{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:64c3f811-a0fd-50b7-9909-e546f180e371", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@nuxt/vite-builder", "purl": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7", "version": "4.0.3-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25852", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:b3ba5e73-79ba-5573-b31d-dfcad6796157", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/vite-builder 4.0.3-tuxcare.7. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:48bf8846-0c4b-58ca-a426-696001d07ddc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-25128", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:13836eb2-1cc8-5cae-9406-5b2b9d1b7d99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-41305", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:01cfccf4-ac01-5a6a-bcb8-7581d66d6e4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-42338", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:c6069750-1883-5e11-96d5-97d63603217a", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/vite-builder 4.0.3-tuxcare.7. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match." } }, { "id": "CVE-2026-44372", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:f0fff5a7-a040-5052-8dad-de9306b6b827", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44372 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:17e7cd9b-bec5-5830-9ec9-3cf8c905b2ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-45670", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:9364dbdd-5d02-538f-964d-a9ce63cb2c48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-45736", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:c18d36df-8543-58db-9576-a6c4ad68952c", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-45736 is a false positive for @nuxt/vite-builder 4.0.3-tuxcare.7. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:7e58bbc4-09ab-5b5a-9ec4-d9d48d34682c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:d0758281-e2a4-52cf-8556-adbeb2c618dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47200 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-49993", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:b0a2d9ea-b419-54d7-ac1a-2c01ca089245", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:99980983-5e7f-5a86-9320-a484b77b5ff3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:3359d504-0e5e-5cb1-ab54-6c845c0c6b69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-56301", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:474caaa5-6256-5eda-8c57-291336b8d6c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56301 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:373098b8-c8a1-5b43-b1bf-a202d3b74a3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:d74945cd-8023-5662-bb38-d5d6b91ec69c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:49d07187-98b9-508a-aa58-87305dee25e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71314 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:a64b2bda-fccd-55dd-b99a-922c84664904", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.7 of @nuxt/vite-builder. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:635be756-547d-5dae-8f7e-5bd5e3999d51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71318 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:ecebc75e-ec84-5335-b5c0-ac1bcca40d90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71320 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:8c7477b9-951e-57a2-b1cf-8dcf534c7846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71321 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "GHSA-534h-c3cw-v3h9", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:a44bcda2-4dc5-5031-bb71-1262347988fb", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:e279e23a-eb5e-5fee-b237-8daef23f1111", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:74cb9700-1ce6-5bbb-b554-e4b0591304d7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "GHSA-rq7w-g337-39qq", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:a3248341-50d2-5750-8a1a-e65e74411f21", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.7 of @nuxt/vite-builder." } }, { "id": "GHSA-xppm-jmw6-fhmf", "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:3e6f5189-0e19-5817-8b5d-10dac02eae01", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/vite-builder 4.0.3-tuxcare.7." } } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.7" } ] }