{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3583b5d8-24db-5ec0-8021-56c67b0d8096",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/qs@1.0.2-tuxcare.1",
      "type": "library",
      "name": "qs",
      "version": "1.0.2-tuxcare.1",
      "purl": "pkg:npm/qs@1.0.2-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:1f95497f-9221-56e7-bf75-cc3d100d80d1",
      "id": "CVE-2017-1000048",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-1000048 does not affect version 1.0.2-tuxcare.1 of qs. already_fixed \u2014 CVE-2017-1000048 has already been fixed in this repository. TuxCare commit 87a4daf (Dec 25, 2025) backported the prototype pollution protections, and all defense mechanisms are present in the current code at HEAD 614c63d."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2b07fac4-db09-5775-8078-d8411a05c77e",
      "id": "CVE-2017-20165",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2017-20165 is fixed in version 1.0.2-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:45000f67-dc47-5330-93ad-52a5feb4a272",
      "id": "CVE-2022-24999",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-24999 does not affect version 1.0.2-tuxcare.1 of qs. already_fixed \u2014 The target repository (qs version 1.0.2-tuxcare.1) already contains the fix for CVE-2022-24999. The vulnerability was addressed in commit 72fc431 on 2025-12-24, which added the '__proto__' key filtering defense to lib/parse.js at line 67. This fix prevents prototype pollution attacks by explicitly rejecting property assignments when the parsed key equals '__proto__'."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:adabf95c-c249-5f73-a773-e3972646cf91",
      "id": "CVE-2025-15284",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-15284 affects version 1.0.2-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:36ec323b-376a-5667-ae0c-2166f5f3cde6",
      "id": "CVE-2025-7339",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-7339 is fixed in version 1.0.2-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4d2c260d-dc92-5e90-afd9-13a03fa8e4a9",
      "id": "CVE-2026-2391",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-2391 does not affect version 1.0.2-tuxcare.1 of qs. not_affected \u2014 Target version 1.0.2 is not affected by CVE-2026-2391. The vulnerability requires the comma-parsing feature (enabled via `comma: true` option), which does not exist in this version. Version 1.0.2 uses a simple parsing architecture that lacks configurable options and only splits on '&' to separate parameters. Comma-separated values within a single parameter remain as strings and are not parsed i..."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d271d616-cfd1-51c2-a850-d59d8c446eee",
      "id": "CVE-2026-24001",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24001 is fixed in version 1.0.2-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e5298d3b-600b-5553-84c5-8f9de8639081",
      "id": "CVE-2026-8723",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8723 does not affect version 1.0.2-tuxcare.1 of qs. not_affected \u2014 Target version 1.0.2 is not affected by CVE-2026-8723. The vulnerability requires the arrayFormat: 'comma' and encodeValuesOnly: true options, which do not exist in v1.0.2. The vulnerable code pattern (utils.maybeMap calling an unguarded encoder) was introduced in v6.11.1, approximately 5 major versions after 1.0.2. The target uses a fundamentally different architecture with explicit null handl..."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:938f9ecf-7a52-547c-900b-ce59c653c381",
      "id": "GHSA-h6ch-v84p-w6p9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-h6ch-v84p-w6p9 is fixed in version 1.0.2-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@1.0.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8463728c-5d89-5446-974c-acc1c5e30792",
      "id": "fix-CVE-2021-3803",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability fix-CVE-2021-3803 is fixed in version 1.0.2-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@1.0.2-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/qs@1.0.2-tuxcare.1"
    }
  ]
}