{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c018535d-4984-5b9d-bd88-02d401c9ce9a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "fastify", "purl": "pkg:npm/fastify@5.8.2-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/fastify@5.8.2-tuxcare.1", "version": "5.8.2-tuxcare.1", "pedigree": { "ancestors": [ { "name": "fastify", "purl": "pkg:npm/fastify@5.8.2", "type": "library", "version": "5.8.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-3711", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:9ba82342-fe31-5b4a-9e48-0c79dbae2d13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-3711 affects version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2020-8192", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:82ff7ac5-b62e-55e3-a5fa-3412a58a12e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-8192 affects version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2022-39288", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:00f91df4-1fdf-56f4-a0fa-7fc827aa21b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-39288 affects version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2022-41919", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:7b0cebe8-7ddb-5974-844b-e4f941862e8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-41919 affects version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2025-32442", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:e89ecb31-c0a7-5564-b455-5ef0b229409c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-32442 affects version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2026-107832", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:a3580ae0-e588-5e5d-9f30-fc81b142d83b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107832 affects version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2026-120216", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:87d7ef23-c1d3-5b8d-ac40-49998a2d936b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-120216 affects version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2026-16732", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:d9262634-9512-523f-acd1-d282ef4bfc0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-16732 affects version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2026-18504", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:6df9d45d-da3a-5c3e-998d-9751d99787f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18504 affects version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2026-25223", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:fce03264-48f2-5089-a0ad-855b2856fbbc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25223 does not affect version 5.8.2-tuxcare.1 of fastify. not_affected \u2014 Target fastify 5.8.2 already contains the upstream fix. Commit 32d7b6ad (\"chore: Updated content-type header parsing (#6414)\") is an ancestor of HEAD and of the upstream \"Bumped v5.8.2\" commit. It adds a strict ContentType parser, and a header like \"application/jsona\" is now rejected with 415 instead of being parsed as JSON while skipping schema lookup.", "justification": "code_not_present" } }, { "id": "CVE-2026-25224", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:5549b3af-df11-5767-90d4-d6992b7d9802", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25224 does not affect version 5.8.2-tuxcare.1 of fastify. not_affected \u2014 The upstream fix (eb111563, \"Merge commit from fork\") is already in the 5.8.2 release this target is built on. sendWebStream in lib/reply.js writes each chunk to the socket and stops reading the stream when res.write() returns false, resuming only on 'drain'. A slow client therefore cannot cause unbounded buffering.", "justification": "code_not_present" } }, { "id": "CVE-2026-33806", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:11bb9e3d-44a2-5ace-a2bd-60d6519f1f23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33806 affects version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2026-3419", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:6d2d1fa8-d821-5284-b606-e46e1178064c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3419 affects version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2026-3635", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:63062bfb-3301-5007-a400-a6bdbb8a8dcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-3635 is fixed in version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2026-76169", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:1f4f6bdf-3130-5fd4-a6d0-b170a08fdc6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-76169 affects version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2026-84428", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:2f62161c-4051-5656-860d-8c2bc6495a2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84428 affects version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2026-84469", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:d64ff0e3-5ae0-5485-8416-562afbb059a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84469 affects version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2026-84504", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:b70eabb1-fc27-5ca0-ab0e-893b7cc2f16e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84504 affects version 5.8.2-tuxcare.1 of fastify." } }, { "id": "CVE-2026-92081", "affects": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ], "bom-ref": "urn:uuid:a9834ef3-dc25-59ef-a2db-ff4cc1ed6fac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-92081 affects version 5.8.2-tuxcare.1 of fastify." } } ], "dependencies": [ { "ref": "pkg:npm/fastify@5.8.2-tuxcare.1" } ] }