{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:83479bab-0b76-54b6-8c6a-37d6f0176a55", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7", "type": "library", "name": "@nuxt/vite-builder", "version": "3.12.3-tuxcare.7", "purl": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:ab921401-c8ad-5ec6-a52b-c8173df38957", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/vite-builder 3.12.3-tuxcare.7. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b9344273-cf0c-5ebc-ada5-e651e26878ad", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:19493810-5793-515d-b595-a3e77211057b", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:05c53e6e-6de5-5247-ad94-baab4a6ad745", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:61d85f9f-92ed-5c50-828a-b52abf4d50eb", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:db4b0689-5804-5f7a-b0b0-b7b9b3a9bcfd", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:d623bf48-a451-5ee3-9d63-ec88effd1bf5", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c020bc2c-8181-591b-b4df-58f0744d56ee", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:92ac75d3-463c-5fd9-9fa1-768f2ccd57b6", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/vite-builder 3.12.3-tuxcare.7. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:9a0c35ba-3526-51a6-92d3-e6c0aac0a86c", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a5cdbca0-2609-50ca-960b-a48596859eda", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c331c3fe-e338-57dd-bb40-cc6827184009", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:2dc23348-2494-5bc5-93bd-844c05a0e44c", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b572de7f-2ad1-5375-befb-07d435644e2d", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:dd978d3f-e85b-5dd1-b6fe-beff4940d9b8", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:ecb2718f-87ae-5bd9-a993-6f2cd5a63b4f", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:6f67d9da-550a-50e8-b193-6b89bf57b3b7", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.7 of @nuxt/vite-builder. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:54013e38-591f-50a0-952a-424b7e9c760b", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:02b40e6b-3fda-5965-b7a2-b07cf8d590ea", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f78ee43d-9ddd-53a1-9afa-083a104db7c4", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c91d009c-0b9e-50b4-b69d-6a597c21b4a1", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.7 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:767dde8a-cdb9-5477-a3f7-44338a6735ef", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.7 of @nuxt/vite-builder. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.7" } ] }