{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c9ed158c-ff74-51a0-97eb-d62cbb0944b8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "astro", "purl": "pkg:npm/astro@5.18.1-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/astro@5.18.1-tuxcare.10", "version": "5.18.1-tuxcare.10", "pedigree": { "ancestors": [ { "name": "astro", "purl": "pkg:npm/astro@5.18.1", "type": "library", "version": "5.18.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-47885", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:1924732c-a930-5a50-a585-63ab194c6c20", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-47885 does not affect version 5.18.1-tuxcare.10 of astro. not_affected \u2014 Target is not affected by CVE-2024-47885. The vulnerable pattern (use of DOM-clobberable `document.scripts`) is not present in the target code. The fix (replacing `document.scripts` with `document.getElementsByTagName('script')`) was already applied by the upstream vendor (Matthew Phillips, commit a4ffbfaa5c, October 2024) and shipped in the upstream release that TuxCare onboarded. The target u...", "justification": "code_not_present" } }, { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:30f56194-ee53-551d-95ef-02f4fb138230", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-56140 does not affect version 5.18.1-tuxcare.10 of astro. not_affected \u2014 The target Astro repository (v5.18.1-tuxcare.9) is NOT AFFECTED by CVE-2024-56140. The vulnerability involved two CSRF bypass patterns: (1) requests with Content-Type headers containing semicolon parameters (e.g., \"application/x-www-form-urlencoded; abc\") bypassed checks due to exact string matching, and (2) requests without Content-Type headers entirely bypassed CSRF validation. Both vulnerabl...", "justification": "code_not_present" } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:900276af-4d12-5fae-8104-47999291d600", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56159 affects version 5.18.1-tuxcare.10 of astro." } }, { "id": "CVE-2025-54793", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:6c5a206a-a896-5a83-9f6e-e2ade715c4d7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-54793 does not affect version 5.18.1-tuxcare.10 of astro. not_affected \u2014 The target Astro repository (version 5.18.1-tuxcare.9) is NOT affected by CVE-2025-54793. The vulnerability involves an open redirect in trailing slash redirection logic when paths start with `//`, which browsers interpret as protocol-relative URLs. The upstream vendor fix (commit 0567fb7b50c0c452be387dd7c7264b96bedab48f by Matt Kane) added `'//'` to the `INTERNAL_PREFIXES` set in `packages/int...", "justification": "code_not_present" } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:ff0494b6-63b9-520e-b36e-522f619255c2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55303 does not affect version 5.18.1-tuxcare.10 of astro. not_affected \u2014 The target repository (astro@5.18.1-tuxcare.5) is NOT affected by CVE-2025-55303. The vulnerability (protocol-relative URL bypass of domain restrictions) has been fixed by upstream commit 4d16de7f95, which is included in the base astro@5.18.1 release. The fix modifies the isRemotePath() function to detect URLs starting with '//' as remote paths, subjecting them to domain authorization checks. W..." } }, { "id": "CVE-2025-59837", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:ae1ca9bc-fe1f-5a49-9340-418c84eba575", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59837 does not affect version 5.18.1-tuxcare.10 of astro. not_affected \u2014 CVE-2025-59837 describes a backslash bypass of the CVE-2025-58179 SSRF fix. The target repository contains a comprehensive fix in the isRemotePath function (packages/internal-helpers/src/path.ts, lines 154-156) that explicitly checks for and blocks backslash-based URLs like \\\\host.com. When a backslash is detected at the start of a URL, the function returns true (treats it as remote), which tri...", "justification": "code_not_present" } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:e314a733-883e-5a38-85ca-22eb13cd6165", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-61925 does not affect version 5.18.1-tuxcare.10 of astro. not_affected \u2014 CVE-2025-61925 does NOT affect this target. The vulnerability (unvalidated X-Forwarded-Host header reflection) is not present because the upstream fix was already included in the release that TuxCare onboarded. The target contains comprehensive validation logic that: (1) validates X-Forwarded-Host against security.allowedDomains patterns, (2) rejects hostnames with path separators to prevent in...", "justification": "code_not_present" } }, { "id": "CVE-2025-64525", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:c1a3121c-21e7-59d7-a1ee-ff2f8e95c98e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-64525 