{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:905e6655-dac4-5015-b6b3-41a0fb3da886", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "astro", "purl": "pkg:npm/astro@3.6.5-tuxcare.13", "type": "library", "bom-ref": "pkg:npm/astro@3.6.5-tuxcare.13", "version": "3.6.5-tuxcare.13", "pedigree": { "ancestors": [ { "name": "astro", "purl": "pkg:npm/astro@3.6.5", "type": "library", "version": "3.6.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-47885", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:e36a5321-3851-5fb8-a31c-7c114b7919a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47885 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:53dd1b2e-3f69-5820-bb21-afad1f820a76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:987712e7-c8e4-5b62-9e33-f9b29916a7e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2025-54793", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:efce923b-1fe4-5ef5-9e7d-77cf798dde48", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-54793 does not affect version 3.6.5-tuxcare.13 of astro. not_affected \u2014 Astro 3.6.5 is not affected by CVE-2025-54793. The vulnerability exists in the automatic trailing slash redirection feature introduced in Astro 5.x, which does not exist in version 3.6.5. The patched code (INTERNAL_PREFIXES set and isInternalPath() function in packages/internal-helpers/src/path.ts) is absent from the target. While version 3.6.5 can receive HTTP requests with paths starting with...", "justification": "code_not_reachable" } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:5a2d5b42-7384-5f5c-84f5-2527950944e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55303 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2025-59837", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:75e65a94-64f9-5ba7-bc48-6391238d1c52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59837 affects version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:fb59f915-6298-5552-a274-99b6069b930a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2025-64525", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:93e70d35-cf3d-54d2-a424-15135ec4e6ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64525 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2025-64745", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:5a6d16d9-7abd-5b80-a2f6-96ef326b9627", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-64745 does not affect version 3.6.5-tuxcare.13 of astro. not_affected \u2014 Astro version 3.6.5 is NOT affected by CVE-2025-64745. The vulnerable `trailingSlashMismatchTemplate` function does not exist in this version. The vulnerability was introduced in commit 536175528d on 2025-01-29 (via PR #12994), nearly 11 months after the 3.6.5 release on 2024-03-01. The commit is not an ancestor of HEAD. The existing error page functions in 4xx.ts properly escape user-controlle...", "justification": "code_not_present" } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:3032e350-af28-5c45-95eb-1196896f05ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:9c78de4e-4811-55af-bf05-a5e0e9762442", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:8ea62e49-e03b-51d1-a3d5-70a6a653a8e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:75b8ffb7-fbd3-5d45-97b4-d6d3c9e688ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:64fd184f-e0f5-57bf-a629-e5aac7d685b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2026-114127", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:dab84ed5-d3c8-5521-b5e2-60db410ce284", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114127 affects version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2026-114128", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:6db91324-5af4-512c-971a-a4ef9f91f23c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-114128 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:7b915a97-2788-5bc0-913c-c4ff96f2203b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33769 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:26d8983f-64f7-53c9-a65f-d65619dbd84e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:34223e4e-d17e-5ca4-ad5c-864f8e1778de", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45028 does not affect version 3.6.5-tuxcare.13 of astro. not_affected \u2014 Astro version 3.6.5 is NOT AFFECTED by CVE-2026-45028. The vulnerability concerns server islands encryption (AES-GCM ciphertext replay between props and slots), but server islands functionality does not exist in version 3.6.5. The feature was introduced in later versions (~May 2025, v5.x/6.x), and the vulnerability was fixed in v6.1.10 (April 2026). Exhaustive search across 327 source files con...", "justification": "code_not_present" } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:fe36e2d2-c9a3-5e24-ae9a-bad35976cbc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50146 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:e39d6b57-f348-5765-8cb3-1341c36f267b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:561415e4-7aed-52b3-a3f1-968a96a35583", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54299 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2026-59727", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:7345724f-1c6d-56bd-ad52-98d3fa02e948", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59727 affects version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:189e3665-f453-59c1-ad13-89102a72c815", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2026-59731", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:86bc8696-55ac-5c01-97e1-5d4d544acd5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59731 affects version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:4b6b2d93-a1a5-5ad6-854f-d22dfc2ae62c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-73422 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "CVE-2026-73423", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:516f1c07-2f83-5f2a-a127-87b264660256", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-73423 does not affect version 3.6.5-tuxcare.13 of astro. not_affected \u2014 Version 3.6.5 is not affected by CVE-2026-73423. The vulnerability requires the composable `astro/hono` pipeline feature (including `actions()`, `pages()`, and `middleware()` primitives), which was introduced in Astro 7.0.0 (July 2026), approximately 2.5 years after this version. The target uses the classic (non-composable) pipeline, which the CVE explicitly states is not affected. The vulnerab...", "justification": "code_not_present" } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:5c72a538-fe05-5ee1-9f57-68b80a3e9aa2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84376 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:398f5b08-6012-5c48-9ee3-ff8e0304a087", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 is fixed in version 3.6.5-tuxcare.13 of astro." } }, { "id": "GHSA-4g3v-8h47-v7g6", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ], "bom-ref": "urn:uuid:ce50d56e-7f1d-5863-b183-4b5af12e518b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 is fixed in version 3.6.5-tuxcare.13 of astro." } } ], "dependencies": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.13" } ] }