{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c41e841b-3368-5f71-b0aa-16fd12e15464",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "fastify",
      "purl": "pkg:npm/fastify@4.25.2-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/fastify@4.25.2-tuxcare.1",
      "version": "4.25.2-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "fastify",
            "purl": "pkg:npm/fastify@4.25.2",
            "type": "library",
            "version": "4.25.2"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-3711",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:71a59023-9bb2-5c80-827f-49a9de815866",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-3711 affects version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2020-8192",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:04643f0d-be86-5ff2-8ad4-2dddc88608fc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-8192 affects version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2022-39288",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:13714e17-f8e9-528a-bc4e-387f7fb55081",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-39288 affects version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2022-41919",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cb7e4ac1-f6e8-5710-9804-a105416d43be",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-41919 affects version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2025-32442",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4c8ce70f-c4af-532c-9e18-d1f9c0e7aafb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-32442 affects version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-107832",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:99dda2b3-ff32-58f0-a888-93d8e6d51288",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-107832 affects version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-120216",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3983532b-3dde-56ad-9328-2998ea07f4df",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-120216 affects version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-16732",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a94cc96a-d1a7-5c85-b9b2-2be417cb8b29",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-16732 affects version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-18504",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e2a7c44b-6701-5996-9c96-c21ea5bec53d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-18504 is fixed in version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-25223",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6754f3f8-a439-552a-83da-f8b438257abf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-25223 does not affect version 4.25.2-tuxcare.1 of fastify. not_affected \u2014 Fastify 4.25.2 has no Content-Type-discriminated request-body schemas. schema.body is compiled as a single validator and applied to every parsed body, so a tab-suffixed Content-Type cannot skip validation. The CVE affects the v5 content-keyed body-schema feature, which is absent here.",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-25224",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:984c2495-c5d5-58be-a787-e4f73bc55c5a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-25224 does not affect version 4.25.2-tuxcare.1 of fastify. not_affected \u2014 Fastify 4.25.2 has no Web Stream (ReadableStream / fetch Response) reply handling. CVE-2026-25224 is in that 5.x-only feature, so the vulnerable code does not exist in this target. Node streams are sent with payload.pipe(res), which honors backpressure.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-33806",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b311fe88-6ff7-512d-905b-358cc60a85ca",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33806 affects version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-3419",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ae1ecf3c-d156-571d-97a1-d76625e38ef6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-3419 affects version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-3635",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:761e7add-3214-5fb0-80d5-f271640cf6f6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-3635 affects version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-76169",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fb50329d-0455-594c-afb6-17c76f265c00",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-76169 affects version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-84428",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f9e68448-f714-5722-a1ac-a662311278f2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-84428 affects version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-84469",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fecd7bcb-b556-5dd8-af96-05470a7416c3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-84469 is fixed in version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-84504",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7a3f41a4-79ca-5018-b425-68e2b92a3e43",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-84504 is fixed in version 4.25.2-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-92081",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ccf51d64-468f-588d-ae64-caad295e35fc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-92081 is fixed in version 4.25.2-tuxcare.1 of fastify."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/fastify@4.25.2-tuxcare.1"
    }
  ]
}