does not affect version 5.18.1-tuxcare.10 of astro. not_affected \u2014 The target repository (Astro 5.18.1-tuxcare.9) already contains the upstream security fix (commit dafbb1ba29) that validates and sanitizes X-Forwarded-Proto, X-Forwarded-Host, and X-Forwarded-Port headers before using them in URL construction. This fix prevents attackers from injecting malicious values in these headers to manipulate URLs for middleware bypass, cache poisoning, SSRF, or XSS atta...", "justification": "code_not_present" } }, { "id": "CVE-2025-64745", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:ccc0725b-c44f-526e-bc29-499463372f15", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-64745 does not affect version 5.18.1-tuxcare.10 of astro. not_affected \u2014 The target repository (Astro 5.18.1-tuxcare.9) is not affected by CVE-2025-64745 (Reflected XSS in development server error pages). The vulnerability pattern is not present because the fix was already applied in upstream commit 790d9425f3 (authored by Chris Swithinbank), which shipped in the upstream release before TuxCare's onboarding. The vulnerable code that lacked HTML escaping on the `corr...", "justification": "code_not_present" } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:aa837c3a-5b9b-58ff-9e69-e709d8e112da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-64757 does not affect version 5.18.1-tuxcare.10 of astro. not_affected \u2014 The target repository (Astro 5.18.1-tuxcare.9) is NOT AFFECTED by CVE-2025-64757. The vulnerability (arbitrary local file read via path traversal in the development image endpoint) has been fixed by upstream commit b8ca69b971 which was already present in the upstream release when TuxCare onboarded version 5.18.1. The fix introduces isParentDirectory() validation in production endpoint (node.ts)...", "justification": "code_not_present" } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:441b0b0f-a6c6-5aa6-a355-bbe65ff856a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-64764 affects version 5.18.1-tuxcare.10 of astro." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:c85267f9-2724-5afd-ad85-632207f8faab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-64765 does not affect version 5.18.1-tuxcare.10 of astro. not_affected \u2014 The target repository is NOT affected by CVE-2025-64765. The vulnerability pattern (path normalization mismatch between routing and middleware) is not present because the upstream vendor (Astro/withastro) already shipped the fix in commit e0f277d924 (\"fix: prevent authentication bypass via double URL encoding in middleware #14929\"), which was included in the upstream release that TuxCare onboar...", "justification": "code_not_present" } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:2dcba32b-cbdb-5c60-83e6-50d5df34937c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-65019 does not affect version 5.18.1-tuxcare.10 of astro. not_affected \u2014 Target version 5.18.1-tuxcare.9 is NOT AFFECTED by CVE-2025-65019. The vulnerable pattern (unconditional acceptance of data: URLs in image processing) is not present in the target codebase. The upstream vendor fix (commit 9e9c528191b6f5e06db9daf6ad26b8f68016e533 by Erika/Princesseuh on 2025-11-17) was already included in the Astro release that TuxCare onboarded (first TuxCare commit c7b74c333ce...", "justification": "code_not_present" } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:8d0d59f8-7078-5b29-8fea-f36cd3bfabbd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-66202 does not affect version 5.18.1-tuxcare.10 of astro. not_affected \u2014 The target repository (Astro 5.18.1-tuxcare.9) is not affected by CVE-2025-66202. The upstream Astro 5.18.1 release already included the complete fix for the double URL encoding authentication bypass vulnerability. The fix was authored by Matthew Phillips (matthew@skypack.dev) in commit e0f277d9248d2fefbd0234b53f9dea8c9b750adb and shipped in the upstream release that TuxCare onboarded. The defe...", "justification": "code_not_present" } }, { "id": "CVE-2026-114127", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:3bc79226-d94f-5535-921e-9c10249074a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114127 affects version 5.18.1-tuxcare.10 of astro." } }, { "id": "CVE-2026-114128", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:c509199e-8f18-57aa-b153-8cafc63de1ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-114128 is fixed in version 5.18.1-tuxcare.10 of astro." } }, { "id": "CVE-2026-126361", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:d8107c5f-a877-5461-8c41-b247ebb0337c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-126361 affects version 5.18.1-tuxcare.10 of astro." } }, { "id": "CVE-2026-126364", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:1619bede-7966-50f7-94b4-0156606cd2f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-126364 