{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:22b9acbb-b8fa-51cf-af9c-1ce09e1c8a20", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "astro", "purl": "pkg:npm/astro@4.16.19-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/astro@4.16.19-tuxcare.4", "version": "4.16.19-tuxcare.4", "pedigree": { "ancestors": [ { "name": "astro", "purl": "pkg:npm/astro@4.16.19", "type": "library", "version": "4.16.19" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "AIKIDO-2025-10879", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:652b32ba-275b-512f-a6a1-1dffc835469a", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2025-10879 is fixed in version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2024-47885", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:ccbabcbd-4c3b-5701-8ec6-21955c8cd4ff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-47885 does not affect version 4.16.19-tuxcare.4 of astro. not_affected \u2014 CVE-2024-47885 (DOM Clobbering XSS in Astro's ViewTransitions router) is NOT present in this target. The vulnerability was fixed in upstream commit a4ffbfaa5c (Oct 11, 2024) by Matthew Phillips, which replaced vulnerable `document.scripts` usage with `document.getElementsByTagName('script')` at both affected locations in router.ts (lines 137 and 646). This fix was already present in the upstrea...", "justification": "code_not_present" } }, { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:c7c4c922-e38d-5c23-ada5-de8ac526bc7d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-56140 does not affect version 4.16.19-tuxcare.4 of astro. not_affected \u2014 CVE-2024-56140 affects Astro versions prior to 4.16.17. The target version is 4.16.19-tuxcare.9, which includes the upstream fix that was released in astro@4.16.17. The vulnerable CSRF bypass patterns (semicolon-parameterized Content-Type and missing Content-Type) are not present because the fix shipped in the upstream release before TuxCare onboarded this version. The middlewares.ts file conta...", "justification": "code_not_present" } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:db270b0e-9687-54e7-8790-5274850319e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56159 affects version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2025-54793", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:ccb25660-844b-5f3e-9025-721af69d0632", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-54793 does not affect version 4.16.19-tuxcare.4 of astro. not_affected \u2014 Astro 4.16.19 is not affected by CVE-2025-54793. The vulnerability exists in Astro's automatic trailing slash redirection feature, which was first introduced in Astro 5.10.0 (commit 536175528d, dated 2025-01-29). The target version 4.16.19 predates this feature entirely and contains no code that performs automatic trailing slash redirection in SSR mode. The vulnerable code path\u2014where paths star...", "justification": "code_not_reachable" } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:55b8f3a6-61e0-5856-99b9-76cd26d70bb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55303 is fixed in version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2025-59837", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:9c64e7d2-a3f9-553b-b6a0-902da3ab3bb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59837 affects version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:dc901b6f-c5ad-5491-a8c1-0d7bdc3f7794", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2025-64525", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:213c23f8-033e-5c4b-95ce-2e7bc42ce1aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64525 is fixed in version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2025-64745", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:4d339174-c836-56cb-b692-10953481d29b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-64745 does not affect version 4.16.19-tuxcare.4 of astro. not_affected \u2014 The target version 4.16.19-tuxcare.9 does not contain the vulnerable code. The XSS vulnerability in the `trailingSlashMismatchTemplate` function was introduced in commit 536175528d on 2025-01-29, affecting Astro versions 5.10.0 and later. This target version predates the introduction of the vulnerable function and is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:809c504b-400c-5841-a8bf-dbbf4f4374c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-64757 affects version 4.16.19-tuxcare.4 of astro, and is fixed in 4.16.19-tuxcare.9." } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:dedf30a3-c3f3-56ad-be32-f0e026b4a894", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:a4d100fb-0a41-58a7-9f30-6a134e6429db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:de32167f-95b5-5a1e-b67b-b0761433edb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:c82b51b9-2b17-5208-82dd-7138d7a9f6cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2026-114127", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:5b7273da-df6e-59f2-bc51-e3fced3a2e0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114127 affects version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2026-114128", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:85e0f371-732b-51dc-98c3-ff7af0214bed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114128 affects version 4.16.19-tuxcare.4 of astro, and is fixed in 4.16.19-tuxcare.10." } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:48ce6655-c4dc-5bb5-96c2-a4c246147201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33769 is fixed in version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:6448afff-3ff9-52f1-a179-532c52842676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:a8bd3c33-f8ee-5391-86a9-f9b19bdd0f87", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45028 does not affect version 4.16.19-tuxcare.4 of astro. not_affected \u2014 Astro version 4.16.19 is NOT affected by CVE-2026-45028. The vulnerability requires encrypted slots and componentExport features that were introduced in later versions (between 4.x and 6.x). The target uses an older server islands implementation that only encrypts props\u2014slots and componentExport are sent unencrypted. This makes the cross-parameter-type replay attack described in the CVE (replay...", "justification": "code_not_present" } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:afcd8814-f43a-5bcf-86d3-53b9669f52bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50146 is fixed in version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:5191bb6a-e7b4-5862-820f-3f312b1ba022", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:8ed27dbf-f208-58d3-8282-7ce5dd8e528e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54299 does not affect version 4.16.19-tuxcare.4 of astro. already_fixed \u2014 The target repository has already fixed this vulnerability via CVE-2026-25545 / AIKIDO-2025-10879 (May 7, 2026), which addresses the identical SSRF issue. The fix removes the prerendered error page fetching feature entirely, replacing it with direct SSR rendering. This is a more aggressive mitigation than the upstream's host validation approach.", "justification": "code_not_present" } }, { "id": "CVE-2026-59727", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:eb02dbeb-5a31-565a-9dbc-a79f1666d67d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59727 is fixed in version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:d704d378-e244-54b2-8d1e-122207fc2e62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2026-59731", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:928ea50c-19ed-500b-8e16-adcefafb5d5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59731 affects version 4.16.19-tuxcare.4 of astro." } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:4b60e42d-d7f2-55f1-866a-0930eb0401f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-73422 affects version 4.16.19-tuxcare.4 of astro, and is fixed in 4.16.19-tuxcare.5." } }, { "id": "CVE-2026-73423", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:790c8965-f0cf-5ffe-b30f-2bfcf586f1b0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-73423 does not affect version 4.16.19-tuxcare.4 of astro. not_affected \u2014 CVE-2026-73423 affects Astro >= 7.0.0 with the composable astro/hono pipeline, where middleware(), actions(), and pages() primitives can be mounted in different orders, allowing origin check bypass when actions() or pages() are mounted before middleware(). Version 4.16.19 uses the classic unified Pipeline architecture where all routes (pages, API endpoints, actions) are dispatched through a sin...", "justification": "code_not_present" } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:48a43015-916a-5374-b2bb-f90cb4013f55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84376 affects version 4.16.19-tuxcare.4 of astro, and is fixed in 4.16.19-tuxcare.6." } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:cdfa1664-c602-5763-9469-5b0287080ae8", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 affects version 4.16.19-tuxcare.4 of astro, and is fixed in 4.16.19-tuxcare.6." } }, { "id": "GHSA-4g3v-8h47-v7g6", "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ], "bom-ref": "urn:uuid:6d9647bb-8620-5850-ae6f-f578f074e048", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 is fixed in version 4.16.19-tuxcare.4 of astro." } } ], "dependencies": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.4" } ] }