{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8323c26b-a428-519d-b64b-89b05d6656f1",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/ws@3.3.3-tuxcare.2",
      "type": "library",
      "name": "ws",
      "version": "3.3.3-tuxcare.2",
      "purl": "pkg:npm/ws@3.3.3-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:20955286-247c-5192-86a3-282a505396ff",
      "id": "CVE-2024-37890",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-37890 does not affect version 3.3.3-tuxcare.2 of ws. already_fixed \u2014 CVE-2024-37890 has been fixed in the target repository. The vulnerability allowed an attacker to crash the ws server by sending an HTTP Upgrade request with a number of headers exceeding server.maxHeadersCount, causing Node.js to not populate the upgrade header value (leaving it undefined), which led to a TypeError when the code attempted to call .toLowerCase() on undefined. The fix extracts th..."
      },
      "affects": [
        {
          "ref": "pkg:npm/ws@3.3.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7fcabee2-1418-5a84-a801-099d47dc1255",
      "id": "CVE-2026-32141",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-32141 is fixed in version 3.3.3-tuxcare.2 of ws."
      },
      "affects": [
        {
          "ref": "pkg:npm/ws@3.3.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e6678405-b1d2-5a09-b2a9-f1686dbadf60",
      "id": "CVE-2026-33228",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-33228 is fixed in version 3.3.3-tuxcare.2 of ws."
      },
      "affects": [
        {
          "ref": "pkg:npm/ws@3.3.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:69f1d8ad-e3e6-509e-8e16-be29339308db",
      "id": "CVE-2026-48779",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-48779 is fixed in version 3.3.3-tuxcare.2 of ws."
      },
      "affects": [
        {
          "ref": "pkg:npm/ws@3.3.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:19d9103d-8f18-507d-873c-be5a66650855",
      "id": "fix-CVE-2024-37890",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability fix-CVE-2024-37890 is fixed in version 3.3.3-tuxcare.2 of ws."
      },
      "affects": [
        {
          "ref": "pkg:npm/ws@3.3.3-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/ws@3.3.3-tuxcare.2"
    }
  ]
}