{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:eb3469a5-23b5-53c0-b30d-35c5be5bbd79",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "devalue",
      "purl": "pkg:npm/devalue@4.3.1-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/devalue@4.3.1-tuxcare.1",
      "version": "4.3.1-tuxcare.1",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-57820",
      "affects": [
        {
          "ref": "pkg:npm/devalue@4.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c595c92c-fb0a-5135-a6ed-ae8235011673",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-57820 is fixed in version 4.3.1-tuxcare.1 of devalue."
      }
    },
    {
      "id": "CVE-2026-22774",
      "affects": [
        {
          "ref": "pkg:npm/devalue@4.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f4073b78-8681-59d6-b551-239ab940cac9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22774 does not affect version 4.3.1-tuxcare.1 of devalue. Version 4.3.1 is not affected by CVE-2026-22774. The vulnerability concerns typed array deserialization in devalue.parse, where malformed input can cause excessive memory allocation when TypedArray constructors receive non-ArrayBuffer values. However, version 4.3.1 does not have TypedArray or ArrayBuffer deserialization support at all\u2014this feature was added in version 4.3.2+ (commit bbf86c2). When TypedArray-formatted data is sent to v4.3.1, it's rejected with \"Unknown type\" error at src/parse.js:105. The vulnerable code path does not exist in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-30226",
      "affects": [
        {
          "ref": "pkg:npm/devalue@4.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b47f206c-73d9-5c99-9428-95c49ea1e2bf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-30226 is fixed in version 4.3.1-tuxcare.1 of devalue."
      }
    },
    {
      "id": "CVE-2026-42570",
      "affects": [
        {
          "ref": "pkg:npm/devalue@4.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6b15b7ee-d25e-5b7b-a89a-b032f0c92f8c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42570 affects version 4.3.1-tuxcare.1 of devalue, and is fixed in 4.3.1-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-81176",
      "affects": [
        {
          "ref": "pkg:npm/devalue@4.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:15505c94-b675-50d4-ab0e-5fed8a4a9dd3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-81176 affects version 4.3.1-tuxcare.1 of devalue, and is fixed in 4.3.1-tuxcare.2."
      }
    },
    {
      "id": "GHSA-33hq-fvwr-56pm",
      "affects": [
        {
          "ref": "pkg:npm/devalue@4.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:55def86d-ff77-5944-9eeb-2a10c928a34a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-33hq-fvwr-56pm is fixed in version 4.3.1-tuxcare.1 of devalue."
      }
    },
    {
      "id": "GHSA-4q55-j62x-fr9h",
      "affects": [
        {
          "ref": "pkg:npm/devalue@4.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d1043389-ef24-57d7-b6c6-4bfd4e48f8c2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-4q55-j62x-fr9h affects version 4.3.1-tuxcare.1 of devalue."
      }
    },
    {
      "id": "GHSA-8qm3-746x-r74r",
      "affects": [
        {
          "ref": "pkg:npm/devalue@4.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8832886a-08d4-5148-9880-619f2eda17e2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-8qm3-746x-r74r is fixed in version 4.3.1-tuxcare.1 of devalue."
      }
    },
    {
      "id": "GHSA-hx4r-w6wj-j8fg",
      "affects": [
        {
          "ref": "pkg:npm/devalue@4.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:187926e4-452f-58ed-b8e8-f8c7001ec31c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-hx4r-w6wj-j8fg affects version 4.3.1-tuxcare.1 of devalue."
      }
    },
    {
      "id": "GHSA-mcm9-63f2-9j32",
      "affects": [
        {
          "ref": "pkg:npm/devalue@4.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9bf487d3-113c-5355-b326-305eaccda7d8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mcm9-63f2-9j32 affects version 4.3.1-tuxcare.1 of devalue."
      }
    },
    {
      "id": "GHSA-mwv9-gp5h-frr4",
      "affects": [
        {
          "ref": "pkg:npm/devalue@4.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5d146caa-44b7-5a8a-a176-1a01cfad972d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-mwv9-gp5h-frr4 is fixed in version 4.3.1-tuxcare.1 of devalue."
      }
    },
    {
      "id": "GHSA-r9w8-h9r3-54w4",
      "affects": [
        {
          "ref": "pkg:npm/devalue@4.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a27196ff-c0b7-508e-90d3-00cd2406d105",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-r9w8-h9r3-54w4 does not affect version 4.3.1-tuxcare.1 of devalue. not_affected \u2014 Target version 4.3.1-tuxcare.2 does not contain ArrayBuffer handling code required for GHSA-r9w8-h9r3-54w4. ArrayBuffer support was introduced in commit bbf86c2 (Sep 2023), first released in upstream v5.1.0. The target version predates this feature and lacks the vulnerable code path entirely. The parse.js switch statement only handles Date, Set, Map, RegExp, Object, BigInt, and null types - no ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-wf3x-273g-mvxv",
      "affects": [
        {
          "ref": "pkg:npm/devalue@4.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c301a065-c81c-5041-ab2f-079faee04db0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-wf3x-273g-mvxv affects version 4.3.1-tuxcare.1 of devalue."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/devalue@4.3.1-tuxcare.1"
    }
  ]
}