{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:acc36906-5639-59bb-9618-e65c8d332f79",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "fast-xml-parser",
      "purl": "pkg:npm/fast-xml-parser@4.2.7",
      "type": "library",
      "bom-ref": "pkg:npm/fast-xml-parser@4.2.7",
      "version": "4.2.7",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-25128",
      "affects": [
        {
          "ref": "pkg:npm/fast-xml-parser@4.2.7"
        }
      ],
      "bom-ref": "urn:uuid:19fc702c-ac0a-589f-9ddb-31b750c42a2e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-25128 does not affect version 4.2.7 of fast-xml-parser. Version 4.2.7-tuxcare.1 is not affected by CVE-2026-25128. The vulnerable numeric entity processing code (num_dec/num_hex handlers calling String.fromCodePoint with unvalidated code points) was introduced in commit 391f24f, which is not present in the 4.2.7 release. The CVE correctly states it affects versions 5.0.9 through 5.3.3; version 4.2.7 predates the introduction of this feature entirely. The target processes only hardcoded HTML entities and does not handle arbitrary numeric character references.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-25896",
      "affects": [
        {
          "ref": "pkg:npm/fast-xml-parser@4.2.7"
        }
      ],
      "bom-ref": "urn:uuid:b389a6d6-4cac-5e9f-bdb3-988248603dca",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-25896 affects version 4.2.7 of fast-xml-parser, and is fixed in 4.2.7-tuxcare.1."
      }
    },
    {
      "id": "CVE-2026-26278",
      "affects": [
        {
          "ref": "pkg:npm/fast-xml-parser@4.2.7"
        }
      ],
      "bom-ref": "urn:uuid:e2b07338-8b7b-56b0-8657-ffbe3324546e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-26278 affects version 4.2.7 of fast-xml-parser, and is fixed in 4.2.7-tuxcare.1."
      }
    },
    {
      "id": "CVE-2026-27942",
      "affects": [
        {
          "ref": "pkg:npm/fast-xml-parser@4.2.7"
        }
      ],
      "bom-ref": "urn:uuid:fc910479-2b50-5a6e-9060-4ea593318ae1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-27942 affects version 4.2.7 of fast-xml-parser, and is fixed in 4.2.7-tuxcare.1."
      }
    },
    {
      "id": "CVE-2026-33036",
      "affects": [
        {
          "ref": "pkg:npm/fast-xml-parser@4.2.7"
        }
      ],
      "bom-ref": "urn:uuid:4c75a53b-f698-53c2-89d8-cc30d45efe0c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33036 affects version 4.2.7 of fast-xml-parser, and is fixed in 4.2.7-tuxcare.1."
      }
    },
    {
      "id": "CVE-2026-33349",
      "affects": [
        {
          "ref": "pkg:npm/fast-xml-parser@4.2.7"
        }
      ],
      "bom-ref": "urn:uuid:023b9b34-1ded-53ac-b77c-478fa0cf0a8f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33349 affects version 4.2.7 of fast-xml-parser, and is fixed in 4.2.7-tuxcare.1."
      }
    },
    {
      "id": "CVE-2026-41650",
      "affects": [
        {
          "ref": "pkg:npm/fast-xml-parser@4.2.7"
        }
      ],
      "bom-ref": "urn:uuid:823b6b6c-e572-52f7-bf6f-8cdbe3c57ea2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41650 affects version 4.2.7 of fast-xml-parser, and is fixed in 4.2.7-tuxcare.1."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/fast-xml-parser@4.2.7"
    }
  ]
}