{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a4748dc1-4d26-582e-9219-ae8cd59c4b7c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxi@3.2.0-tuxcare.3", "type": "library", "name": "nuxi", "version": "3.2.0-tuxcare.3", "purl": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:ba4de08b-1e0f-5241-bf05-c355d6ad18e2", "id": "CVE-2016-10735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-10735 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d7aaef71-46be-527f-92ff-fe22c89573d0", "id": "CVE-2018-14040", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14040 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c169f032-3ab9-5841-92f4-c6bf36c51912", "id": "CVE-2018-14042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14042 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ec86c108-3788-541e-abdc-50b276d2fbbb", "id": "CVE-2018-16487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-16487 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9813ce9c-f32f-52f3-a99b-3428c7fcde60", "id": "CVE-2018-20676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20676 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c3954c46-41d9-5acb-a218-2ed05b693910", "id": "CVE-2018-20677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20677 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e813fd63-f4e2-5716-9a8c-4c846b640ea3", "id": "CVE-2018-3721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-3721 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a9bd0719-afaa-50e4-b6cd-2c919ac7542a", "id": "CVE-2019-10744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10744 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e6a43539-45fc-548b-a49c-eeb7cd5c5786", "id": "CVE-2019-14862", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-14862 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5333df40-60de-5471-8f4f-50bc72b27e55", "id": "CVE-2019-8331", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-8331 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8fca6dbb-83c7-5c9c-af9b-6b6de12adf29", "id": "CVE-2020-36049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-36049 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cd39d194-878d-51e2-ae12-44afe1e4ebb8", "id": "CVE-2020-8203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-8203 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:599bac53-c6ed-5b2f-8106-fb30d5106f3f", "id": "CVE-2021-23337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23337 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c37ee33f-0b77-5db9-a465-a8d66ba84e00", "id": "CVE-2022-2421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2421 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:81cba771-8c24-57d9-86ae-9f9b0d3ce4fc", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:468c866a-18d5-5f3a-a929-59d4d8cdda10", "id": "CVE-2023-32695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-32695 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6a548466-2333-549d-bb5f-2c9d22fb4c9a", "id": "CVE-2024-34343", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34343 affects version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:823fa508-cb3b-561e-9a27-df3bfe7c09c1", "id": "CVE-2024-6484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6484 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:13f7c466-664e-5c15-bb0f-9d09afda30c8", "id": "CVE-2024-6485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6485 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e129b74f-127e-542f-93e0-cc2fe761b06b", "id": "CVE-2025-24361", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24361 affects version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b1a3087b-b558-5fbb-a648-d62978b41eaf", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:62555363-6f22-5112-bd79-f90bd127bf0e", "id": "CVE-2026-33151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33151 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:389df8f2-7564-5f21-bbe0-b7ddacd99ce6", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:df242009-72d9-5cf8-a0ba-8d04316faba1", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxi 3.2.0-tuxcare.3. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (IPv6/IPv4 address parsing), but this repository is Nuxt v3.2.0-tuxcare.1 (a Vue.js meta-framework). The affected component is not present in this repository as a vendored copy, dependency, or in any other form. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:39ed1039-a17e-5de6-9701-a8cca1da9d01", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5c7d4961-583a-5e12-953a-146dc29e82b7", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c67a1055-fecb-51de-a7db-57fdcaec00d5", "id": "CVE-2026-47200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 3.2.0-tuxcare.3 of nuxi. not_affected \u2014 Nuxt version 3.2.0 does not contain the server-only pages feature that is the prerequisite for CVE-2026-47200. The vulnerable code pattern (`.server.vue` pages rendered as islands via `/__nuxt_island/page_*` endpoint) was introduced in Nuxt v3.11.0, which is 2,059 commits after v3.2.0. The target version predates the feature by multiple major versions." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3a237215-297a-55b7-90c7-9899d71361a6", "id": "CVE-2026-4800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-4800 is fixed in version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:99a0d55d-d758-5119-b680-b5ae7ebf8aaf", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.2.0-tuxcare.3 of nuxi." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9321ac41-72ab-55ce-bf9a-3667a073537f", "id": "CVE-2026-56326", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 3.2.0-tuxcare.3 of nuxi. not_affected \u2014 Version 3.2.0 does not contain the vulnerable code pattern. The vulnerability exists in the encodeURL() function which was introduced on June 26, 2024, over a year after version 3.2.0 (released February 9, 2023). The target uses a simpler redirect architecture without the vulnerable encodeURL() function." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c96940c7-e113-5bad-9c17-8625a3692c70", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 3.2.0-tuxcare.3 of nuxi. not_affected \u2014 Target repository Nuxt version 3.2.0 is NOT affected by GHSA-c9cv-mq2m-ppp3. All three vulnerability sinks described in the CVE (SSR open redirect via path-normalization, script execution via navigateTo open option, and protocol-relative bypass in reloadNuxtApp) require code features that were introduced AFTER version 3.2.0. The vulnerable encodeURL function with WHATWG URL parsing was added in..." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:de5e93a6-3985-535e-8a4b-ee2a343d6d91", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.2.0-tuxcare.3 of nuxi. not_affected \u2014 Version 3.2.0 is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerable innerHTML pattern was introduced in v3.16.0 (March 2025), two years after this version. The target uses noscript.children instead of the vulnerable noscript.innerHTML assignment." }, "affects": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/nuxi@3.2.0-tuxcare.3" } ] }