{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:18701198-b3f4-5141-9afc-553b04eb3521", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@nuxt/kit", "purl": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7", "version": "4.0.3-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25852", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:7a42d453-15dc-5375-8dbb-67778f59a437", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/kit 4.0.3-tuxcare.7. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:4f15cfa0-ac4c-55d1-bab5-9932b3ed867d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-25128", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:3dce0380-c6c2-559a-ab9b-b5f7573feae9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-41305", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:05a047c9-9574-5163-84e1-54ef9da64783", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-42338", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:4b2d7be7-542f-59ad-ac9e-a41a48b8f877", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/kit 4.0.3-tuxcare.7. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match." } }, { "id": "CVE-2026-44372", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:a67ee1d8-0bec-5c22-b8a1-1356e66a91ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44372 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:572f2ca7-332e-568f-9b7c-053711101d44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-45670", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:e25f4e8b-f68e-55fd-819c-331bf1dcf127", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-45736", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:0367cdce-3ea5-5eec-a644-8ea95dd19791", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-45736 is a false positive for @nuxt/kit 4.0.3-tuxcare.7. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:73fb16d5-d82b-5641-8901-c8fd03cab3bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:8d13211f-75bc-5567-bfe7-f5e86c44c8ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47200 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-49993", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:a5f4ca80-5682-55b4-9b4a-030efbf41ab2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:67440766-963e-5324-8710-85e55c309916", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:59ce8963-6f5e-5339-8602-99e294951fb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-56301", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:ea255030-110c-5a36-9e87-4b2264b7902e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56301 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:69636e43-4839-5ca4-9ca2-49a7c4160dc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:2fe417a2-0547-53d9-97f4-d7f76790bedf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:7252e2dd-be05-51ed-8960-bfb7978c3dba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71314 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:b712976b-a196-5e2f-baaf-3f4f7d0d8555", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.7 of @nuxt/kit. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:eac5c2b4-7df8-572f-beb8-d47487d13816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71318 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:c68fcb16-b063-57ab-afc9-4c724a25def6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71320 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:1fb9eda1-0e8d-5518-ad62-7eba131a60a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71321 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "GHSA-534h-c3cw-v3h9", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:106e86f1-ada3-504e-b6e9-a56c075a8187", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:478c87e0-d896-5bfa-924a-312e12bf9312", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:674b5b21-98f1-5207-9b9b-3dd56b6a5be8", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "GHSA-rq7w-g337-39qq", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:30b87ffd-b476-5000-bae2-69cc5a984a3a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.7 of @nuxt/kit." } }, { "id": "GHSA-xppm-jmw6-fhmf", "affects": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ], "bom-ref": "urn:uuid:6288a043-e694-5b21-9e20-6af79983ed27", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/kit 4.0.3-tuxcare.7." } } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/kit@4.0.3-tuxcare.7" } ] }