{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c051472e-2f16-5054-a182-58b6f813dc0a",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/multer@1.4.5-lts.2-tuxcare.1",
      "type": "library",
      "name": "multer",
      "version": "1.4.5-lts.2-tuxcare.1",
      "purl": "pkg:npm/multer@1.4.5-lts.2-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:0c52e14d-6c80-5b60-a883-1560f734166a",
      "id": "CVE-2025-47935",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-47935 does not affect version 1.4.5-lts.2-tuxcare.1 of multer. already_fixed \u2014 CVE-2025-47935 has already been fixed in the target repository. TuxCare developers applied the upstream patch (plus additional protections) in commit 657250bbc5ce371a2f8749e0c0ecd6158dc8714d on 2025-11-13. The current version (1.4.5-lts.2-tuxcare.3 at SHA 8c2a89600fc9f48a505ba8d8cb5a2bc91fc760f8) contains all defensive components from the upstream fix: drainStream function, request error handle..."
      },
      "affects": [
        {
          "ref": "pkg:npm/multer@1.4.5-lts.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d33bc2e6-a95f-540b-96af-b56b39123c74",
      "id": "CVE-2025-47944",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-47944 does not affect version 1.4.5-lts.2-tuxcare.1 of multer. already_fixed \u2014 CVE-2025-47944 has been fixed in this target repository. TuxCare applied a comprehensive backport on 2025-11-13 (commit 657250b) that combines stream draining, error flag management, busboy finalization patching, explicit request error handling, and try-catch protection. The current HEAD (8c2a896) contains all defensive layers needed to prevent malformed multipart requests from causing process ..."
      },
      "affects": [
        {
          "ref": "pkg:npm/multer@1.4.5-lts.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:810cda74-abff-5af4-9ba4-2e2824813395",
      "id": "CVE-2025-48997",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-48997 does not affect version 1.4.5-lts.2-tuxcare.1 of multer. already_fixed \u2014 The target repository (multer 1.4.5-lts.2-tuxcare.3) already contains the fix for CVE-2025-48997. TuxCare applied a backport in commit 657250b that adds fieldname validation to prevent DoS from null/undefined/empty field names."
      },
      "affects": [
        {
          "ref": "pkg:npm/multer@1.4.5-lts.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:878739bc-ffc7-5d2d-9afb-1c970bb90b1e",
      "id": "CVE-2025-7338",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-7338 affects version 1.4.5-lts.2-tuxcare.1 of multer."
      },
      "affects": [
        {
          "ref": "pkg:npm/multer@1.4.5-lts.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a753a91c-8220-5fad-a367-2464f006d754",
      "id": "CVE-2026-2359",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-2359 does not affect version 1.4.5-lts.2-tuxcare.1 of multer. already_fixed \u2014 CVE-2026-2359 has been fixed in the target repository. TuxCare backported the upstream fix (commit cccf0fe) in commit 9ff2252 on March 13, 2026. The current code at SHA 8c2a89600fc9f48a505ba8d8cb5a2bc91fc760f8 includes this fix. The vulnerability allowed DoS via resource exhaustion when connections were dropped during multipart upload, but the target now properly destroys busboy parser instance..."
      },
      "affects": [
        {
          "ref": "pkg:npm/multer@1.4.5-lts.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:da60a004-e67f-55f0-b31a-93d4041a35ad",
      "id": "CVE-2026-3304",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-3304 does not affect version 1.4.5-lts.2-tuxcare.1 of multer. CVE-2026-3304 fix already exists in commit 35d3b114b6f55f7a9c80a5f1a5e7c9be816056d2"
      },
      "affects": [
        {
          "ref": "pkg:npm/multer@1.4.5-lts.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1b5ebe7a-1d15-5f95-ab6e-a182fd8f8e38",
      "id": "CVE-2026-3520",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-3520 does not affect version 1.4.5-lts.2-tuxcare.1 of multer. already_fixed \u2014 The target repository already contains the fix for CVE-2026-3520. The vulnerability (stack overflow DoS from processing many uploaded files via synchronous recursion) has been addressed through a prior TuxCare backport in commit 5a313b2 on March 13, 2026. The exact vendor fix is present: setImmediate() wrapper breaks the synchronous recursive call chain."
      },
      "affects": [
        {
          "ref": "pkg:npm/multer@1.4.5-lts.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6c8c4e71-0f56-5fc5-b6d2-ef0aed6551f7",
      "id": "CVE-2026-5079",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-5079 affects version 1.4.5-lts.2-tuxcare.1 of multer."
      },
      "affects": [
        {
          "ref": "pkg:npm/multer@1.4.5-lts.2-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/multer@1.4.5-lts.2-tuxcare.1"
    }
  ]
}