{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f5de1d34-7d88-5fe7-97c9-eabf67e9fea2", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/astro@4.16.19-tuxcare.1", "type": "library", "name": "astro", "version": "4.16.19-tuxcare.1", "purl": "pkg:npm/astro@4.16.19-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e568d21e-f736-5910-bac4-2e21b41abdd7", "id": "AIKIDO-2025-10879", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2025-10879 is fixed in version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b391d424-6fb0-5c77-8022-619fba40f103", "id": "CVE-2025-55303", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55303 affects version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2d1b0b4a-36c9-5837-af1f-648a27fcc4e0", "id": "CVE-2025-61925", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fc233fa2-c7a2-5233-9615-2128601bf577", "id": "CVE-2025-64525", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64525 is fixed in version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fd17e85b-4d30-5cb4-96c1-078990ec2144", "id": "CVE-2025-64757", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fdec0c5b-a3a5-50d0-b63b-e82dd5915f64", "id": "CVE-2025-64764", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:555791eb-649f-554c-b59f-924daad3cdfe", "id": "CVE-2025-64765", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:01296b87-b2ce-5a39-98cc-7188c30562a1", "id": "CVE-2025-65019", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f752c62b-3ce6-597b-8eed-a393c35ecf43", "id": "CVE-2025-66202", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:87268777-0940-5041-9072-f101d1e4b996", "id": "CVE-2026-33490", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-33490 is a false positive for astro 4.16.19-tuxcare.1. false_positive \u2014 CVE-2026-33490 concerns H3 (a minimal HTTP framework), but the target repository is Astro (a website build tool). H3 is not present in this repository - no vendored code, no dependency, no imports. The only 'h3' references found are HTML heading components (

tags), unrelated to the H3 framework." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ba989013-a0b6-5e8e-bc95-1812b8959209", "id": "CVE-2026-33769", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33769 is fixed in version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a3af9bed-f4d7-502f-a5b1-8d1e816c4ea1", "id": "CVE-2026-41067", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f9800b8f-e97b-584d-8a26-c68fdc614c66", "id": "CVE-2026-45028", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45028 affects version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:74ab26ac-f39d-5dab-bc17-8539c944dd2e", "id": "CVE-2026-50146", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50146 affects version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ac9392da-da22-5bdc-bba8-4d75d2a0e96e", "id": "CVE-2026-54298", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54298 affects version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a18b817c-8a9b-56fc-8ae3-c0ae8a9ca77a", "id": "CVE-2026-54299", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54299 does not affect version 4.16.19-tuxcare.1 of astro. already_fixed \u2014 The target repository has already fixed this vulnerability via CVE-2026-25545 / AIKIDO-2025-10879 (May 7, 2026), which addresses the identical SSRF issue. The fix removes the prerendered error page fetching feature entirely, replacing it with direct SSR rendering. This is a more aggressive mitigation than the upstream's host validation approach." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1098a3b2-1888-5d43-81e2-d3f3ab10ddc8", "id": "CVE-2026-59727", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59727 affects version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ddfae739-1dee-515b-a7d9-1037144709ed", "id": "CVE-2026-59729", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59729 affects version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d6ab5c7a-8406-5571-8cca-83ed5104d38f", "id": "GHSA-4g3v-8h47-v7g6", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 affects version 4.16.19-tuxcare.1 of astro." }, "affects": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/astro@4.16.19-tuxcare.1" } ] }