{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:743562da-552a-59c6-a227-165146622665", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@nuxt/webpack-builder", "purl": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7", "version": "4.0.3-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25852", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:64c397c1-3aaa-5b68-977f-beb76804a12c", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/webpack-builder 4.0.3-tuxcare.7. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:db6c1d0e-b47b-5bf5-a29f-6e5a00f8160a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-25128", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:30921229-4231-573c-b5db-550d4ba3855b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-41305", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:f476e8c2-2d28-5d9d-b050-54e1298eedf3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-42338", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:ea91a178-fc25-5691-972d-d33034f765b9", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/webpack-builder 4.0.3-tuxcare.7. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match." } }, { "id": "CVE-2026-44372", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:cfdc5475-910c-5087-8c5b-a0cea80cd262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44372 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:11c96f6c-f2cd-51ef-96fc-66e6bf0be33c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-45670", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:32891be2-9507-5188-9dbe-9e587c52dbbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-45736", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:4e1bc8ee-6d17-505b-83dd-0f54cfb9794f", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-45736 is a false positive for @nuxt/webpack-builder 4.0.3-tuxcare.7. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:a5f5bb38-6a05-53bb-99ba-694dd6ab1e25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:fd521d6c-c193-51cf-9a05-b939d7860e7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47200 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-49993", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:ad9852d4-d626-5823-b263-090f52b04579", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:ae43c0bb-e6e8-5bd3-bd84-d8f337d21536", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:27e21572-83da-57cf-8f9b-c79f9913b5c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-56301", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:c979bf18-7c03-5c8e-ba9f-643c33dc1bf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56301 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:94190ec4-e932-5290-b1e9-b42e6e4a29e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:3cb091cd-7afd-5341-ad5d-d6090f586b1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:9460dd24-1db7-5ea0-9fde-9abf8ad6bd12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71314 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:b3f1cb89-5420-5991-acca-947a6a050065", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.7 of @nuxt/webpack-builder. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:50050dc0-1811-590c-bc92-b168cc60145b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71318 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:ec338301-2b88-5734-bb34-865127dc8915", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71320 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:cecf42fb-f924-5c5f-8b3b-63fd49d457f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71321 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "GHSA-534h-c3cw-v3h9", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:4944d2cf-5f09-5d53-8739-6285a49c916c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:cf8e31a1-6a87-5bc6-9a53-17c5ba5eebd3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:9d60a61d-bba6-5ae2-9f91-40c158dc07e6", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "GHSA-rq7w-g337-39qq", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:ec13106d-9f7a-583d-8336-09e711e3da79", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.7 of @nuxt/webpack-builder." } }, { "id": "GHSA-xppm-jmw6-fhmf", "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:71c9e0ff-5add-5cb8-a16e-92856781bd27", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/webpack-builder 4.0.3-tuxcare.7." } } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.7" } ] }