{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:089198f1-db2a-50ee-9b50-fe6269a8024b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@astrojs/webapi", "purl": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8", "version": "2.10.15-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:2faf8cb4-a4a2-5e74-95ea-43b1e381b300", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:ae105b07-0fff-5fdc-bc2c-a3a88c1e463e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:8dad6cd8-129b-58d1-bfd2-eeb239e4d75e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55303 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:08889c5e-f43d-5643-8f95-bdd0ea75451f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:f224befb-5141-539f-b44a-512dfc80ad64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:5b151c18-1b7e-53fd-8672-25ea06ca4478", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:15722d14-44ac-5389-9f87-d08c7072d767", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:78a0b5e9-4ff1-59f6-8cde-0ca17f5ee5ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:0fc81279-535b-5ff8-9e42-9e2181d27f0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:542b4f17-1a1f-5dcd-9ab5-b2fcceb3da09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33769 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:69af391d-8e1b-5e7e-9bc6-30b9377e18db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:6c97ca23-eff3-52d9-a8a5-c9527e83cfaf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45028 does not affect version 2.10.15-tuxcare.8 of @astrojs/webapi. not_affected \u2014 Astro version 2.10.14 is not affected by CVE-2026-45028. The server islands feature with encrypted parameter handling does not exist in this version. The vulnerability requires server islands (introduced in later versions) to be present, specifically the encryption/decryption of props and slots parameters via AES-GCM. Version 2.10.14 predates this feature entirely. While the repository contains...", "justification": "code_not_present" } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:0cb78cb7-ae2e-5abd-ac34-6bcf8d341fb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50146 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:6b6c8475-e939-59d0-8337-b07011e222e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:b43d5b8a-1bf0-5875-9abf-4c540ade7b39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54299 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2026-59728", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:b966490b-4023-5926-934b-148f859e9cbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59728 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:36f2db91-2bd3-52aa-b1b1-723bd2a757ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:cb8ffd0f-f3d6-5695-ac9b-41937d1bd544", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-73422 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:700050e9-1ffb-554e-bfe0-2cde9d14eed1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84376 affects version 2.10.15-tuxcare.8 of @astrojs/webapi, and is fixed in 2.10.15-tuxcare.9." } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:a4dde92b-f6d9-54fb-92d3-562dc6171d1f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 affects version 2.10.15-tuxcare.8 of @astrojs/webapi, and is fixed in 2.10.15-tuxcare.9." } }, { "id": "GHSA-4g3v-8h47-v7g6", "affects": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ], "bom-ref": "urn:uuid:f9b595e0-4199-5eb7-8d48-98db2a83a5b9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 is fixed in version 2.10.15-tuxcare.8 of @astrojs/webapi." } } ], "dependencies": [ { "ref": "pkg:npm/%40astrojs/webapi@2.10.15-tuxcare.8" } ] }