b3ba-59d6-93b3-abfdda72aee4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-45670", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:52013634-8d4c-5a09-ab30-ac603fffa149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-45736", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:4061c0d4-2822-5280-ab55-44bc29e6e3df", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-45736 is a false positive for @nuxt/schema 4.0.3-tuxcare.7. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:a7baa960-a486-58df-a510-048d6ea69e77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:9fe27e2a-cd39-5846-838b-32c38c4b31a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47200 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-49993", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:c37f3d82-9b20-5816-b78a-d61af8d4fedb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:961eb71e-cdc8-591a-89c5-d7457795f566", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:5b960883-07c0-55ec-9780-606cdccb0f5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-56301", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:b0cdd07a-ef6b-52e7-bf6c-a1086b7ccb8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56301 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:7688c7af-e8d7-5102-a0dc-51fda166e1da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:dadb18d1-37bc-55a8-bcf9-133bd64d7de9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:6fbe227f-394d-53d2-b5c1-d40cf8d747ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71314 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:8ad64411-dd5d-5e73-8d6f-afd2cdf81adb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.7 of @nuxt/schema. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:f3388050-d7b1-51fc-907f-f187a39a4d62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71318 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:d6a6da12-4163-5c2b-a3dd-fbf464b085b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71320 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:fa0ec5fb-3227-5a57-8145-7cc6a5ebb1a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71321 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "GHSA-534h-c3cw-v3h9", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:e20e1e2b-e80f-53ca-8a56-99784f35c0d1", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:098299e9-5b99-5657-a6b2-27a6550e7f0f", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:846833af-e037-5fe4-9a40-50eb20810c0d", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "GHSA-rq7w-g337-39qq", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:a6bd7d96-e879-51f7-8438-a6d400999e5a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.7 of @nuxt/schema." } }, { "id": "GHSA-xppm-jmw6-fhmf", "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:491a40ea-09a1-54fb-bdba-b0868efc6fed", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/schema 4.0.3-tuxcare.7." } } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.7" } ] }