{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:77264392-a7d0-517b-a05a-e1f0818ec4ff", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@4.0.3-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/nuxt@4.0.3-tuxcare.7", "version": "4.0.3-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25852", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:8830476e-ddd6-5b59-a796-9b82b7a0e51d", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for nuxt 4.0.3-tuxcare.7. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:bc6dc581-221a-5750-afad-a1b0c4a78f9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-25128", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:bd9caca4-2ec7-5379-af4b-81de2a727af7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-41305", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:dbd11d0e-a213-50e1-a7e9-770670a8feae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-42338", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:b92a013e-43b1-5779-beb5-31ca58675d84", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 4.0.3-tuxcare.7. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match." } }, { "id": "CVE-2026-44372", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:f830d47f-f765-5619-b69f-43cec34196a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44372 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:482d5b59-8b15-55a5-a675-760839fbb073", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-45670", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:b99849af-4cdf-5bfb-86bd-e8224e3194ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-45736", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:e8f5ff1e-7b5d-521d-a36c-f7c2f9592015", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-45736 is a false positive for nuxt 4.0.3-tuxcare.7. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:c59061f5-f33f-5540-919a-844a551531b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:58463cb0-ea05-52b4-a0ad-fa424dab245c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47200 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-49993", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:a280aced-416d-588c-95b1-b15b740d6bf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:d0ac4735-c9f9-5368-8417-15f38965cc14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:8177d33d-03eb-5b9f-88c3-6d1b382b43c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-56301", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:14cab122-7900-5171-ac72-9fc2d90c9ed7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56301 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:51863ea2-d95b-5f16-92f9-ae4c01c5c9b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:b2fcb82c-229a-5e45-888f-fc250a2a08c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:5803e17d-8d8e-5b1a-8673-57cb5db1c589", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71314 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:9e9bdcb0-023b-559c-88da-daf2fb071364", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.7 of nuxt. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:66272119-5017-5548-a640-3f13b90389ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71318 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:acab3e7a-e159-5925-abec-906405167b08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71320 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:6ecc034c-b58a-5640-89d1-66213ae7f440", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71321 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "GHSA-534h-c3cw-v3h9", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:5c67ce5b-2769-580d-b59b-da4cdab6bd91", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:bc59e516-9668-5a08-b2c0-af0565362e1b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:76c96afd-2ee2-5936-a60c-4f5576831eaa", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "GHSA-rq7w-g337-39qq", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:e1ccff24-60ba-5ff0-a1ef-d2114a85ed43", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.7 of nuxt." } }, { "id": "GHSA-xppm-jmw6-fhmf", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:1e5ddd0f-37df-5e2d-b5ae-f672b94f1bb8", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for nuxt 4.0.3-tuxcare.7." } } ], "dependencies": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.7" } ] }