{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:025c7d9d-9820-5d55-9a63-dcb6e617ff04", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxt@3.2.0-tuxcare.3", "type": "library", "name": "nuxt", "version": "3.2.0-tuxcare.3", "purl": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:75cce805-5f98-53aa-bb42-8e8401ea2c21", "id": "CVE-2016-10735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-10735 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:418cd21a-934c-528a-b433-9800b5994c5d", "id": "CVE-2018-14040", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14040 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3ea48229-743b-5d43-ab4c-34a285401170", "id": "CVE-2018-14042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14042 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:63b2da75-e8e3-5613-96ca-54e53d40f5a9", "id": "CVE-2018-16487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-16487 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e61e8182-4af7-5eed-a4af-bafe7a065d0e", "id": "CVE-2018-20676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20676 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d9eb51fc-dd37-5584-83c9-4785c33c3717", "id": "CVE-2018-20677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20677 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7858fbde-d661-536b-a94a-5fd842ec1610", "id": "CVE-2018-3721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-3721 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9f6b04f7-edb8-5d28-ab8c-949f741298c3", "id": "CVE-2019-10744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10744 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:13c2f939-1464-549e-89a9-e0d814376d68", "id": "CVE-2019-14862", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-14862 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b27950ca-fa75-5599-ba3a-01834c5967da", "id": "CVE-2019-8331", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-8331 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e775dea3-1fa6-595f-9d57-0555f91e4e76", "id": "CVE-2020-36049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-36049 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9a3c5310-b02b-592b-b237-d5fb8a9b17ee", "id": "CVE-2020-8203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-8203 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d8605dd0-3fd8-5d63-931d-5b7d2efe54cb", "id": "CVE-2021-23337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23337 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bf2fc4d6-2de4-5bdf-b9ee-372b1db285de", "id": "CVE-2022-2421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2421 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:769c5501-08c1-5752-ad2e-b158f9fd121d", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4d98265f-75cc-5177-a273-03d9b1cc884b", "id": "CVE-2023-32695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-32695 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2633dd1a-0f83-5060-90bb-0d4db3734c4a", "id": "CVE-2024-34343", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34343 affects version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9a2c952f-2807-5774-810e-64e70d536770", "id": "CVE-2024-6484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6484 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a5dd5997-e46e-59fb-8e05-8559de2b22b9", "id": "CVE-2024-6485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6485 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:39ce3c97-a90b-543a-948e-860d400a0046", "id": "CVE-2025-24361", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24361 affects version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:20f374b6-77d6-57e5-84e3-400abbb5451a", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6cc8864f-e4af-577b-b5b5-ae1227b70c73", "id": "CVE-2026-33151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33151 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2fb52cff-9c1b-55b2-90dc-7a3df6753d23", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d8a5e15b-1951-5255-bc34-e8608afd55b7", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 3.2.0-tuxcare.3. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (IPv6/IPv4 address parsing), but this repository is Nuxt v3.2.0-tuxcare.1 (a Vue.js meta-framework). The affected component is not present in this repository as a vendored copy, dependency, or in any other form. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:71df5048-e997-5fc3-ad66-3cae46fab562", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:696d9551-89d7-58af-bbe6-9b7ecdfebe82", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d424ba4c-f80f-5bef-803d-f35d5b840f2e", "id": "CVE-2026-47200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 3.2.0-tuxcare.3 of nuxt. not_affected \u2014 Nuxt version 3.2.0 does not contain the server-only pages feature that is the prerequisite for CVE-2026-47200. The vulnerable code pattern (`.server.vue` pages rendered as islands via `/__nuxt_island/page_*` endpoint) was introduced in Nuxt v3.11.0, which is 2,059 commits after v3.2.0. The target version predates the feature by multiple major versions." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9fdecc28-d45e-5a81-a023-28a4814b9565", "id": "CVE-2026-4800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-4800 is fixed in version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:07a31433-1cab-5f65-98d8-58d7cd5f3a52", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.2.0-tuxcare.3 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a3deda5f-1fc2-582c-ab54-2c801cd8fad4", "id": "CVE-2026-56326", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 3.2.0-tuxcare.3 of nuxt. not_affected \u2014 Version 3.2.0 does not contain the vulnerable code pattern. The vulnerability exists in the encodeURL() function which was introduced on June 26, 2024, over a year after version 3.2.0 (released February 9, 2023). The target uses a simpler redirect architecture without the vulnerable encodeURL() function." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:123d08e3-c95b-5d3e-b870-d9bb59b0f35b", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 3.2.0-tuxcare.3 of nuxt. not_affected \u2014 Target repository Nuxt version 3.2.0 is NOT affected by GHSA-c9cv-mq2m-ppp3. All three vulnerability sinks described in the CVE (SSR open redirect via path-normalization, script execution via navigateTo open option, and protocol-relative bypass in reloadNuxtApp) require code features that were introduced AFTER version 3.2.0. The vulnerable encodeURL function with WHATWG URL parsing was added in..." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f0c11a66-8745-54de-aab6-8997012f3da2", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.2.0-tuxcare.3 of nuxt. not_affected \u2014 Version 3.2.0 is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerable innerHTML pattern was introduced in v3.16.0 (March 2025), two years after this version. The target uses noscript.children instead of the vulnerable noscript.innerHTML assignment." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.3" } ] }