{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:48f3ddcb-9103-5edf-8b6e-eae7f3a2d79b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1", "type": "library", "name": "@nuxt/kit", "version": "3.2.0-tuxcare.1", "purl": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:814b2c69-0b25-5fc4-9f1b-811f3baa4794", "id": "CVE-2016-10735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-10735 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fd133a32-e82c-5d8d-9da9-64b539b8dc4f", "id": "CVE-2018-14040", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14040 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5e6fb99f-20a3-5904-8e7b-bd46ce2064da", "id": "CVE-2018-14042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14042 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:847e54b9-90e8-516a-8f40-644923f8c3a3", "id": "CVE-2018-16487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-16487 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:69b27481-9ccd-5763-9f84-82fefe9ed075", "id": "CVE-2018-20676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20676 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4fcc1b0c-390e-5597-85e1-d5a72fd499d7", "id": "CVE-2018-20677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20677 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:13e731bf-7586-5765-9ea2-20414a570ed8", "id": "CVE-2018-3721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-3721 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:12ceea27-ea06-563f-88ff-84094cbdbbe0", "id": "CVE-2019-10744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10744 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:762575e6-6aa0-5e2a-8dc6-41f5cd300acc", "id": "CVE-2019-14862", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-14862 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:171d23be-ab04-5f7c-be96-47f844a11582", "id": "CVE-2019-8331", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-8331 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cebec30e-e709-5d13-a443-3af49b322689", "id": "CVE-2020-36049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-36049 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9a266cbd-35cd-5808-bffd-6cdcaa1a3c03", "id": "CVE-2020-8203", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-8203 affects version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:789873ed-fe76-5dfd-a32e-1b2ab5010ecb", "id": "CVE-2021-23337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23337 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7afe75c1-3bba-5ce2-9022-e9f97d6710e7", "id": "CVE-2022-2421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2421 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:be1a9ef0-b89c-5459-a77b-8c937d6e7ae3", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:11a84065-a3b2-5314-9aa1-33c44e875ca4", "id": "CVE-2023-32695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-32695 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:83383ebf-61e3-50ff-b8d3-ffd555670a6f", "id": "CVE-2024-34343", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34343 affects version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c46501e1-4b04-5727-945e-64d922f5d9e8", "id": "CVE-2024-6484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6484 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1aa7a458-ad32-5f14-9a55-1cb5a81a0da5", "id": "CVE-2024-6485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6485 is fixed in version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b4598f29-e228-59ab-a03e-3b58ce79bdd9", "id": "CVE-2025-24361", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24361 affects version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:62a39d7f-e4f2-59dc-830b-01de234500dc", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0c0705c8-9f40-5b0f-a822-f4ef21364273", "id": "CVE-2026-33151", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33151 affects version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d9787806-e225-54eb-9839-fc706b3e8f33", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8111f68f-4692-59da-8238-384c9e79fce8", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/kit 3.2.0-tuxcare.1. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (IPv6/IPv4 address parsing), but this repository is Nuxt v3.2.0-tuxcare.1 (a Vue.js meta-framework). The affected component is not present in this repository as a vendored copy, dependency, or in any other form. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7a0de6e6-f775-593b-bb49-058ae678c9d8", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:89817c16-c0c3-5a7f-8049-a6790a695334", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:74277348-c96c-5067-99f6-8fb6e5770b24", "id": "CVE-2026-47200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 3.2.0-tuxcare.1 of @nuxt/kit. not_affected \u2014 Nuxt version 3.2.0 does not contain the server-only pages feature that is the prerequisite for CVE-2026-47200. The vulnerable code pattern (`.server.vue` pages rendered as islands via `/__nuxt_island/page_*` endpoint) was introduced in Nuxt v3.11.0, which is 2,059 commits after v3.2.0. The target version predates the feature by multiple major versions." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:549dc7a8-0bfd-53d9-8e9e-c72ddb3b3b0b", "id": "CVE-2026-4800", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-4800 affects version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7094eb8d-52b3-5042-a3e0-9ca7547d86c4", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.2.0-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b5ed33d1-334e-5c14-9c1e-4b124ed9b4c3", "id": "CVE-2026-56326", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 3.2.0-tuxcare.1 of @nuxt/kit. not_affected \u2014 Version 3.2.0 does not contain the vulnerable code pattern. The vulnerability exists in the encodeURL() function which was introduced on June 26, 2024, over a year after version 3.2.0 (released February 9, 2023). The target uses a simpler redirect architecture without the vulnerable encodeURL() function." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:879b2848-07a5-5226-84a8-54d8507e6b70", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 3.2.0-tuxcare.1 of @nuxt/kit. not_affected \u2014 Target repository Nuxt version 3.2.0 is NOT affected by GHSA-c9cv-mq2m-ppp3. All three vulnerability sinks described in the CVE (SSR open redirect via path-normalization, script execution via navigateTo open option, and protocol-relative bypass in reloadNuxtApp) require code features that were introduced AFTER version 3.2.0. The vulnerable encodeURL function with WHATWG URL parsing was added in..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cc85210e-501f-5bba-a1d3-17b3590e420b", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.2.0-tuxcare.1 of @nuxt/kit. not_affected \u2014 Version 3.2.0 is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerable innerHTML pattern was introduced in v3.16.0 (March 2025), two years after this version. The target uses noscript.children instead of the vulnerable noscript.innerHTML assignment." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.1" } ] }