{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:cadaf296-66d2-5310-8a50-2d7f5d497ca8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "fast-uri",
      "purl": "pkg:npm/fast-uri@2.4.5",
      "type": "library",
      "bom-ref": "pkg:npm/fast-uri@2.4.5",
      "version": "2.4.5",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-16221",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@2.4.5"
        }
      ],
      "bom-ref": "urn:uuid:d777f5ba-5176-5cbb-a23f-6cda807351ba",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-16221 does not affect version 2.4.5 of fast-uri. The target fast-uri v2.4.5 is NOT AFFECTED by CVE-2026-16221. The vulnerability pattern (lack of literal backslash validation in URI authority) is absent because an upstream vendor fix (commit 9438266 by Fastify maintainer Matteo Collina) has already removed it. The target contains the complete fix: AUTHORITY_PREFIX regex (line 243), backslash rejection logic (lines 357-361), enhanced authority introducer checks (lines 363-383), and comprehensive test coverage. The fix was authored by the upstream vendor (hello@matteocollina.com), not TuxCare, and is already shipped in version 2.4.5.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-6321",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@2.4.5"
        }
      ],
      "bom-ref": "urn:uuid:0bcffee6-58ab-5f01-acc2-846e672b90f0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-6321 affects version 2.4.5 of fast-uri."
      }
    },
    {
      "id": "CVE-2026-6322",
      "affects": [
        {
          "ref": "pkg:npm/fast-uri@2.4.5"
        }
      ],
      "bom-ref": "urn:uuid:da79b08f-0908-5eed-abaa-c8ea150b0718",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-6322 affects version 2.4.5 of fast-uri."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/fast-uri@2.4.5"
    }
  ]
}