{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5a577bab-96f9-5cc3-a261-d098fff35e50", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@sveltejs/kit", "purl": "pkg:npm/%40sveltejs/kit@2.70.3", "type": "library", "bom-ref": "pkg:npm/%40sveltejs/kit@2.70.3", "version": "2.70.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-29003", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:f2e59016-4703-5635-93ef-b3f719a24c4e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-29003 does not affect version 2.70.3 of @sveltejs/kit. not_affected \u2014 CVE-2023-29003 affects SvelteKit's CSRF protection, which originally failed to block cross-origin requests with Content-Type: text/plain, allowing CSRF attacks via form submissions that bypass the protection. The target repository (SvelteKit v2.70.3) already contains the complete upstream fix committed on April 4, 2023 (commit bb2253d51). The fix extends is_form_content_type() to include 'text/...", "justification": "code_not_present" } }, { "id": "CVE-2023-29008", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:55aee638-0779-5e7e-8b68-dfd76300b3d2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-29008 does not affect version 2.70.3 of @sveltejs/kit. not_affected \u2014 CVE-2023-29008 describes a CSRF protection bypass in SvelteKit where uppercase characters in the Content-Type header (e.g., \"text/plaiN\") bypass the case-sensitive comparison. The target repository (SvelteKit 2.70.3) already contains the upstream fix that normalizes Content-Type to lowercase before comparison. This fix (commit ba436c6685e751d968a960fbda65f24cf7a82e9f, April 2023) was authored b...", "justification": "code_not_present" } }, { "id": "CVE-2024-23641", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:185b2bc6-e821-54d3-a211-1cc6bce0fd9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-23641 does not affect version 2.70.3 of @sveltejs/kit. not_affected \u2014 CVE-2024-23641 describes a Denial of Service vulnerability where sending GET or HEAD requests with a request body causes SvelteKit applications to crash with \"Request with GET/HEAD method cannot have body.\" The target repository @sveltejs/kit version 2.70.3 is NOT AFFECTED because the fix was already included in the upstream release. The vulnerable code pattern (passing request bodies to the Re...", "justification": "code_not_present" } }, { "id": "CVE-2024-53261", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:79966da0-0e0d-5598-8705-28ca366bb968", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-53261 does not affect version 2.70.3 of @sveltejs/kit. not_affected \u2014 The target @sveltejs/kit version 2.70.3 is not affected by CVE-2024-53261. The upstream vendor fix (commit d338d4635a from PR #13039) was already included in version 2.8.3, well before this target version. The fix properly implements HTML escaping via the escape_html() function in the not_found() handler, preventing XSS attacks by converting special characters (<, &, ") to HTML enti...", "justification": "code_not_present" } }, { "id": "CVE-2024-53262", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:ade8b204-8439-55ca-9ec5-0da97297c348", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-53262 does not affect version 2.70.3 of @sveltejs/kit. not_affected \u2014 The target repository is NOT vulnerable to CVE-2024-53262. The vulnerability (XSS via unescaped error messages in error.html template) has been fixed by upstream commit 134e36343 authored by Ben McCann. Both vulnerable locations now properly escape error messages using escape_html() before inserting them into HTML templates. This is an upstream fix that shipped in the upstream release - no TuxC...", "justification": "code_not_present" } }, { "id": "CVE-2025-32388", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:ee7cb7cb-6ec8-5f57-90d7-b24038221b2f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-32388 does not affect version 2.70.3 of @sveltejs/kit. not_affected \u2014 CVE-2025-32388 affects SvelteKit applications that iterate over event.url.searchParams in server load functions, causing XSS via unsanitized search parameter names embedded in server-rendered HTML. The target repository (SvelteKit v2.70.3 at SHA 3ec3833d9) is NOT AFFECTED because the upstream vendor fix (commit d3300c6a6 by rich.harris@vercel.com) is already present in this release. The vulnera...", "justification": "code_not_present" } }, { "id": "CVE-2025-67647", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:56108871-8f6b-5b2f-b1c1-feef7f0d1eef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-67647 affects version 2.70.3 of @sveltejs/kit." } }, { "id": "CVE-2026-114060", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:d3be2352-5b5c-5259-b440-95df994ba39d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114060 affects version 2.70.3 of @sveltejs/kit." } }, { "id": "CVE-2026-114061", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:fd0704b8-8627-56ab-8da3-ff398a59eb40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114061 affects version 2.70.3 of @sveltejs/kit." } }, { "id": "CVE-2026-114062", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:bda3e651-136f-5136-b10e-7451fd199582", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114062 affects version 2.70.3 of @sveltejs/kit." } }, { "id": "CVE-2026-114063", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:8f8baceb-8b46-52a7-bce3-9db733aaae79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114063 affects version 2.70.3 of @sveltejs/kit." } }, { "id": "CVE-2026-22803", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:897e5d91-b2cb-547a-834b-ff3d0185158e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22803 affects version 2.70.3 of @sveltejs/kit." } }, { "id": "CVE-2026-40073", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:010a71cb-3911-5df1-bb42-6ad4f4d349e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-40073 affects version 2.70.3 of @sveltejs/kit." } }, { "id": "CVE-2026-40074", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:af5c4661-c345-5c31-ba58-4517696c2077", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40074 does not affect version 2.70.3 of @sveltejs/kit. not_affected \u2014 The target repository (SvelteKit 2.70.3) is not affected by CVE-2026-40074. The vulnerability involves unhandled TypeError when redirect() receives a location parameter with invalid HTTP header characters (e.g., CR/LF), which could cause server DoS. The fix that prevents this vulnerability was already present in the upstream release that TuxCare onboarded. The fix validates redirect locations b...", "justification": "code_not_present" } }, { "id": "CVE-2026-66062", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:4ab707d8-c3fc-54e0-826f-2f8d4d032f55", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-66062 does not affect version 2.70.3 of @sveltejs/kit. not_affected \u2014 CVE-2026-66062 describes a CPU-exhaustion DoS vulnerability via crafted Accept headers in SvelteKit, patched in version 2.70.2. The target version 2.70.3 contains the upstream fix commit 82712fc02c (2026-07-29) which prevents quadratic backtracking in Accept header parsing by anchoring the regex pattern. The vulnerable code pattern is not present in the target; the fix shipped in the upstream r...", "justification": "code_not_present" } }, { "id": "GHSA-85pr-xr59-r75h", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:2cf717ec-ba15-5d55-9779-92aa8233a7e5", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-85pr-xr59-r75h is a false positive for @sveltejs/kit 2.70.3." } }, { "id": "GHSA-866w-xmhq-wj7x", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:8c4c5179-d6da-5c35-8e1f-82f25e1664b3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-866w-xmhq-wj7x does not affect version 2.70.3 of @sveltejs/kit. not_affected \u2014 Target version 2.70.3 is NOT affected by GHSA-866w-xmhq-wj7x (prototype pollution via file input path names). The vulnerability was fixed by upstream commit df32f6fe8 authored by Simon H, which replaced manual property deletion with a safe `set_nested_value` + `DELETE_KEY` mechanism that routes through `check_prototype_pollution` guards. This upstream fix shipped in the release that TuxCare onb...", "justification": "code_not_present" } }, { "id": "GHSA-88qp-p4qg-rqm6", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:5b2eebe4-5428-516d-aaad-916cad43a01e", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-88qp-p4qg-rqm6 does not affect version 2.70.3 of @sveltejs/kit. not_affected \u2014 Target version 2.70.3 is not affected by GHSA-88qp-p4qg-rqm6. The vulnerability was fixed in upstream version 2.52.2 via commit 3e607b314, which added validation for form file metadata in deserialize_binary_form() to prevent CPU exhaustion from malformed form data. The fix is present in the target's form-utils.js (lines 268-277) and was shipped in the upstream release. No TuxCare backport was n...", "justification": "code_not_present" } }, { "id": "GHSA-fpg4-jhqr-589c", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:a0967c91-be0a-5a91-bd55-1c4de0411a8b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-fpg4-jhqr-589c affects version 2.70.3 of @sveltejs/kit." } }, { "id": "GHSA-hgv7-v322-mmgr", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:a2486c0c-8737-5a71-8351-626b42138227", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-hgv7-v322-mmgr affects version 2.70.3 of @sveltejs/kit." } }, { "id": "GHSA-pvhg-7v4p-f5q9", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:bc79db6f-109a-5b51-97f4-bd4899eb01d2", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-pvhg-7v4p-f5q9 is a false positive for @sveltejs/kit 2.70.3." } }, { "id": "GHSA-vrhm-gvg7-fpcf", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:f78445d2-0617-5d01-80e8-187194dfc077", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-vrhm-gvg7-fpcf affects version 2.70.3 of @sveltejs/kit." } }, { "id": "GHSA-wqjv-9729-c5q2", "affects": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ], "bom-ref": "urn:uuid:3154a25c-7bae-56ca-82ad-d387a0ac4ec4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-wqjv-9729-c5q2 affects version 2.70.3 of @sveltejs/kit." } } ], "dependencies": [ { "ref": "pkg:npm/%40sveltejs/kit@2.70.3" } ] }