affects version 5.18.1-tuxcare.10 of astro." } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:46b5ac9c-fec0-59bb-a9c5-9c418daace64", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33769 does not affect version 5.18.1-tuxcare.10 of astro. not_affected \u2014 The target is NOT AFFECTED. The vulnerable unanchored path matching code pattern is not present in the target. The fix was already included in the upstream Astro release (v5.18.1) that TuxCare onboarded, authored by upstream maintainer Erika. The target code at packages/internal-helpers/src/remote.ts lines 93-102 contains the complete fix: (1) line 95 adds startsWith() check to anchor prefix va...", "justification": "code_not_present" } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:5b73029b-4081-582e-aecf-83be69077785", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 5.18.1-tuxcare.10 of astro." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:ab5d4ed3-547b-5084-a684-8fede83b5d5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45028 is fixed in version 5.18.1-tuxcare.10 of astro." } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:f9966bfe-1e65-5789-9c98-f919c5c093f9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50146 does not affect version 5.18.1-tuxcare.10 of astro. already_fixed \u2014 The target repository (astro v5.18.1-tuxcare.3) already contains the vendor's slot name XSS fix. The escapeHTML() function is applied to slot names at both injection points (lines 348 and 362 in component.ts) before interpolating into HTML attributes, preventing attribute context breakout attacks. The fix was backported by TuxCare's automation service on May 18, 2026 via commit b30fca309f.", "justification": "code_not_present" } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:fd86ad73-40fe-5550-ac64-2010a4234c4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 5.18.1-tuxcare.10 of astro." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:ede6df84-94de-564b-8fad-3969ddab05fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54299 is fixed in version 5.18.1-tuxcare.10 of astro." } }, { "id": "CVE-2026-59727", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:8a4dafa7-61a1-5b85-bcb8-42931e1df26b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59727 is fixed in version 5.18.1-tuxcare.10 of astro." } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:8b321930-56a6-59b8-a4b8-76684fdb502d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 5.18.1-tuxcare.10 of astro." } }, { "id": "CVE-2026-59731", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:3c10031b-68a4-52cc-818b-b67e3ec4f9b3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59731 does not affect version 5.18.1-tuxcare.10 of astro. not_affected \u2014 Astro 5.18.1-tuxcare.9 is NOT AFFECTED by CVE-2026-59731. The vulnerable iterative URL decoder pattern that creates authorization bypass via canonicalization mismatch does not exist in this version. Target uses validateAndDecodePathname() which performs single decoding and REJECTS multi-level encoding entirely, preventing the attack chain. The vulnerable code (PR #16967, commit 3719765263) intr...", "justification": "code_not_present" } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:c8697079-a1d5-53d2-a5f0-febb6752bb53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-73422 is fixed in version 5.18.1-tuxcare.10 of astro." } }, { "id": "CVE-2026-73423", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:87c39878-66dd-5f5e-9af6-d44556c643fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-73423 does not affect version 5.18.1-tuxcare.10 of astro. not_affected \u2014 The target (Astro 5.18.1) does not contain the vulnerable composable astro/hono pipeline described in CVE-2026-73423. This architectural pattern was introduced in Astro 7.0.0+. In version 5.18.1, all routes including actions flow through a unified pipeline with the origin check middleware ALWAYS applied at the beginning of the middleware chain, providing mandatory CSRF protection with no bypass...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:9b510e23-d1f3-5a5f-8bd5-fef2648b2acb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84376 is fixed in version 5.18.1-tuxcare.10 of astro." } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:50b5d040-828b-59ce-8d14-0142fe77835d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 is fixed in version 5.18.1-tuxcare.10 of astro." } }, { "id": "GHSA-4g3v-8h47-v7g6", "affects": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ], "bom-ref": "urn:uuid:71bbc1ce-446f-5396-a129-0e258b9accdc", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 is fixed in version 5.18.1-tuxcare.10 of astro." } } ], "dependencies": [ { "ref": "pkg:npm/astro@5.18.1-tuxcare.10" } ] }