{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7af730e4-118a-5835-80b5-1323776c5f18",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/qs@6.5.5-tuxcare.1",
      "type": "library",
      "name": "qs",
      "version": "6.5.5-tuxcare.1",
      "purl": "pkg:npm/qs@6.5.5-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:d80a2ff0-b2e0-51c8-806a-861c8e5af091",
      "id": "CVE-2024-42459",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-42459 is fixed in version 6.5.5-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e1ddbdab-a378-5ae2-9fd0-3e9dce67678c",
      "id": "CVE-2024-42460",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-42460 is fixed in version 6.5.5-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:34915b03-e6cc-5d72-b842-60de161fd775",
      "id": "CVE-2024-42461",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-42461 is fixed in version 6.5.5-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:74e0cdf2-1015-5cd6-a925-a7fe02450a65",
      "id": "CVE-2024-48948",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-48948 is fixed in version 6.5.5-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4e923564-6c3a-5206-b6a8-f4f67a83fa2f",
      "id": "CVE-2024-48949",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-48949 is fixed in version 6.5.5-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:267a1797-eea0-58b5-9af8-7797d0b6d346",
      "id": "CVE-2025-14505",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-14505 is fixed in version 6.5.5-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fdefc9cd-bcca-5493-8efa-9d2d419add0b",
      "id": "CVE-2025-15284",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-15284 is fixed in version 6.5.5-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e32019b0-3113-50a3-9fdf-f6d150bef478",
      "id": "CVE-2026-2391",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-2391 does not affect version 6.5.5-tuxcare.1 of qs. not_affected \u2014 Target version 6.5.5 does not contain the comma parsing feature required for this vulnerability. The comma option was introduced in v6.7.0, two minor versions after the target. Without comma parsing, comma-separated query parameter values remain as single strings and cannot bypass arrayLimit."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:29c65757-3361-5d65-ac91-03eed6c8aa20",
      "id": "CVE-2026-8723",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8723 does not affect version 6.5.5-tuxcare.1 of qs. not_affected \u2014 Version 6.5.5 is not affected by CVE-2026-8723. The vulnerability requires the arrayFormat: 'comma' feature combined with encodeValuesOnly: true, which was introduced in v6.11.1. Version 6.5.5 lacks both the comma arrayFormat implementation and the utils.maybeMap function that the vulnerable code path relies on."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:92e77215-625d-519e-a1bf-85d6280337ba",
      "id": "GHSA-vjh7-7g9h-fjfh",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-vjh7-7g9h-fjfh is fixed in version 6.5.5-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.5-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/qs@6.5.5-tuxcare.1"
    }
  ]
}