{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:90fbee69-ef21-5ac3-b1d8-4add2d199f08",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2",
      "type": "library",
      "name": "@nuxt/webpack-builder",
      "version": "4.0.3-tuxcare.2",
      "purl": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:a62fe471-c9ad-54f6-925e-25f3116a0cef",
      "id": "CVE-2022-21670",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-21670 is fixed in version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d269b9be-fdaa-5631-ab6a-36d43062f4c7",
      "id": "CVE-2022-25852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-25852 affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:67400d8f-6681-5c5a-a0f3-ec8acaccd2d4",
      "id": "CVE-2025-59414",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3f7045f1-fcfc-5890-9f7b-76025cc237d1",
      "id": "CVE-2026-25128",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-25128 affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8cd16a21-b025-5cd9-8e85-76ef56847a04",
      "id": "CVE-2026-41305",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41305 affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bc37dfe2-08b8-5265-988a-81a9eaa61592",
      "id": "CVE-2026-42338",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/webpack-builder 4.0.3-tuxcare.2. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:96bcb516-8fc5-5cb6-8f1c-394a2484238e",
      "id": "CVE-2026-44372",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44372 affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5a103c12-f854-5832-ad6b-51f2ac9b1d01",
      "id": "CVE-2026-45669",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45669 affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:96329a93-da9d-5a75-bf4b-0cdfcd95c395",
      "id": "CVE-2026-45670",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45670 affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4b523af0-6a6d-5906-be5f-1f7638dabc96",
      "id": "CVE-2026-45736",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-45736 is a false positive for @nuxt/webpack-builder 4.0.3-tuxcare.2. false_positive \u2014 CVE-2026-45736 is a wrong-project match. The advisory concerns the 'ws' WebSocket library for Node.js, but the target repository is Nuxt.js framework. The ws library's source code (specifically lib/sender.js containing the vulnerable WebSocket close implementation) does not exist anywhere in this repository. While ws appears as a transitive dependency in pnpm-lock.yaml, no ws source code is pre..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7e0b1064-076f-50fa-9405-52b0ca16a3d3",
      "id": "CVE-2026-46342",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-46342 affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6315f008-4879-584c-a589-70de58fb4dc1",
      "id": "CVE-2026-47200",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47200 affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8e36fba6-8921-51d7-be8c-bd328aa342af",
      "id": "CVE-2026-49993",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49993 affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1b23c871-0a00-5e54-b111-3e6eba501708",
      "id": "CVE-2026-53721",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53721 affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f837134c-d1ab-54cf-beb4-e7a00a0ab3b8",
      "id": "CVE-2026-53722",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53722 affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:65581bd9-22d0-5692-a411-1b36b69ca137",
      "id": "CVE-2026-56326",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56326 affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e969e7e4-ae5c-5f7b-ab91-db29360df638",
      "id": "GHSA-534h-c3cw-v3h9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-534h-c3cw-v3h9 affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c89488cd-83a7-5658-a6cd-262754fceb26",
      "id": "GHSA-c9cv-mq2m-ppp3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2e6aac3f-9556-58c8-990b-97345c9abd6a",
      "id": "GHSA-m3q2-p4fw-w38m",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c5a396a5-0314-590e-b984-7da563b4a4c2",
      "id": "GHSA-rq7w-g337-39qq",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-rq7w-g337-39qq affects version 4.0.3-tuxcare.2 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40nuxt/webpack-builder@4.0.3-tuxcare.2"
    }
  ]
}