{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:78819d7c-506e-513e-bf49-5459158ec505",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "next",
      "purl": "pkg:npm/next@15.1.2-tuxcare.4",
      "type": "library",
      "bom-ref": "pkg:npm/next@15.1.2-tuxcare.4",
      "version": "15.1.2-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "next",
            "purl": "pkg:npm/next@15.1.2",
            "type": "library",
            "version": "15.1.2"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2017-16877",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:615b1a7a-84ee-5327-a5a3-45dc9aa2e037",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-16877 does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 CVE-2017-16877 affects Next.js versions before 2.4.1. The target (v15.1.2-tuxcare.3) is not affected because the vulnerable code pattern was removed by upstream Next.js in July 2023 (commit f57eecde5e1). The current architecture uses the Pillarjs `send` library with a `root` option for serving static files, which provides built-in directory traversal protection. This fix was shipped in the upst...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-18282",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:12b72321-cdf7-52aa-bafc-543a7246e6b7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-18282 does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 CVE-2018-18282 affected Next.js versions 7.0.0 and 7.0.1 with an XSS vulnerability via the 404/500 error pages. The vulnerability was fixed in Next.js 7.0.2 (October 2018) by commit e6d79bb88ee. The target version 15.1.2-tuxcare.3 contains this upstream fix that was already present in the base release before TuxCare's involvement. The vulnerable pattern (unsafe pathname injection into inline Ja...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-6184",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:55032ac5-6dec-5b4c-9f71-da39aadcc947",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-6184 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2020-15242",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b81044df-43c3-5040-ba2e-523cef31ae7d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-15242 does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 CVE-2020-15242 affected Next.js 9.5.0-9.5.3 due to a vulnerability in the node-fetch dependency version 2.6.0. The target (Next.js 15.1.2-tuxcare.3) is not affected because: (1) The fix (commit 7efa3babb75 upgrading node-fetch from 2.6.0 to 2.6.1) was already present in the upstream release before TuxCare's maintenance began, (2) The target uses node-fetch 2.6.7, which is much newer than both t...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-5284",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:18e56498-bf5c-5a89-8353-66471f27f455",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-5284 does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 CVE-2020-5284 (path traversal via URL-encoded static file paths) is NOT present in Next.js v15.1.2-tuxcare.3. The target implements whitelist-based protection in production mode that blocks traversal attempts. The vulnerable pattern was fixed in upstream v9.3.2 (commit 1d6ffc39f7b, March 2020) and shipped with the upstream release that TuxCare onboarded. In production mode, static file paths ar...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-37699",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:e6779445-c710-5e75-bcc7-c5a057bf38d3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-37699 does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 CVE-2021-37699 open redirect vulnerability is NOT present in Next.js 15.1.2. The fix (commit 4ab41efdbfd) that adds normalizeRepeatedSlashes() to prevent specially encoded paths with repeated slashes/backslashes from causing open redirects was already shipped in the upstream release before TuxCare began maintaining this version. The vulnerable pattern (URLs like //google.com or \\/\\/google.com b...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-39178",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:16f73ea2-c478-5b13-b7f8-9f238087da0f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-39178 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2021-43803",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:5911f924-1d3b-5a57-8439-4edce275628c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-43803 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2022-21721",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:821f3f56-56e5-5d1e-9a35-ce62623da3cc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-21721 does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 CVE-2022-21721 affects Next.js >= 12.0.0 with i18n, causing DoS via /${locale}/_next/ paths. The vulnerability was fixed in Next.js 12.0.9 (January 2022) by commit 69524c290d8 which added checks to prevent locale prefixing of _next paths. This fix is present in the upstream Next.js 15.1.2 release that TuxCare onboarded. The target version 15.1.2-tuxcare.3 contains the upstream fix and is not vu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23646",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1cac3815-0807-5137-8a56-03dbbe10c1d6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-23646 does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 CVE-2022-23646 is not present in Next.js v15.1.2-tuxcare.3. The vulnerability allowed serving user-provided SVG files (potentially containing malicious JavaScript) through the Next.js image optimizer when images.domains was configured. The fix, introduced by upstream Vercel in commit 8a55612c0d3 (author: steven@ceriously.com), added a dangerouslyAllowSVG configuration flag (default: false) that...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-36046",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:25f90857-a27c-5671-bb4e-1051bab718bb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-36046 does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 CVE-2022-36046 affects Next.js v12.2.3 and was fixed in v12.2.4. The target repository is Next.js version 15.1.2-tuxcare.3, which is significantly newer than the affected version. The fix (commit f1aac90c7ba) was already present in the upstream release before TuxCare onboarded this version. The vulnerable pattern (unhandled promise rejection in body-streams.ts) has been removed by the upstream ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46298",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:3eccad75-fd7d-578a-a05d-6688abdcbdcc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-46298 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2024-34350",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:0632e4a4-cedd-58cb-911e-a14023c9294f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-34350 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2024-34351",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:36051b1e-3ba4-54a8-aa2f-d5f38ec66df3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-34351 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2024-39693",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:641bab1d-dd87-5679-b76d-10570d838c56",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-39693 