{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9a8d4a45-078e-5c0e-be41-e11539f47ed3",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/node-fetch@1.7.3-tuxcare.1",
      "type": "library",
      "name": "node-fetch",
      "version": "1.7.3-tuxcare.1",
      "purl": "pkg:npm/node-fetch@1.7.3-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:540d1763-43d7-59b4-ac56-126ff6031eaa",
      "id": "CVE-2020-15168",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-15168 does not affect version 1.7.3-tuxcare.1 of node-fetch. not_affected \u2014 node-fetch v1.7.3-tuxcare.2 is NOT AFFECTED by CVE-2020-15168. The vulnerability pattern that affected v2/v3 (omitting 'size' from explicitly constructed redirect options) does not apply to v1.7.3's architecture. v1.7.3 passes the entire Request object during redirects, and the Request constructor preserves the size limit via 'init.size' extraction (request.js:55). Size validation is enforced d..."
      },
      "affects": [
        {
          "ref": "pkg:npm/node-fetch@1.7.3-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:881f51bf-a5a2-50b5-9c87-0253340f3a98",
      "id": "CVE-2022-0235",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-0235 is fixed in version 1.7.3-tuxcare.1 of node-fetch."
      },
      "affects": [
        {
          "ref": "pkg:npm/node-fetch@1.7.3-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:517dced3-da02-55ac-a2cd-074b6b8eac3a",
      "id": "CVE-2026-13311",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-13311 is fixed in version 1.7.3-tuxcare.1 of node-fetch."
      },
      "affects": [
        {
          "ref": "pkg:npm/node-fetch@1.7.3-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:42772431-796b-5bcc-b89e-9cc364068dbe",
      "id": "CVE-2026-9277",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-9277 is fixed in version 1.7.3-tuxcare.1 of node-fetch."
      },
      "affects": [
        {
          "ref": "pkg:npm/node-fetch@1.7.3-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/node-fetch@1.7.3-tuxcare.1"
    }
  ]
}