{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5a2ff808-b512-5cb3-8036-46962d4a38c2",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "h3",
      "purl": "pkg:npm/h3@1.15.3-tuxcare.3",
      "type": "library",
      "bom-ref": "pkg:npm/h3@1.15.3-tuxcare.3",
      "version": "1.15.3-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "h3",
            "purl": "pkg:npm/h3@1.15.3",
            "type": "library",
            "version": "1.15.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-23527",
      "affects": [
        {
          "ref": "pkg:npm/h3@1.15.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:465983eb-2be6-55a1-a4f6-b7f97ab22965",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-23527 is fixed in version 1.15.3-tuxcare.3 of h3."
      }
    },
    {
      "id": "CVE-2026-33128",
      "affects": [
        {
          "ref": "pkg:npm/h3@1.15.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:b4e7fb38-a705-5fc3-856c-9debae51953d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-33128 is fixed in version 1.15.3-tuxcare.3 of h3."
      }
    },
    {
      "id": "CVE-2026-33129",
      "affects": [
        {
          "ref": "pkg:npm/h3@1.15.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:c0f99a59-8ce3-50db-9f00-16e7f545e667",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-33129 does not affect version 1.15.3-tuxcare.3 of h3. not_affected \u2014 Target version 1.15.3 is not affected by CVE-2026-33129. The basic authentication feature (requireBasicAuth function) was introduced in version 1.15.8, which postdates the target version by 5 releases. The vulnerable code pattern never existed in v1.15.3 because the entire authentication module (src/utils/auth.ts) does not exist in this version. The CVE affects versions 2.0.1-beta.0 through 2.0...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-33490",
      "affects": [
        {
          "ref": "pkg:npm/h3@1.15.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4b906ebe-0289-5cda-abeb-5d94767ffb50",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33490 affects version 1.15.3-tuxcare.3 of h3."
      }
    },
    {
      "id": "CVE-2026-86253",
      "affects": [
        {
          "ref": "pkg:npm/h3@1.15.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:259c2335-7eda-543b-9264-7a734aab0cba",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-86253 is fixed in version 1.15.3-tuxcare.3 of h3."
      }
    },
    {
      "id": "GHSA-4hxc-9384-m385",
      "affects": [
        {
          "ref": "pkg:npm/h3@1.15.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7cc40c03-31d0-532a-b13b-afc71e9fed4d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-4hxc-9384-m385 is fixed in version 1.15.3-tuxcare.3 of h3."
      }
    },
    {
      "id": "GHSA-72gr-qfp7-vwhw",
      "affects": [
        {
          "ref": "pkg:npm/h3@1.15.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:9e6d2e4d-90d3-52c6-b193-078a8ce8e772",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-72gr-qfp7-vwhw is fixed in version 1.15.3-tuxcare.3 of h3."
      }
    },
    {
      "id": "GHSA-wr4h-v87w-p3r7",
      "affects": [
        {
          "ref": "pkg:npm/h3@1.15.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4d948e47-9f3e-524e-938c-b1b06f549a4a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-wr4h-v87w-p3r7 affects version 1.15.3-tuxcare.3 of h3."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/h3@1.15.3-tuxcare.3"
    }
  ]
}