{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bfb78379-bf8a-5394-a731-bc8a765ad24e",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/jsonwebtoken@8.5.1-tuxcare.2",
      "type": "library",
      "name": "jsonwebtoken",
      "version": "8.5.1-tuxcare.2",
      "purl": "pkg:npm/jsonwebtoken@8.5.1-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:74819cb0-7adf-532f-9251-d8768cbd9eaf",
      "id": "CVE-2022-23529",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-23529 is a false positive for jsonwebtoken 8.5.1-tuxcare.2."
      },
      "affects": [
        {
          "ref": "pkg:npm/jsonwebtoken@8.5.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e28ab3e4-4d07-5d0b-a914-e26734b79b5f",
      "id": "CVE-2022-23539",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-23539 is fixed in version 8.5.1-tuxcare.2 of jsonwebtoken."
      },
      "affects": [
        {
          "ref": "pkg:npm/jsonwebtoken@8.5.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e73ca547-d96f-5a61-aa8e-e58886bc933a",
      "id": "CVE-2022-23540",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-23540 is fixed in version 8.5.1-tuxcare.2 of jsonwebtoken."
      },
      "affects": [
        {
          "ref": "pkg:npm/jsonwebtoken@8.5.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c6dbdaf5-a0f6-5c8c-b15d-13b4678a86b0",
      "id": "CVE-2022-23541",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-23541 is fixed in version 8.5.1-tuxcare.2 of jsonwebtoken."
      },
      "affects": [
        {
          "ref": "pkg:npm/jsonwebtoken@8.5.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9063a85e-d36f-5698-a1a7-2d36997ef7fc",
      "id": "CVE-2026-25537",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-25537 is a false positive for jsonwebtoken 8.5.1-tuxcare.2. false_positive \u2014 This is a wrong-project match. CVE-2026-25537 concerns the Rust jsonwebtoken library (github.com/Keats/jsonwebtoken), but the target repository is a JavaScript/Node.js jsonwebtoken library. These are two completely different implementations that share the same name but have unrelated codebases. No Rust code exists in the target repository, and the JavaScript implementation does not exhibit the ..."
      },
      "affects": [
        {
          "ref": "pkg:npm/jsonwebtoken@8.5.1-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/jsonwebtoken@8.5.1-tuxcare.2"
    }
  ]
}