{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8d56349c-3607-54db-afb9-b40b9d347da9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@next/font", "purl": "pkg:npm/%40next/font@13.5.11-tuxcare.19", "type": "library", "bom-ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19", "version": "13.5.11-tuxcare.19", "pedigree": { "ancestors": [ { "name": "@next/font", "purl": "pkg:npm/%40next/font@13.5.11", "type": "library", "version": "13.5.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "AIKIDO-2024-10173", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:c2c1e7d3-c967-5b28-b091-64686c0c835d", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2024-10173 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "AIKIDO-2025-10936", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:2c2a996a-bf3a-5084-af37-4d9bd964b281", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2025-10936 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2024-34351", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:5229cacf-121a-578c-8a5e-2cfc45294a7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34351 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2024-47831", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:599339b3-b304-5cc2-af3b-8a88e0c3de37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47831 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2024-51479", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:d03c0f06-8c6e-5e21-ab13-4eba63b38b47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-51479 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2025-32421", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:a97375ba-51b1-5bb1-8bf8-f9a290908dc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32421 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2025-48068", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:9e9c430b-6df9-51ba-a103-d59c31d461df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48068 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2025-55173", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:20f65356-8aff-516e-864f-d7a3fab05f6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55173 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2025-55183", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:c31b3ebf-3ada-5609-b01a-fdf789808ff1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55183 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2025-55184", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:ca74a01b-2255-5689-bfda-dd81bcd4a5da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55184 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2025-57752", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:9e314254-4864-5e2f-be71-98ad198722c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57752 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2025-57822", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:da821254-586c-5781-a09a-c3d0aeb54515", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57822 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2025-59471", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:7d9c7b93-d69d-51ab-9ff4-547ce8cf418b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59471 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2025-59472", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:78008b32-8c05-5e63-a79d-47710813280b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59472 does not affect version 13.5.11-tuxcare.19 of @next/font. not_affected \u2014 Version 13.5.11-tuxcare.13 is not affected by CVE-2025-59472. The vulnerable PPR (Partial Prerendering) resume endpoint feature does not exist in this version. The resume endpoint handler that processes `Next-Resume: 1` headers, the postponed-state processing logic, and the resume-data-cache decompression code were all introduced in much later Next.js versions (v16.3.0+). Version 13.5.11 predat...", "justification": "code_not_present" } }, { "id": "CVE-2025-67779", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:75f66c6e-9ecd-51c2-b728-30cb61f8a672", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-67779 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-27980", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:783cb273-495b-54a8-926c-c14d7d323ab1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27980 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-29057", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:e1d1fb09-78c0-5752-ad0f-10d9efdda416", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29057 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-44572", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:5fea2942-a889-530f-80ca-c5391b2ab3ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44572 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-44573", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:1d472470-6ad0-5fd9-8d0f-7b4677428723", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44573 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-44577", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:ce7755e5-1a3f-5b65-a71a-f7c5572a9714", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44577 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-44578", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:6a9c4411-a148-5fee-a76c-69039d87690b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44578 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-44580", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:530c4588-8083-5023-9fec-18c94beffcb8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44580 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-44581", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:cf783dfe-0c42-5cb8-8da9-ba8c6bf3d83e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44581 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-44582", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:1aaa7d6d-e113-51aa-b881-be0e676a45bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44582 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-64641", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:dc821aa4-ca65-53d9-9b6a-579a9413c944", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64641 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-64643", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:02b24f83-1c59-56b5-a42c-740b43946312", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64643 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-64645", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:ed09f858-89bc-5789-9538-2fdd50f019a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64645 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-64646", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:9d24d959-7635-5eb3-a59c-d70f9eb0ef59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64646 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-64647", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:ef811aba-2c09-5305-a142-e216727a8171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64647 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-64648", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:00f33c8d-b2a6-5384-9197-a2dcff5ed43e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64648 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-75604", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:bb771a33-8bd1-59da-88b9-3a9b5ea802ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75604 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "CVE-2026-94482", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:c0559573-d2dd-5ce9-ba9e-d044f956288f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94482 affects version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "GHSA-2464-fhr4-w9xw", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:f1485fcd-874c-5824-a2d1-4d8d6cedbedb", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-2464-fhr4-w9xw does not affect version 13.5.11-tuxcare.19 of @next/font. not_affected \u2014 Next.js 13.5.11-tuxcare.18 is not affected by GHSA-2464-fhr4-w9xw because the vulnerable code (memory-related RCE in sharp library) is not present in the Next.js repository. Sharp is not bundled, vendored, or declared as a dependency in this version. The vulnerability only manifests when users separately install a vulnerable version of sharp (< 0.35.5). Later Next.js versions (lts-active, 16.3....", "justification": "requires_dependency" } }, { "id": "GHSA-2xp9-vwfh-vxw4", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:e1589fa5-c303-51ae-af72-35216b1bd866", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-2xp9-vwfh-vxw4 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "GHSA-5j59-xgg2-r9c4", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:8ae20606-5a76-5f60-87b7-fd4721783d95", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5j59-xgg2-r9c4 is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "GHSA-8h8q-6873-q5fj", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:eae9ca1a-809f-53ee-b304-a499449447fe", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-8h8q-6873-q5fj is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "GHSA-h25m-26qc-wcjf", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:3461696e-fe3c-551c-88b3-73d41f6009c7", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h25m-26qc-wcjf is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "GHSA-mwv6-3258-q52c", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:53b5f715-c489-5022-997f-fd618ecb1d8f", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mwv6-3258-q52c is fixed in version 13.5.11-tuxcare.19 of @next/font." } }, { "id": "GHSA-q4gf-8mx6-v5v3", "affects": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:695cc538-ecd9-54f5-87ff-9f3ea5aea101", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q4gf-8mx6-v5v3 is fixed in version 13.5.11-tuxcare.19 of @next/font." } } ], "dependencies": [ { "ref": "pkg:npm/%40next/font@13.5.11-tuxcare.19" } ] }