{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:68349268-4cc7-5c3b-8c16-71c0360b0b0c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxt@3.2.0-tuxcare.2", "type": "library", "name": "nuxt", "version": "3.2.0-tuxcare.2", "purl": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e5a4d42a-d35f-564b-9a74-21cff5037a87", "id": "CVE-2016-10735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-10735 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e144be55-b3d7-5c6f-b32a-b8d633704345", "id": "CVE-2018-14040", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14040 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:223c46e7-322f-563c-b1b9-036d457a9fff", "id": "CVE-2018-14042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14042 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f21bc7f6-cac8-58a2-bd3d-8d4154c6fcee", "id": "CVE-2018-16487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-16487 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:643730b6-7cf7-5322-9871-13af37a4bf66", "id": "CVE-2018-20676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20676 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2d59d78e-e25e-569a-b818-4d324b080f8f", "id": "CVE-2018-20677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20677 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0c801103-2487-5c21-bc00-a474bf9d8da4", "id": "CVE-2018-3721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-3721 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:766efb3f-4644-50d4-ae74-f42a1ed29d6f", "id": "CVE-2019-10744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10744 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5a18f9aa-4dc4-5a29-b361-82bcb98a4080", "id": "CVE-2019-14862", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-14862 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:276bb1f5-dc66-5026-a0e8-97c091d5dbc1", "id": "CVE-2019-8331", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-8331 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:13752086-b2b8-5497-8af0-1db956af8b9d", "id": "CVE-2020-36049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-36049 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f3f5479b-b2cf-5c41-82a4-499294de0eb7", "id": "CVE-2020-8203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-8203 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1eae38ed-f2b8-594e-ae17-00a40da70eca", "id": "CVE-2021-23337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23337 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dbaa0dbb-e91b-5643-aef8-31f4f5bc50cb", "id": "CVE-2022-2421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2421 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:95b725b6-6a2d-5004-85e4-dffe6f8625e8", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:00bf14e5-31e2-5a33-922e-10adad4176e0", "id": "CVE-2023-32695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-32695 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:20752adc-f622-5583-8571-3265bd4b3514", "id": "CVE-2024-34343", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34343 affects version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6fc0cdf2-1221-51af-b256-3f21b47c04d5", "id": "CVE-2024-6484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6484 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b2ff0c12-37f7-57df-b66c-bd258b6b7134", "id": "CVE-2024-6485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6485 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:334643fe-2fc1-5fe3-9e92-0f4d2aec445f", "id": "CVE-2025-24361", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24361 affects version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:acf5fcda-c394-59d7-b71f-4f429e6b39ca", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:220bbfbd-bf17-50db-bd0e-5829b2a50624", "id": "CVE-2026-33151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33151 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f49da43e-bc08-5ac9-89e2-c74401aba5b7", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:13a5dad6-911c-5c06-8fa2-cd6d3f3d0b6c", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 3.2.0-tuxcare.2. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (IPv6/IPv4 address parsing), but this repository is Nuxt v3.2.0-tuxcare.1 (a Vue.js meta-framework). The affected component is not present in this repository as a vendored copy, dependency, or in any other form. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a7c12ae9-eff2-54a7-afe4-633d66d0a9d7", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f8ec7c95-da47-57d7-9f7e-ad8b2667615c", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:148c523e-f5fc-51cb-ab8c-ee19656e0aa8", "id": "CVE-2026-47200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 3.2.0-tuxcare.2 of nuxt. not_affected \u2014 Nuxt version 3.2.0 does not contain the server-only pages feature that is the prerequisite for CVE-2026-47200. The vulnerable code pattern (`.server.vue` pages rendered as islands via `/__nuxt_island/page_*` endpoint) was introduced in Nuxt v3.11.0, which is 2,059 commits after v3.2.0. The target version predates the feature by multiple major versions." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b5be5501-538d-5683-a33e-5d89dafd1a78", "id": "CVE-2026-4800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-4800 is fixed in version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7d6fbf18-21ef-5d97-8c2c-42b52d705d17", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.2.0-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7e0e1192-3725-5c38-a950-3928c60d3b16", "id": "CVE-2026-56326", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 3.2.0-tuxcare.2 of nuxt. not_affected \u2014 Version 3.2.0 does not contain the vulnerable code pattern. The vulnerability exists in the encodeURL() function which was introduced on June 26, 2024, over a year after version 3.2.0 (released February 9, 2023). The target uses a simpler redirect architecture without the vulnerable encodeURL() function." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ba1d0100-5a1a-5321-a8c2-718127aad034", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 3.2.0-tuxcare.2 of nuxt. not_affected \u2014 Target repository Nuxt version 3.2.0 is NOT affected by GHSA-c9cv-mq2m-ppp3. All three vulnerability sinks described in the CVE (SSR open redirect via path-normalization, script execution via navigateTo open option, and protocol-relative bypass in reloadNuxtApp) require code features that were introduced AFTER version 3.2.0. The vulnerable encodeURL function with WHATWG URL parsing was added in..." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4d372b54-af68-5308-9c5e-4054fc048335", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.2.0-tuxcare.2 of nuxt. not_affected \u2014 Version 3.2.0 is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerable innerHTML pattern was introduced in v3.16.0 (March 2025), two years after this version. The target uses noscript.children instead of the vulnerable noscript.innerHTML assignment." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.2" } ] }