{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:35da37cc-ea4c-5713-a478-4c1f31bf538f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "astro", "purl": "pkg:npm/astro@1.9.2-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/astro@1.9.2-tuxcare.8", "version": "1.9.2-tuxcare.8", "pedigree": { "ancestors": [ { "name": "astro", "purl": "pkg:npm/astro@1.9.2", "type": "library", "version": "1.9.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-47885", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:ad775de6-ea6b-5ee6-ae46-508434ddff2a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-47885 does not affect version 1.9.2-tuxcare.8 of astro. not_affected \u2014 Astro v1.9.2-tuxcare.8 is NOT AFFECTED by CVE-2024-47885. The vulnerable ViewTransitions component and client-side router code do not exist in this version. The vulnerability affects the `document.scripts` usage in `packages/astro/src/transitions/router.ts`, but this entire file and feature were introduced much later in Astro 3.2.0 (September 2023), approximately 9 months after Astro 1.9.2 was ...", "justification": "code_not_present" } }, { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:cfeed2d9-2c4c-51ef-b0fa-229a094d8d26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 1.9.2-tuxcare.8 of astro." } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:6e2cff9e-c339-527f-87f3-3affb60867f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 1.9.2-tuxcare.8 of astro." } }, { "id": "CVE-2025-54793", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:f001e469-1a87-5ab2-912a-305b5d10879c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-54793 does not affect version 1.9.2-tuxcare.8 of astro. not_affected \u2014 Astro version 1.9.2 is not affected by CVE-2025-54793. The vulnerability exists in the automatic trailing slash redirection logic introduced in later versions (>=5.2.0). Version 1.9.2 does not have this feature - it lacks the INTERNAL_PREFIXES mechanism, the isInternalPath() function, and the trailingSlashMismatchTemplate() that would generate 301 redirects based on trailing slash configuration...", "justification": "code_not_present" } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:705d61ba-9839-53cc-87be-5ea7cca4438c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55303 is fixed in version 1.9.2-tuxcare.8 of astro." } }, { "id": "CVE-2025-59837", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:b00f40e4-38e5-5e0d-bf04-9b9014e6b8f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59837 affects version 1.9.2-tuxcare.8 of astro." } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:910ef466-1d62-52a5-8320-cb8051e73b22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 1.9.2-tuxcare.8 of astro." } }, { "id": "CVE-2025-64525", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:ec9b80cd-8ccf-5bdf-a1a6-c3907c18179b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-64525 does not affect version 1.9.2-tuxcare.8 of astro. not_affected \u2014 Astro version 1.9.2 is not affected by CVE-2025-64525. The vulnerability requires processing X-Forwarded-Proto, X-Forwarded-Port, and X-Forwarded-Host headers to construct URLs, but this version predates that feature. The code in packages/astro/src/core/app/node.ts (line 12) uses only `req.headers.host` directly in a simple URL template (`http://${req.headers.host}${req.url}`). No X-Forwarded-*...", "justification": "code_not_present" } }, { "id": "CVE-2025-64745", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:20acbf89-d1be-5a7f-b082-dfb6d87f1dfb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-64745 does not affect version 1.9.2-tuxcare.8 of astro. not_affected \u2014 Version 1.9.2 is not affected by CVE-2025-64745. The vulnerable trailingSlashMismatchTemplate function that contains the unescaped 'corrected' variable does not exist in this version. The vulnerability was introduced in commit 536175528d (PR #12994) which first appeared in astro@5.10.0 (January 2025), years after version 1.9.2. The commit is not an ancestor of HEAD. The pathname rendering that ...", "justification": "code_not_present" } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:1a3b3fc1-d08d-581a-9361-3758500272b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 1.9.2-tuxcare.8 of astro." } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:dab7ad49-7293-5e60-bcdb-b54bfec9f89d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 1.9.2-tuxcare.8 of astro." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:fc1f6f62-d1bb-5ab9-89a9-e0f2319a6eed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 1.9.2-tuxcare.8 of astro." } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:257aa7fd-35d9-5280-8291-916ed73f96c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 1.9.2-tuxcare.8 of astro." } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:71d31882-44ea-56d4-b2b6-373538344f8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 1.9.2-tuxcare.8 of astro." } }, { "id": "CVE-2026-114127", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:d610a0b7-fb12-5fca-8567-af9d6a6f8c85", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114127 does not affect version 1.9.2-tuxcare.8 of astro. not_affected \u2014 Target version 1.9.2-tuxcare.8 is not affected by CVE-2026-114127. The vulnerability affects Astro's View Transition CSS generator in versions 7.1.0-7.3.2, but the View Transitions feature was introduced in July 2023 (commit 6a12fcecb0) and is not present in version 1.9.2. The vulnerable file `packages/astro/src/runtime/server/transition.ts` and the vulnerable function `addAnimationProperty()` ...", "justification": "code_not_present" } }, { "id": "CVE-2026-114128", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:29038361-17eb-5183-baee-55c6aaf8b6d3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114128 does not affect version 1.9.2-tuxcare.8 of astro. not_affected \u2014 Version 1.9.2 is NOT affected by CVE-2026-114128. The vulnerable code (`prerenderElementChildren` function that marks script/style children as raw HTML) was introduced in version 2.1.1 (March 2023) and fixed in version 7.3.2 (September 2026). Version 1.9.2 predates the vulnerability introduction and properly escapes all string children through the `escapeHTML` function in `renderJSX`.", "justification": "code_not_present" } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:d2298f68-0b3e-5f9b-8681-a6a10fbd985b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33769 does not affect version 1.9.2-tuxcare.8 of astro. not_affected \u2014 Astro 1.9.2 is NOT AFFECTED by CVE-2026-33769. The vulnerable code does not exist in this version. The CVE concerns unanchored path matching in the matchPathname() function within the astro:assets feature's remotePatterns validation (packages/internal-helpers/src/remote.ts). This feature, including the /_image endpoint and remotePatterns configuration, was introduced in Astro 2.1. Version 1.9.2...", "justification": "code_not_present" } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:7d6f8525-6ae7-5248-8fdc-12b6e820a2ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 1.9.2-tuxcare.8 of astro." