{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7af01c98-5a3f-50d5-a864-aaceec93a1b7",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/happy-dom@14.12.3-tuxcare.1",
      "type": "library",
      "name": "happy-dom",
      "version": "14.12.3-tuxcare.1",
      "purl": "pkg:npm/happy-dom@14.12.3-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:e7b1c272-1dc7-5766-aba8-92dd43086f69",
      "id": "CVE-2026-33943",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-33943 does not affect version 14.12.3-tuxcare.1 of happy-dom. not_affected \u2014 Target version 14.12.3 predates the introduction of the vulnerable ECMAScript module compilation feature. The ECMAScriptModuleCompiler component that contains the vulnerability was introduced in v17.0.0, while the target is v14.12.3. The vulnerability pattern cannot manifest because the code path required to process ES module export declarations does not exist in this version."
      },
      "affects": [
        {
          "ref": "pkg:npm/happy-dom@14.12.3-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/happy-dom@14.12.3-tuxcare.1"
    }
  ]
}