{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0f9942eb-4f8b-5724-8070-1c2a249c592f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@hono/node-server",
      "purl": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.1",
      "version": "1.13.8-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "@hono/node-server",
            "purl": "pkg:npm/%40hono/node-server@1.13.8",
            "type": "library",
            "version": "1.13.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-23340",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8998fe59-4c9c-5abf-88d9-b7c0c8b8d03f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-23340 affects version 1.13.8-tuxcare.1 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2024-32652",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8b9d412a-0532-56a9-9d1a-b835826413cc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-32652 affects version 1.13.8-tuxcare.1 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-118663",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f48afe47-f6e8-5e88-9017-10702c6d8883",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-118663 affects version 1.13.8-tuxcare.1 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-126210",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:14de12d4-cd9e-55d6-89f0-3b4a76a66d14",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-126210 is fixed in version 1.13.8-tuxcare.1 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-126343",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2d7208f5-2209-5957-b4fb-8bbc2e5d614d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-126343 does not affect version 1.13.8-tuxcare.1 of @hono/node-server. not_affected \u2014 @hono/node-server 1.13.8 has no WebSocket/upgrade support. The vulnerable upgrade handler, which awaits the app without socket error listeners, does not exist in this tree. It is the same product, so this is not a false_positive. Nothing receives an HTTP upgrade request and passes it to the Hono app.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-29087",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e625415f-0d20-58f7-afd0-c8ce1c661752",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-29087 affects version 1.13.8-tuxcare.1 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-39406",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7a14cf60-8ef1-56d6-83fb-a20ae7c987c4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-39406 affects version 1.13.8-tuxcare.1 of @hono/node-server, and is fixed in 1.13.8-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-73565",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:76f8f657-e3b5-5e08-b7a1-9a3c2d3822d7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-73565 does not affect version 1.13.8-tuxcare.1 of @hono/node-server. not_affected \u2014 @hono/node-server 1.13.8 has no WebSocket support. The CVE concerns the upgradeWebSocket helper, which leaks a retained IncomingMessage and a pending promise when ws aborts a handshake with a missing or malformed Sec-WebSocket-Key. That helper does not exist in this tree, so the vulnerable code is absent (Type A1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-frvp-7c67-39w9",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:22e460c5-c773-5da6-b35b-f77d84471544",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-frvp-7c67-39w9 affects version 1.13.8-tuxcare.1 of @hono/node-server."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.1"
    }
  ]
}