{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fcfd9ee3-d29d-5af2-8158-5d8706c3dd86",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "i18next-http-backend",
      "purl": "pkg:npm/i18next-http-backend@1.4.4-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/i18next-http-backend@1.4.4-tuxcare.1",
      "version": "1.4.4-tuxcare.1",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-41691",
      "affects": [
        {
          "ref": "pkg:npm/i18next-http-backend@1.4.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cc09d86e-6424-5a1a-80b6-39274fb485dd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41691 does not affect version 1.4.4-tuxcare.1 of i18next-http-backend. already_fixed \u2014 CVE-2026-41691 has been fixed in the target. The target repository at SHA 4c259a05342a83d40708a87d91745cb81440f564 contains the complete security fix from commit 5f9123b, which adds input validation to prevent path traversal, URL injection, log injection, prototype pollution, and credential leakage vulnerabilities. All affected code paths are protected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/i18next-http-backend@1.4.4-tuxcare.1"
    }
  ]
}