{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:79c394d2-3828-5a79-ae38-66241be60ffb", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxt@3.2.0-tuxcare.1", "type": "library", "name": "nuxt", "version": "3.2.0-tuxcare.1", "purl": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c5d3e233-9c25-5dde-a321-1f7e3219ca31", "id": "CVE-2016-10735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-10735 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e3613faf-2d05-5dde-976e-02aca1ba4734", "id": "CVE-2018-14040", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14040 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:11e6706b-da30-5d20-a95d-7addf760f9c9", "id": "CVE-2018-14042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14042 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d4f6d4ac-a866-52bd-9659-523804f0e4e4", "id": "CVE-2018-16487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-16487 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5b9c03d9-82ff-56d7-91c2-a2d2037174aa", "id": "CVE-2018-20676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20676 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:416a92af-2e1d-5927-96d4-193146d3f9a9", "id": "CVE-2018-20677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20677 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3642bb72-f412-5c15-8ccf-63c606da7428", "id": "CVE-2018-3721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-3721 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:906e69ef-a154-55a2-839c-42644a3cbcc3", "id": "CVE-2019-10744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10744 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1bf051ec-dd68-50c1-ae49-78d02bf142f6", "id": "CVE-2019-14862", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-14862 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:147cdae2-35e9-5779-b660-0b711890126f", "id": "CVE-2019-8331", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-8331 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d404e116-e4f4-5edd-bdd8-e7248661b0f0", "id": "CVE-2020-36049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-36049 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:51515254-acaa-51b2-82f4-72481ebda80f", "id": "CVE-2020-8203", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-8203 affects version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6dd61b79-6ae5-54c4-a432-95e5d18dced1", "id": "CVE-2021-23337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23337 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b0c0c681-77aa-521d-a409-b866ae17b709", "id": "CVE-2022-2421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2421 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:39e437fe-b56a-5403-97be-c98127be89a3", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:03de0584-812e-53a8-a911-e70c37da6225", "id": "CVE-2023-32695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-32695 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:18df1d29-dbda-5f0b-bb1a-429558c5eea6", "id": "CVE-2024-34343", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34343 affects version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fd218a2c-bf30-50e5-a3ab-1ad89e7be52b", "id": "CVE-2024-6484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6484 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:99986fad-d87e-5cff-b2da-5ab2eb708fcf", "id": "CVE-2024-6485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6485 is fixed in version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4a667aa7-49df-5750-8ec2-5311dac44e92", "id": "CVE-2025-24361", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24361 affects version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9e2516f9-5728-59ea-85cc-c501e92ef2b2", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:22c6e45c-fc32-5c11-a64f-fbf83d1cef56", "id": "CVE-2026-33151", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33151 affects version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4d9edf89-762a-5e8c-ba03-5e6fdb0b135f", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3b8649a3-70f6-5074-882a-1c2a09792097", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 3.2.0-tuxcare.1. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (IPv6/IPv4 address parsing), but this repository is Nuxt v3.2.0-tuxcare.1 (a Vue.js meta-framework). The affected component is not present in this repository as a vendored copy, dependency, or in any other form. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f9abe320-0857-570a-a93a-27c84b099493", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b3a1daca-0ef3-57b6-ba16-73adf05f713d", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f24475bf-9659-56bf-bd51-61c97cb1eec1", "id": "CVE-2026-47200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 3.2.0-tuxcare.1 of nuxt. not_affected \u2014 Nuxt version 3.2.0 does not contain the server-only pages feature that is the prerequisite for CVE-2026-47200. The vulnerable code pattern (`.server.vue` pages rendered as islands via `/__nuxt_island/page_*` endpoint) was introduced in Nuxt v3.11.0, which is 2,059 commits after v3.2.0. The target version predates the feature by multiple major versions." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:97b79339-3338-569a-872d-1cd77c9cd984", "id": "CVE-2026-4800", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-4800 affects version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:226aa3a3-7111-55bf-b8a7-91fa7c0b153e", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.2.0-tuxcare.1 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:605a3f90-3a29-5bfa-91ab-0d3a73586622", "id": "CVE-2026-56326", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 3.2.0-tuxcare.1 of nuxt. not_affected \u2014 Version 3.2.0 does not contain the vulnerable code pattern. The vulnerability exists in the encodeURL() function which was introduced on June 26, 2024, over a year after version 3.2.0 (released February 9, 2023). The target uses a simpler redirect architecture without the vulnerable encodeURL() function." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:031af350-10bc-53f0-8a61-dd1f03f34ff3", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 3.2.0-tuxcare.1 of nuxt. not_affected \u2014 Target repository Nuxt version 3.2.0 is NOT affected by GHSA-c9cv-mq2m-ppp3. All three vulnerability sinks described in the CVE (SSR open redirect via path-normalization, script execution via navigateTo open option, and protocol-relative bypass in reloadNuxtApp) require code features that were introduced AFTER version 3.2.0. The vulnerable encodeURL function with WHATWG URL parsing was added in..." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a46b1712-931e-552b-b4b5-897d80a05e31", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.2.0-tuxcare.1 of nuxt. not_affected \u2014 Version 3.2.0 is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerable innerHTML pattern was introduced in v3.16.0 (March 2025), two years after this version. The target uses noscript.children instead of the vulnerable noscript.innerHTML assignment." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.1" } ] }