{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:18322108-82ee-5317-a36b-5a36c1dbb4ef", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6", "type": "library", "name": "@nuxt/schema", "version": "4.0.3-tuxcare.6", "purl": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:7f783ab9-5048-5a55-b51e-e6004c64e0ae", "id": "CVE-2022-21670", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-21670 is fixed in version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b1dbc58f-2b11-5205-b043-6afba2574862", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/schema 4.0.3-tuxcare.6. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c17473fb-0acc-5e77-85f9-e0c4c5595ec7", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a0dd329b-eafe-5c45-8d2a-e315d9ca24a8", "id": "CVE-2026-25128", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ef515977-76cf-5627-8914-767da3ba7c90", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b1c15a48-25a1-5023-b873-bf12043788ea", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/schema 4.0.3-tuxcare.6. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7340bd5f-8306-5406-87b2-a8130fc2f809", "id": "CVE-2026-44372", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44372 is fixed in version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8754d147-38be-5d0f-959c-9d13a2ea04d0", "id": "CVE-2026-45669", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8459c943-e76f-5a44-841e-6f43d9fb8296", "id": "CVE-2026-45670", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:474e6423-c6a6-5592-a2f9-60db783a4a92", "id": "CVE-2026-45736", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-45736 is a false positive for @nuxt/schema 4.0.3-tuxcare.6. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f38d91a3-77d4-513c-9428-b5ec66a4c45d", "id": "CVE-2026-46342", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1c2ccb91-a452-5b8f-8ffd-ad500be658a9", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:52d26f3e-3891-5a93-a56d-114306601988", "id": "CVE-2026-49993", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e5742158-991f-5216-8d42-6907d30ee02c", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2dc194e8-a371-548c-9632-7b11703012c2", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bdc2a722-6a8a-5aca-bd40-6048f09104c9", "id": "CVE-2026-56326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8b2f8c6b-afe8-5045-bb4e-69c6c5325303", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f77711e2-5f13-58c3-82ee-952d0c599525", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.6 of @nuxt/schema. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:69cd0a56-2678-5f34-817e-091bdab827a8", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9b6b3407-fa26-53cb-b345-21e0ec8409fa", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:78760d0c-0062-5f06-8fae-017beee2307d", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:20319810-5e27-52fe-a16f-b60f6bf6b60a", "id": "GHSA-534h-c3cw-v3h9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0414d00b-9d3f-5612-ba77-e221f8d59f4b", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e1cd3ba7-b20f-5fb2-8e49-d3ca3ef54931", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b5b7b591-7914-559b-8806-3cd7c27d3958", "id": "GHSA-rq7w-g337-39qq", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.6 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/schema@4.0.3-tuxcare.6" } ] }