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:e09c7c72-f8d8-5efa-81bc-83fb877fceca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45028 does not affect version 1.9.2-tuxcare.8 of astro. not_affected \u2014 Astro version 1.9.2 is not affected by CVE-2026-45028. The vulnerability concerns server islands, a feature that encrypts component parameters (props, slots, componentExport) using AES-GCM without binding ciphertext to component/parameter context, allowing replay attacks. However, the server islands feature does not exist in version 1.9.2. This feature was introduced much later (PR #11305) in A...", "justification": "code_not_present" } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:70bc3aa8-61cc-5742-9d1b-bddce40829d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50146 is fixed in version 1.9.2-tuxcare.8 of astro." } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:22723495-7b1b-5fc2-86de-49efbaae7460", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 1.9.2-tuxcare.8 of astro." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:4c198335-e4f2-5a7f-8821-5978fe8a5e9a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54299 does not affect version 1.9.2-tuxcare.8 of astro. not_affected \u2014 Astro version 1.9.2 is not affected by CVE-2026-54299. The vulnerability requires the prerendered error page HTTP fetching feature, which was introduced in Astro 5.12.9+. Version 1.9.2 renders all error pages in-process using the component system, not via HTTP fetch, eliminating the SSRF attack vector.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-59727", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:8d40d115-6b90-575e-a317-e6d86565cd1e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59727 does not affect version 1.9.2-tuxcare.8 of astro. not_affected \u2014 Target version astro@1.9.2-tuxcare.8 is NOT AFFECTED by CVE-2026-59727. The vulnerability affects astro >= 3.10.0, < 7.0.4, where transition directives (transition:persist, transition:scope, transition:persist-props) on client-hydrated components are rendered without HTML-escaping, allowing reflected XSS. Version 1.9.2 predates the introduction of the transition directives feature entirely (int...", "justification": "code_not_present" } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:317dae64-cc83-509f-bf81-e6412a5d5bdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 1.9.2-tuxcare.8 of astro." } }, { "id": "CVE-2026-59731", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:3a93bce2-e6fc-585e-96b6-0ba7d0a96b78", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59731 does not affect version 1.9.2-tuxcare.8 of astro. not_affected \u2014 Astro 1.9.2 is NOT affected by CVE-2026-59731. The vulnerability requires two components working together: (1) middleware that performs pathname-based authorization checks, and (2) iterative URL decoding with a 10-iteration cap that creates canonicalization mismatch between middleware and router. Version 1.9.2 has NEITHER component: middleware was introduced later (commit 831b67cdb8, after 1.9....", "justification": "code_not_present" } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:c7d5d4fb-4092-5c4e-ab81-a03c8f69d41f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-73422 does not affect version 1.9.2-tuxcare.8 of astro. not_affected \u2014 Astro version 1.9.0 is not affected by CVE-2026-73422. The View Transitions feature\u2014which contains the vulnerable code path where animation property values are embedded in generated CSS without escaping\u2014does not exist in this version. View Transitions were introduced in Astro 2.9 (mid-2023), while version 1.9.0 is from late 2022. The vulnerable file `packages/astro/src/runtime/server/transition...", "justification": "code_not_present" } }, { "id": "CVE-2026-73423", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:1c450206-eef8-5b60-8701-f22c60f51e2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-73423 does not affect version 1.9.2-tuxcare.8 of astro. not_affected \u2014 CVE-2026-73423 targets a CSRF origin-check bypass in Astro's composable astro/hono pipeline (introduced in v7.0.0). The target version (1.9.2-tuxcare.8) predates this feature by ~6 major versions. The vulnerable architecture\u2014including ActionHandler, PagesHandler, actions(), pages(), middleware() primitives, and the composable pipeline system\u2014does not exist in v1.9.2. The CVE explicitly scopes t...", "justification": "code_not_present" } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:7e81c2d1-b41e-5390-8435-c955ad9f2e6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84376 is fixed in version 1.9.2-tuxcare.8 of astro." } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:5291b48c-0212-58d5-a060-b71dbc359f30", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 does not affect version 1.9.2-tuxcare.8 of astro. not_affected \u2014 Astro 1.9.2 is not affected by GHSA-26w7-cxv4-gfx2 (libheif RCE via malicious AVIF). The vulnerability exists in libheif, used by Sharp, but Sharp is an OPTIONAL peer dependency that must be explicitly installed and configured. The DEFAULT image service in Astro 1.9.2 is Squoosh (WebAssembly-based), which processes AVIF images without using libheif. The vulnerable code path only exists when use...", "justification": "requires_dependency" } }, { "id": "GHSA-4g3v-8h47-v7g6", "affects": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ], "bom-ref": "urn:uuid:d38eed47-b109-54b5-be30-a4a3c1398a64", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 does not affect version 1.9.2-tuxcare.8 of astro. not_affected \u2014 Astro version 1.9.2 does not contain View Transitions functionality. The vulnerable code path (packages/astro/src/runtime/server/transition.ts) does not exist because the View Transitions feature was introduced in a later version (around Astro 2.9+). The vulnerability requires View Transition animation properties to be processed and embedded in generated CSS, but this entire feature is absent f...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:npm/astro@1.9.2-tuxcare.8" } ] }