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2024-46982",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:e767f249-b35a-5fc2-91be-70cc34ba5839",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-46982 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2024-47831",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:561a4cd2-e6fb-5b02-97b4-cfb2e9b2b206",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-47831 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2024-51479",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ed142fa4-2d49-578c-92ee-e0034e82ae17",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-51479 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2024-56332",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:3a1e3650-77c1-5875-a0f2-0aae9eb60c61",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-56332 does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 Target Next.js 15.1.2-tuxcare.3 is not affected by CVE-2024-56332. The upstream fix (commit 40c9424beba) was already present in the Next.js 15.1.2 release that TuxCare onboarded. All 28 react-server-dom server files contain the complete defense mechanism that prevents DoS by immediately rejecting chunks when a global error occurs, rather than creating pending chunks that would hang indefinitely.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-29927",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:766336bc-6c89-57dd-af44-05522a055456",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-29927 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2025-30218",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:7839018a-3761-5221-b2f0-1dd6ae08f363",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-30218 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2025-32421",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:897b4a11-defe-5892-9694-b2f4da48bfdd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-32421 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2025-48068",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:65d56c22-5b09-5fbd-8852-5c9f138d62bb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-48068 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2025-49005",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:296fcad7-1231-5bc4-ab4d-a038d2dc6e16",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-49005 does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 Version 15.1.2 is NOT vulnerable to CVE-2025-49005. The vulnerability was introduced in version 15.3.0 (commit f2cf3dc8e42, April 2025) when the Vary header was removed for basic routes, and fixed in 15.3.3 (commit ec202eccf05, May 2025) by reinstating it. Version 15.1.2 predates the introduction of the vulnerability and contains the protective Vary header code (base-server.ts:1895-1922) that p...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-49826",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:65613048-107b-5ab0-b3c0-7b81322bfa4f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-49826 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2025-55173",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:64914b12-90ec-5c64-ab93-061c525e4932",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55173 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2025-55182",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:89f1fa81-cf9a-591d-8b8a-71a48db96186",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55182 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2025-57752",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ee4df3b8-825a-59e2-a9da-33c9ffe9f295",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-57752 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2025-57822",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:7201fb87-1e20-5f39-8f08-c23ca60e70a4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-57822 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2025-59471",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b550d778-11a3-5e71-8eac-5f7873640677",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59471 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2025-59472",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1bdaecfb-8778-5549-8018-153c7a4ea534",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-59472 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-103004",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:5b66a507-cd15-5eaa-8611-33dffb3b747b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-103004 does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 The target (Next.js 15.1.2-tuxcare.3) is not affected by CVE-2026-103004. The vulnerability requires root params support (`next/root-params` API) to manifest - specifically, nested 'use cache' functions where the inner function reads root parameters. The target does not have root params support; this feature was introduced later in the Next.js version history (commit f76c1aeacc5, not present on...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-27977",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:236ce2d4-de36-506c-987d-4410a1e008d2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-27977 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-27978",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:756daea5-543e-5a2a-8ddc-e40e0f2daa87",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-27978 does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 Target version 15.1.2 is NOT affected by CVE-2026-27978. The official GitHub Security Advisory (GHSA-mq59-m269-xvcx) specifies the vulnerable version range as >=16.0.1, patched in 16.1.7. The target version 15.1.2-tuxcare.3 predates the introduction of the vulnerable code pattern. The vulnerable pattern (`originHeader !== 'null'` check that treats null origin as missing) was introduced in v16.0...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-27979",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:8c718751-5dc1-5919-97da-61510dbaa844",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-27979 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-27980",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ae7e7405-e149-551a-a94c-db0ffd9ee73c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-27980 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-29057",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f4137ef2-983d-5b42-89b2-0f3d546aad5e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29057 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-44572",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f288d00e-29e9-578a-aa8f-b545b00f70ca",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44572 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-44573",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:92eb6824-2ea3-57b9-bef8-db3284ace2f7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44573 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-44574",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:aa53f701-3559-50a1-8dc2-f76d4c61cda8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44574 