{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:16b3b246-53cc-59a2-b914-5ac72af27f04",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "js-yaml",
      "purl": "pkg:npm/js-yaml@3.15.2",
      "type": "library",
      "bom-ref": "pkg:npm/js-yaml@3.15.2",
      "version": "3.15.2",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-53550",
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.15.2"
        }
      ],
      "bom-ref": "urn:uuid:c5cfa279-feca-5327-84d1-285c6d4994c2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53550 affects version 3.15.2 of js-yaml."
      }
    },
    {
      "id": "CVE-2026-59868",
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.15.2"
        }
      ],
      "bom-ref": "urn:uuid:f87b3954-0541-5dd5-8906-d6c900373046",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59868 does not affect version 3.15.2 of js-yaml. not_affected \u2014 The target (js-yaml 3.15.2) already contains the fix for CVE-2026-59868. The upstream vendor (Vitaly Puzrin) backported the maxTotalMergeKeys limit mechanism from v5, which prevents the quadratic CPU time attack by counting and capping merge key operations at 10,000 per parse call. The defense is operational and blocks the attack pattern described in the CVE.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-59870",
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.15.2"
        }
      ],
      "bom-ref": "urn:uuid:edf02739-d730-5b25-889f-08725e2fbf81",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59870 does not affect version 3.15.2 of js-yaml. not_affected \u2014 The target js-yaml v3.15.2 is NOT AFFECTED by CVE-2026-59870. While the CVE claims only v5.x (with YAML11_SCHEMA) is affected, the target v3.15.2 does have `!!omap` support in DEFAULT_SAFE_SCHEMA. The vulnerable O(n\u00b2) array-based duplicate key detection pattern existed in earlier v3.x versions but was eliminated by upstream maintainer Vitaly Puzrin in commit 22a8071 (v3.15.1, released 2026-07-3...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-73643",
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.15.2"
        }
      ],
      "bom-ref": "urn:uuid:c4210820-38b4-56db-8c2f-6974040dfe6d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-73643 does not affect version 3.15.2 of js-yaml. Target js-yaml v3.15.2 is NOT AFFECTED by CVE-2026-73643. The vulnerability requires an event-based parser with state-snapshotting that rewinds and re-parses flow sequence pair keys, causing O(2^n) complexity. This architecture was introduced in js-yaml v5.0.0. The target v3.15.2 uses a fundamentally different direct-composition parser that parses each entry exactly once, achieving O(n) complexity for the same input. The vulnerable code pattern (restoreState + double parseNode) does not exist in v3's architecture.",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/js-yaml@3.15.2"
    }
  ]
}