{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:705f258e-a099-51ca-8fa0-d1034f4700fa",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/qs@0.5.1-tuxcare.1",
      "type": "library",
      "name": "qs",
      "version": "0.5.1-tuxcare.1",
      "purl": "pkg:npm/qs@0.5.1-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:050ee1a2-7e92-5f87-8d90-436db52ee155",
      "id": "CVE-2014-10064",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2014-10064 is fixed in version 0.5.1-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.5.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d92a69d9-93c4-5054-bfbf-2f64820e5601",
      "id": "CVE-2014-7191",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2014-7191 is fixed in version 0.5.1-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.5.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2cf2a6c6-7ad8-5910-b64e-9c882dad74c2",
      "id": "CVE-2017-1000048",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2017-1000048 is fixed in version 0.5.1-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.5.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d12b61a1-b851-569d-9ba9-6408eace76b5",
      "id": "CVE-2022-24999",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-24999 is fixed in version 0.5.1-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.5.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:685b7828-a85a-5a8d-aa97-4831ced3c892",
      "id": "CVE-2022-46175",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-46175 is fixed in version 0.5.1-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.5.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:99559a40-aa99-5737-a337-0fdc99a768f2",
      "id": "CVE-2025-15284",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-15284 is fixed in version 0.5.1-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.5.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d2779964-c02c-569d-8d47-171467e83b23",
      "id": "CVE-2026-2391",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-2391 does not affect version 0.5.1-tuxcare.1 of qs. not_affected \u2014 Version 0.5.1 does not support comma-parsing of query string values. The vulnerability requires the 'comma: true' option, which was introduced in qs v6.7.0 (September 2018), approximately 6 years after this version. The comma-parsing feature and the vulnerable code path (lib/parse.js with comma-split logic) do not exist in this version's architecture."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.5.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:72fb09a1-dce3-53c2-a4ac-60bdc903df6f",
      "id": "CVE-2026-8723",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8723 does not affect version 0.5.1-tuxcare.1 of qs. not_affected \u2014 Version 0.5.1 is not affected by CVE-2026-8723. The vulnerability requires both arrayFormat='comma' and encodeValuesOnly=true options, neither of which exist in version 0.5.1. The vulnerable code path that maps arrays through an encoder was introduced in 2021 (commit 4c4b23d, first released in v6.11.1), well after version 0.5.1 was released. Runtime testing confirms that v0.5.1 safely handles n..."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.5.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:795e0ff7-7630-589c-9663-2c8fb1f79ff1",
      "id": "GHSA-crvj-3gj9-gm2p",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 0.5.1-tuxcare.1."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@0.5.1-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/qs@0.5.1-tuxcare.1"
    }
  ]
}