{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:af45c7dd-579b-50a1-899f-03dd918440d7", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6", "type": "library", "name": "@nuxt/vite-builder", "version": "4.0.3-tuxcare.6", "purl": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:cd3c8a97-8ed6-59e0-95a7-d8288078e4d1", "id": "CVE-2022-21670", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-21670 is fixed in version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8d61b3dc-f584-597b-a614-0c7af180ffb7", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/vite-builder 4.0.3-tuxcare.6. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:36861a86-cf0a-5d87-a4e8-d759c90f4140", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c0ab0729-2eb2-5023-bb24-e99e7d027c8b", "id": "CVE-2026-25128", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6deaa7d6-a215-5624-9329-5b68a8ef07d9", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e2f63226-22b2-594b-8267-f9574680dd9f", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/vite-builder 4.0.3-tuxcare.6. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c63adfb1-e292-5947-8a22-5c4281e00ac3", "id": "CVE-2026-44372", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44372 is fixed in version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c7f8ee44-7688-57a0-85b1-9d9ae8c6f1d6", "id": "CVE-2026-45669", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:30842d32-ac3e-5fe9-8754-160cae8cfb5b", "id": "CVE-2026-45670", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9bba3b0c-44ac-5fca-8544-46f238a9ae4a", "id": "CVE-2026-45736", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-45736 is a false positive for @nuxt/vite-builder 4.0.3-tuxcare.6. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7b47923f-c6a6-5549-8144-c8676a5892eb", "id": "CVE-2026-46342", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c81bc0ef-cedc-5d36-968a-d5f1e9340b7e", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:20c63f8c-2531-5243-aea1-91873aa65ce5", "id": "CVE-2026-49993", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5bca298b-01c0-5674-a9e2-45612877f5aa", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:32fc6022-b6e0-5f3c-b593-656c12918b0b", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:36863c09-4b05-5ae7-b6e5-7290eab3dc73", "id": "CVE-2026-56326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:752033d6-c19d-5f3c-9e83-f150c79fd187", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c2e7c525-e641-5f39-ba51-e60f4a6e4774", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.6 of @nuxt/vite-builder. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:46af74e6-0979-5828-a586-844cb4d5bcb2", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1a91dc43-fa27-5166-bd03-c26119c0e932", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f6e422e6-3500-5a75-8b8c-bc35ba772646", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fb751b76-f68f-574c-8892-45989d9ba2fc", "id": "GHSA-534h-c3cw-v3h9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:60ce39f0-bdf3-595c-b346-3256d3dfcd3b", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:343bb66a-b6b6-5cbd-b702-99b8b8a3ee15", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d8af8426-4418-57fe-91e5-e50c1f7b69a1", "id": "GHSA-rq7w-g337-39qq", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.6" } ] }