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-44575",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:fe583471-e0e1-56ef-b9e1-2b6ed8323fb1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44575 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-44576",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:aa0d7dc0-1bca-514e-a91e-1ab59215404a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44576 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-44577",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1922cdb8-a406-55d2-b567-20f70be5f80f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44577 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-44578",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:027f63a5-7646-5ce0-94c2-7d8cb0ecf0e7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44578 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-44579",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d11fb7c6-7619-5ec0-87b4-1b634c1ffe42",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44579 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-44580",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:2c8b5622-76b3-536d-a484-a50f0cbe226f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44580 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-44581",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:a40fa35e-332f-5068-bc5c-e200c717beed",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44581 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-44582",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:882401a5-7064-5254-8543-c0ae226fd099",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44582 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-45109",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:4d0e60d0-abe6-55ad-971e-4f265d01a69d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45109 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-64641",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:67de6729-4f20-594e-ae66-06e27f685b1e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-64641 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-64642",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:8ea63be8-ca1d-544c-bc45-93fff252f03a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-64642 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-64643",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b7adc52d-3816-514d-ae81-2690725a6a04",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-64643 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-64644",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:94bcf6db-f11f-5370-85f7-dc80e3159be3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-64644 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-64645",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:c82be58a-ed32-5424-834a-fed6804832a6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-64645 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-64646",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b3391fb4-cc15-5b40-8249-3ad4fc665f98",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-64646 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-64647",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:15e3a719-9049-5dd0-8cd9-5bd557cf0ac4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-64647 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-64648",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:33f262ec-805d-590c-ac3f-3df3ceeacf5b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-64648 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-64649",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:390e6c4a-d155-512f-bbbb-84e8b6f24d9f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-64649 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-75604",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:86799c7f-67ee-5649-a689-924e26c3fbd8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-75604 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-94482",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:3caaf8fd-9868-5d34-8da9-d171f13eb42c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-94482 affects version 15.1.2-tuxcare.4 of next, and is fixed in 15.1.2-tuxcare.5."
      }
    },
    {
      "id": "CVE-2026-94483",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:e1a98202-e4a5-55c6-9eab-06bd0da98e7d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-94483 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-94484",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:e89d820f-3959-546a-9b16-678889557c34",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-94484 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-94485",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b6ab97b6-f867-56f1-b1d0-49c52005cfbd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-94485 does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 Target version 15.1.2 is NOT AFFECTED by CVE-2026-94485. The vulnerability was introduced 9 months AFTER v15.1.2 was released. Timeline: v15.1.2 released December 19, 2024; vulnerability introduced September 5, 2025 (commit ede8d1b8613); fixes released September-October 2026. The buggy code pattern (filtering out 'dynamicParams' from metadata route loader re-exports) never existed in v15.1.2. T...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-94486",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:64581644-b77f-56d3-87a2-f6c74fd07ec8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-94486 does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 Version 15.1.2 is not affected by CVE-2026-94486. The Model Context Protocol (MCP) feature\u2014including the vulnerable `/_next/mcp` endpoint and all related infrastructure\u2014does not exist in this version. The MCP feature was introduced to Next.js on July 24, 2025, approximately 7 months after v15.1.2 was released (December 19, 2024). Exhaustive searches across the codebase found no MCP-related code...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-94543",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:561a8be3-ece7-5eca-b616-92c459af5229",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-94543 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "CVE-2026-94544",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d89de0ae-a36e-557c-9755-88b05298e0f8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-94544 does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 Version 15.1.2 is not affected by CVE-2026-94544. The vulnerability requires two architectural features that this version lacks: (1) cross-request deduplication of pending cache fills, and (2) draft mode awareness in cached functions. In 15.1.2, draftMode() always returns isEnabled=false when called inside 'use cache' functions (draft-mode.ts:46-61), preventing draft content generation in cache...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "GHSA-2464-fhr4-w9xw",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:fe5720a4-98b6-546e-bb5a-5812caa24aee",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-2464-fhr4-w9xw affects version 15.1.2-tuxcare.4 of next, and is fixed in 15.1.2-tuxcare.5."
