{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fcef404b-440b-5d4f-945c-e68737e5a0c6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "fastify", "purl": "pkg:npm/fastify@5.8.5-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/fastify@5.8.5-tuxcare.2", "version": "5.8.5-tuxcare.2", "pedigree": { "ancestors": [ { "name": "fastify", "purl": "pkg:npm/fastify@5.8.5", "type": "library", "version": "5.8.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-3711", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:09be9b85-193e-56f0-ad64-21b9c4c0de78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-3711 affects version 5.8.5-tuxcare.2 of fastify." } }, { "id": "CVE-2020-8192", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:a1be5082-9555-5361-8752-8ef2ca365749", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-8192 affects version 5.8.5-tuxcare.2 of fastify." } }, { "id": "CVE-2022-39288", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:3576b47f-46ed-5c39-8646-76b4c107572e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-39288 affects version 5.8.5-tuxcare.2 of fastify." } }, { "id": "CVE-2022-41919", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:40ae8139-66ad-5e42-b3e8-eb47107e79b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-41919 affects version 5.8.5-tuxcare.2 of fastify." } }, { "id": "CVE-2025-32442", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:bc342218-17a3-5e3d-be7d-d338460ac907", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-32442 affects version 5.8.5-tuxcare.2 of fastify." } }, { "id": "CVE-2026-107832", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:3c83cc12-9893-5f79-ac9a-f3aa9155d18f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107832 affects version 5.8.5-tuxcare.2 of fastify." } }, { "id": "CVE-2026-120216", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:a72cffec-54c6-59b4-a4f2-1cdcd6ec4c92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-120216 affects version 5.8.5-tuxcare.2 of fastify." } }, { "id": "CVE-2026-16732", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:ac5f8128-6cc3-5d53-9834-6fc9998a34ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-16732 affects version 5.8.5-tuxcare.2 of fastify." } }, { "id": "CVE-2026-18504", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:422c5403-a25e-505b-8731-18dc92ab4c64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18504 affects version 5.8.5-tuxcare.2 of fastify." } }, { "id": "CVE-2026-25223", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:fe86dc52-5d1a-5cb2-b364-eeeec4432d1e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25223 does not affect version 5.8.5-tuxcare.2 of fastify. not_affected \u2014 Target (fastify 5.8.5) already contains the upstream fix 32d7b6ad (\"Updated content-type header parsing\"), which is an ancestor of HEAD. A Content-Type like \"application/json\\ta\" is now rejected with 415 FST_ERR_CTP_INVALID_MEDIA_TYPE before the body is parsed or validated, so the validation-schema bypass cannot occur. The fix shipped in the upstream release; the repo has no TuxCare-domain comm...", "justification": "code_not_present" } }, { "id": "CVE-2026-25224", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:0877b913-8609-5077-9534-9aacc0def1b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25224 does not affect version 5.8.5-tuxcare.2 of fastify. not_affected \u2014 Fastify 5.8.5 already contains the upstream fix for CVE-2026-25224 (fixed in 5.7.3). sendWebStream in lib/reply.js honours backpressure: it stops reading when res.write() returns false and resumes on 'drain'. The fix is commit eb11156, authored upstream by Matteo Collina. It is an ancestor of the 5.8.5 release commit, so it shipped in the upstream release.", "justification": "code_not_present" } }, { "id": "CVE-2026-33806", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:f502c39f-0c82-5e80-9d27-a43aeb4a2a30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33806 affects version 5.8.5-tuxcare.2 of fastify." } }, { "id": "CVE-2026-3419", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:09e893a2-9b7e-5e46-80a5-0117e64bcb74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3419 affects version 5.8.5-tuxcare.2 of fastify." } }, { "id": "CVE-2026-3635", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:ea2b4196-719b-55fe-a566-a6335d666a63", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3635 does not affect version 5.8.5-tuxcare.2 of fastify. not_affected \u2014 Target fastify 5.8.5 already contains the upstream fix for CVE-2026-3635 (commit 4e1db5bd, \"gate host and protocol getters on proxy trust function\"). In lib/request.js the host and protocol getters honor X-Forwarded-Host and X-Forwarded-Proto only when the socket's remote address passes the trustProxy function. The fix shipped in the upstream release, and HEAD has no TuxCare-domain commit.", "justification": "code_not_present" } }, { "id": "CVE-2026-76169", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:81f46c3a-e28d-5fd1-97fd-f74439725604", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-76169 is fixed in version 5.8.5-tuxcare.2 of fastify." } }, { "id": "CVE-2026-84428", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:810958df-c0b3-5116-9ac8-c63f9cd84137", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84428 is fixed in version 5.8.5-tuxcare.2 of fastify." } }, { "id": "CVE-2026-84469", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:66e557b5-07c6-59bb-9617-88d140d7c088", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84469 affects version 5.8.5-tuxcare.2 of fastify." } }, { "id": "CVE-2026-84504", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:ddded56b-b16d-518d-b019-a2bb0e9d8c94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84504 is fixed in version 5.8.5-tuxcare.2 of fastify." } }, { "id": "CVE-2026-92081", "affects": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:65c3ec1d-24b3-5cc2-9b99-16080b92cd19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-92081 is fixed in version 5.8.5-tuxcare.2 of fastify." } } ], "dependencies": [ { "ref": "pkg:npm/fastify@5.8.5-tuxcare.2" } ] }