{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7b60a7f5-0660-51c4-bd62-4fde4000a736",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/on-headers@1.0.2-tuxcare.1",
      "type": "library",
      "name": "on-headers",
      "version": "1.0.2-tuxcare.1",
      "purl": "pkg:npm/on-headers@1.0.2-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:a28bc8de-ac8c-5b6c-93bb-c5a14291673f",
      "id": "CVE-2017-1000048",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2017-1000048 is a false positive for on-headers 1.0.2-tuxcare.1. false_positive \u2014 CVE-2017-1000048 affects the 'qs' (query string parser) package, but this repository is 'on-headers' version 1.0.2, a completely different package for HTTP response header manipulation. The affected component (qs.parse and query string parsing functionality) is absent from the entire repository. This is a wrong-project match."
      },
      "affects": [
        {
          "ref": "pkg:npm/on-headers@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7ea2fd32-2943-5783-976c-8003ceadca0e",
      "id": "CVE-2017-20165",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2017-20165 is fixed in version 1.0.2-tuxcare.1 of on-headers."
      },
      "affects": [
        {
          "ref": "pkg:npm/on-headers@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f395a256-b4a2-5787-bb83-163866877387",
      "id": "CVE-2018-16487",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2018-16487 is a false positive for on-headers 1.0.2-tuxcare.1. false_positive \u2014 CVE-2018-16487 concerns lodash prototype pollution, but this repository is on-headers (a Node.js HTTP header utility). Lodash is not present as the project itself, as vendored code, or as a dependency. This is a wrong-project advisory match."
      },
      "affects": [
        {
          "ref": "pkg:npm/on-headers@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d86fbf93-2a2a-58be-83d9-4bf4053e157d",
      "id": "CVE-2018-3721",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2018-3721 is a false positive for on-headers 1.0.2-tuxcare.1. false_positive \u2014 CVE-2018-3721 concerns lodash prototype pollution, but target repository is on-headers (HTTP header listener library). Wrong-project match: lodash code is entirely absent from this repository."
      },
      "affects": [
        {
          "ref": "pkg:npm/on-headers@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f6729806-51bf-5c3f-b1bb-5430be4ffa49",
      "id": "CVE-2019-1010266",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2019-1010266 is a false positive for on-headers 1.0.2-tuxcare.1. false_positive \u2014 CVE-2019-1010266 concerns lodash's Date handler ReDoS vulnerability. The target repository is on-headers (version 1.0.2), a completely different Node.js package for HTTP header listener management. Exhaustive containment search found no lodash code, vendored copy, or dependency relationship. This is a wrong-project match."
      },
      "affects": [
        {
          "ref": "pkg:npm/on-headers@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6835a623-8e36-50c9-afc7-ee7b0b69e8e8",
      "id": "CVE-2019-10744",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2019-10744 is a false positive for on-headers 1.0.2-tuxcare.1. false_positive \u2014 CVE-2019-10744 concerns lodash's defaultsDeep prototype pollution vulnerability, but the target repository is on-headers v1.0.2, a completely different Node.js library for HTTP header event handling. The CVE was matched to the wrong project."
      },
      "affects": [
        {
          "ref": "pkg:npm/on-headers@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a5a7d111-d856-56f8-800a-75bc65585eb5",
      "id": "CVE-2020-28500",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2020-28500 is a false positive for on-headers 1.0.2-tuxcare.1. false_positive \u2014 CVE-2020-28500 concerns lodash (a JavaScript utility library) versions prior to 4.17.21, specifically ReDoS vulnerabilities in toNumber, trim, and trimEnd functions. The target repository is on-headers v1.0.2, a completely different Node.js package that provides HTTP header event handling. No relationship exists between the two projects - lodash is not vendored, not a dependency, and the vulner..."
      },
      "affects": [
        {
          "ref": "pkg:npm/on-headers@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:da36dbde-56e4-5189-9800-966a55437bb2",
      "id": "CVE-2021-23337",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2021-23337 is a false positive for on-headers 1.0.2-tuxcare.1. false_positive \u2014 CVE-2021-23337 is a wrong-project match. The advisory concerns the 'lodash' library's template function command injection vulnerability, but the target repository is 'on-headers' (version 1.0.2), a completely different Node.js package for HTTP header manipulation. Lodash is not present in the repository as the project itself, as vendored code, or as a dependency."
      },
      "affects": [
        {
          "ref": "pkg:npm/on-headers@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d073b81a-9c0e-507b-8693-2635f3d2eee0",
      "id": "CVE-2022-24999",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-24999 is a false positive for on-headers 1.0.2-tuxcare.1. false_positive \u2014 CVE-2022-24999 concerns the 'qs' query string parser library, but the target repository is 'on-headers', an HTTP response header listener utility. This is a wrong-project match - the affected component is completely absent from this repository."
      },
      "affects": [
        {
          "ref": "pkg:npm/on-headers@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b85e832d-2c58-5805-a620-61a7f45ced39",
      "id": "CVE-2025-7339",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-7339 is fixed in version 1.0.2-tuxcare.1 of on-headers."
      },
      "affects": [
        {
          "ref": "pkg:npm/on-headers@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f9e702aa-b41e-580c-ab6a-f3b5d806e734",
      "id": "CVE-2026-24001",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24001 is fixed in version 1.0.2-tuxcare.1 of on-headers."
      },
      "affects": [
        {
          "ref": "pkg:npm/on-headers@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:950ac9a3-8094-578c-bd83-657934b3a2a2",
      "id": "GHSA-h6ch-v84p-w6p9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-h6ch-v84p-w6p9 is fixed in version 1.0.2-tuxcare.1 of on-headers."
      },
      "affects": [
        {
          "ref": "pkg:npm/on-headers@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9e6c0653-0203-527d-92d9-8aac6580ed36",
      "id": "fix-CVE-2021-3803",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability fix-CVE-2021-3803 is fixed in version 1.0.2-tuxcare.1 of on-headers."
      },
      "affects": [
        {
          "ref": "pkg:npm/on-headers@1.0.2-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/on-headers@1.0.2-tuxcare.1"
    }
  ]
}