      }
    },
    {
      "id": "GHSA-2xp9-vwfh-vxw4",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:dc5c7484-1458-510c-8ac2-db76135e28fc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-2xp9-vwfh-vxw4 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "GHSA-4633-3j49-mh5q",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:6d98cff9-5de0-50d9-8c50-fec476538274",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-4633-3j49-mh5q is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "GHSA-4c39-4ccg-62r3",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:467e579c-0173-5e04-8ee5-d9253e244b66",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-4c39-4ccg-62r3 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "GHSA-5j59-xgg2-r9c4",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:95e5b359-b7fa-525d-9b8c-117c4db7f2cd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-5j59-xgg2-r9c4 affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "GHSA-5vj8-3v2h-h38v",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:20f387c1-928d-511f-be5a-d69553fe9ca8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-5vj8-3v2h-h38v does not affect version 15.1.2-tuxcare.4 of next. not_affected \u2014 Next.js 15.1.2 is NOT affected by GHSA-5vj8-3v2h-h38v (RCE via unsanitized page path to require()). The vulnerability affected versions prior to 5.1.0. The fix was implemented by upstream Vercel in February 2018 (commit c8da345765e) and shipped in Next.js v5.1.0. The target version 15.1.2 inherited this fix from the upstream release - it was present before TuxCare maintenance began. The vulnera...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-673q-mjm6-r5xr",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:3bec758f-8db1-5551-9525-d6c6998b1e3b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-673q-mjm6-r5xr affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "GHSA-8h8q-6873-q5fj",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:63a58eb3-0754-5020-8995-867075fe1767",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-8h8q-6873-q5fj is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "GHSA-955p-x3mx-jcvp",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:fe7f2054-75a0-517c-b0d8-be5b02da6192",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-955p-x3mx-jcvp is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "GHSA-9qr9-h5gf-34mp",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:31c7dfad-a782-51ff-bd30-4e32d63167ba",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-9qr9-h5gf-34mp affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "GHSA-h25m-26qc-wcjf",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ef2f5659-b429-509d-b377-6a2581bd115c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-h25m-26qc-wcjf is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "GHSA-mwv6-3258-q52c",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:a8e69d94-7e0c-5fab-837e-6e9581af5434",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-mwv6-3258-q52c is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "GHSA-q4gf-8mx6-v5v3",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:75554223-9bd9-539c-bc30-8dfe122f06dd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-q4gf-8mx6-v5v3 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "GHSA-vcvr-r3jv-pc5j",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:169af39f-aedb-5194-85a2-517ac832f26a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-vcvr-r3jv-pc5j affects version 15.1.2-tuxcare.4 of next."
      }
    },
    {
      "id": "GHSA-w37m-7fhw-fmv9",
      "affects": [
        {
          "ref": "pkg:npm/next@15.1.2-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:be508049-408a-582c-8357-bcb888a1ab83",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-w37m-7fhw-fmv9 is fixed in version 15.1.2-tuxcare.4 of next."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/next@15.1.2-tuxcare.4"
    }
  ]
}