{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1ffcfec0-d8ee-5510-aee0-2a46c51ea98c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "js-yaml",
      "purl": "pkg:npm/js-yaml@3.15.1",
      "type": "library",
      "bom-ref": "pkg:npm/js-yaml@3.15.1",
      "version": "3.15.1",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-53550",
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.15.1"
        }
      ],
      "bom-ref": "urn:uuid:7412ab4f-ec52-587c-b93d-f4113a3d9467",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-53550 does not affect version 3.15.1 of js-yaml. not_affected \u2014 Target js-yaml v3.15.1 is not affected by CVE-2026-53550. The vulnerable quadratic complexity pattern (repeated alias references in merge sequences causing O(K*M) operations) is structurally present in the code, but an upstream-authored fix (commit 24f13e7, June 2026) added the `maxTotalMergeKeys` defense that limits total merge operations to 10,000 by default. This caps CPU consumption to O(1)...",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2026-59868",
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.15.1"
        }
      ],
      "bom-ref": "urn:uuid:e597bd98-3343-5d2b-8e20-3b5fae3ed921",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59868 does not affect version 3.15.1 of js-yaml. not_affected \u2014 Target version js-yaml 3.15.1 is not affected by CVE-2026-59868. The upstream vendor (Vitaly Puzrin) backported the fix from v5 in commit 24f13e7, which added the maxTotalMergeKeys defense (default 10,000) that prevents quadratic CPU consumption during merge key processing. The vulnerable pattern is not present in the shipped version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-59870",
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.15.1"
        }
      ],
      "bom-ref": "urn:uuid:31e8c801-c166-58ae-b106-57a7572f57e1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59870 does not affect version 3.15.1 of js-yaml. not_affected \u2014 Target js-yaml v3.15.1 is NOT affected by CVE-2026-59870. The O(n\u00b2) quadratic complexity vulnerability in !!omap parsing was fixed by upstream commit 22a8071 (authored by Vitaly Puzrin) before the v3.15.1 release. The vulnerable pattern (array with indexOf for O(n) duplicate detection) was replaced with an object-based O(1) hasOwnProperty lookup. This is an upstream vendor fix, not a TuxCare ba...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-73643",
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.15.1"
        }
      ],
      "bom-ref": "urn:uuid:79e5fa49-4c19-57d2-a83e-88a84ea04ce0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-73643 does not affect version 3.15.1 of js-yaml. Target js-yaml v3.15.1 is not affected by CVE-2026-73643. The vulnerability affects versions 5.0.0-5.2.2 and was introduced during the v5.0.0 TypeScript rewrite with an event-based parser. Version 3.15.1 uses a fundamentally different JavaScript-based architecture that parses each flow sequence element exactly once without state rewinding or re-parsing. The attack chain (INPUT: nested flow pairs \u2192 restoreState \u2192 double-parse \u2192 exponential time \u2192 CPU exhaustion) is broken because the restoreState mechanism and double-parsing pattern do not exist in v3.15.1's codebase.",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "GHSA-pm4m-ph32-ghv5",
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.15.1"
        }
      ],
      "bom-ref": "urn:uuid:539374ab-007c-59a3-826d-d4cf0ffdb723",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-pm4m-ph32-ghv5 does not affect version 3.15.1 of js-yaml. Target version 3.15.1 uses the old JavaScript implementation that parses flow sequences linearly (O(n)). The exponential reparsing vulnerability (GHSA-pm4m-ph32-ghv5) was introduced in the TypeScript rewrite (June 2026, commit fa4f1f7) and does not exist in this JavaScript version. The target implements single-pass parsing without state restoration or key re-parsing. PoC testing confirms no exponential behavior: n=30 completes in 3ms (CVE states vulnerable versions take >2 minutes). The vulnerable code path is unreachable because the reparse mechanism is absent.",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/js-yaml@3.15.1"
    }
  ]
}