{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6b169381-6fc2-5ea9-822a-d18107f18141",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/node-fetch@1.6.3-tuxcare.1",
      "type": "library",
      "name": "node-fetch",
      "version": "1.6.3-tuxcare.1",
      "purl": "pkg:npm/node-fetch@1.6.3-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:9513a487-66cb-5af5-973d-57b32b018d5e",
      "id": "CVE-2020-15168",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-15168 does not affect version 1.6.3-tuxcare.1 of node-fetch. not_affected \u2014 node-fetch v1.6.3 is NOT affected by CVE-2020-15168. The vulnerability pattern present in v2.x (where size option was lost during redirects due to manual options object construction) does not exist in v1.x due to fundamental architectural differences. v1.6.3 passes the entire Request instance through redirects, preserving the size property via the Request constructor's explicit extraction logic..."
      },
      "affects": [
        {
          "ref": "pkg:npm/node-fetch@1.6.3-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a6174ef1-4222-5d54-9027-fee2ddc2f990",
      "id": "CVE-2022-0235",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-0235 is fixed in version 1.6.3-tuxcare.1 of node-fetch."
      },
      "affects": [
        {
          "ref": "pkg:npm/node-fetch@1.6.3-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/node-fetch@1.6.3-tuxcare.1"
    }
  ]
}