{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8225c3d5-321c-592e-9f4a-80948012635c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@nuxt/rspack-builder",
      "purl": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8",
      "type": "library",
      "bom-ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8",
      "version": "4.0.3-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "@nuxt/rspack-builder",
            "purl": "pkg:npm/%40nuxt/rspack-builder@4.0.3",
            "type": "library",
            "version": "4.0.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-25852",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:9911900e-1596-523b-85bb-3b63e20f2af0",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/rspack-builder 4.0.3-tuxcare.8. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match."
      }
    },
    {
      "id": "CVE-2025-59414",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:1401f4e8-dd30-5d6f-af01-b11378dc6d9c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-25128",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f988d384-e1f5-5e52-aed5-f94d4be4e420",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-41305",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:bf941066-a76b-5500-849d-b389e499b641",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-42338",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:a51bb5d0-225c-5974-9f27-c73e40843f8a",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/rspack-builder 4.0.3-tuxcare.8. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match."
      }
    },
    {
      "id": "CVE-2026-44372",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:3ff5a058-8821-5151-96fb-03eab9acc013",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44372 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-45669",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:781a170c-2de5-5232-a366-e61d8b9e3478",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-45670",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:1f1b5da6-2542-533e-8b34-4ef21c212e49",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-45736",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:04220ead-2e9d-5f5e-ad16-17cc04db4df7",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-45736 is a false positive for @nuxt/rspack-builder 4.0.3-tuxcare.8. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..."
      }
    },
    {
      "id": "CVE-2026-46342",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:07ed953c-cb5e-5c13-ab16-b40c816ca582",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-47200",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:6cb4b419-00b3-5c1d-916b-b43f3ab68e50",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47200 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-49993",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:30254687-0a59-53e2-9e31-ab7e7e511c41",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-53721",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:ca412f46-fd26-541d-b6af-e96a0eeae0be",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-53722",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:fd73d247-d76b-5faa-8e43-d11457b4fb5b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-56301",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:deb8d2f2-f2bf-598e-ba83-6a39fa4ac51c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-56301 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-56317",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:284c857b-558c-53ef-8aba-6b207f01f2d0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-56317 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-56326",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:85c7ac3b-8690-59c1-80b8-2a8519fcf7ce",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-71314",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:dd5aa1c1-533b-5b8f-b5a5-89f88017e935",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71314 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-71316",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:380aca3a-1361-5193-89a6-10d49a28bc73",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.8 of @nuxt/rspack-builder. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3.",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-71318",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f4ed07e0-b6e3-5a21-be15-225260e35072",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71318 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-71320",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f6c8bb0a-1ac7-569a-b44d-0b7cba21437b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71320 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "CVE-2026-71321",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:646ad78d-822d-539f-8507-0888762eac31",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-71321 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "GHSA-2x6f-57hp-86fx",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:4f1357e7-6ddf-504b-8814-cc6b54601478",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-2x6f-57hp-86fx is a false positive for @nuxt/rspack-builder 4.0.3-tuxcare.8."
      }
    },
    {
      "id": "GHSA-534h-c3cw-v3h9",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:4cd49199-a004-5dd2-a0ad-7e2ab1148511",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "GHSA-c9cv-mq2m-ppp3",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d18283c2-9e78-56d6-b518-c0bc0ad63341",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "GHSA-m3q2-p4fw-w38m",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:90ecb3ae-2810-568e-9b06-0a8df6b33e11",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "GHSA-rq7w-g337-39qq",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:2ba44e71-40cb-5017-8695-ea35c1c02751",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.8 of @nuxt/rspack-builder."
      }
    },
    {
      "id": "GHSA-xppm-jmw6-fhmf",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:5d04e53e-3a7e-5ea9-910c-9cae0ba3f295",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/rspack-builder 4.0.3-tuxcare.8."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40nuxt/rspack-builder@4.0.3-tuxcare.8"
    }
  ]
}