{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9542221f-3f6f-593d-84c1-fc95d6da3cf9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@hono/node-server",
      "purl": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.2",
      "type": "library",
      "bom-ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.2",
      "version": "1.13.8-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "@hono/node-server",
            "purl": "pkg:npm/%40hono/node-server@1.13.8",
            "type": "library",
            "version": "1.13.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-23340",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:31a67086-3393-500e-86d5-5065ee15e080",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-23340 affects version 1.13.8-tuxcare.2 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2024-32652",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2f82e992-62df-5498-9625-87349fe45c56",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-32652 affects version 1.13.8-tuxcare.2 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-118663",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fddbd2e6-d375-5f1a-942f-ee232debb07d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-118663 affects version 1.13.8-tuxcare.2 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-126210",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5cb7d776-1471-59d1-9d19-2531f1e548ca",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-126210 is fixed in version 1.13.8-tuxcare.2 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-126343",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f6759d4e-74cb-5095-8a24-90fda7d7f07f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-126343 does not affect version 1.13.8-tuxcare.2 of @hono/node-server. not_affected \u2014 @hono/node-server 1.13.8 has no WebSocket/upgrade support. The vulnerable upgrade handler, which awaits the app without socket error listeners, does not exist in this tree. It is the same product, so this is not a false_positive. Nothing receives an HTTP upgrade request and passes it to the Hono app.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-29087",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0df831b6-4a43-5180-bd83-782a2a6a6456",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-29087 affects version 1.13.8-tuxcare.2 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-39406",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bd13f1d7-29dc-5dfa-8a9a-b4e2b55651bf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-39406 is fixed in version 1.13.8-tuxcare.2 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-73565",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cc75a2a1-8b75-5ce4-ae53-34e6401bb969",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-73565 does not affect version 1.13.8-tuxcare.2 of @hono/node-server. not_affected \u2014 @hono/node-server 1.13.8 has no WebSocket support. The CVE concerns the upgradeWebSocket helper, which leaks a retained IncomingMessage and a pending promise when ws aborts a handshake with a missing or malformed Sec-WebSocket-Key. That helper does not exist in this tree, so the vulnerable code is absent (Type A1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-frvp-7c67-39w9",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:90ae29e5-38a5-5733-b0e6-8fb93e6e59fc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-frvp-7c67-39w9 affects version 1.13.8-tuxcare.2 of @hono/node-server."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40hono/node-server@1.13.8-tuxcare.2"
    }
  ]
}