{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9a912509-1d3f-584a-94ed-55e7fc7e635a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@0.10.7-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/nuxt@0.10.7-tuxcare.4", "version": "0.10.7-tuxcare.4", "pedigree": { "ancestors": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@0.10.7", "type": "library", "version": "0.10.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-3224", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:83109746-ac2f-5d64-9665-dfefee4eb218", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-3224 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 CVE-2023-3224 affects the `/__nuxt_island` endpoint in Nuxt 3.4.0-3.4.3, which is used for server component islands. This feature does not exist in Nuxt 0.10.7. The target version is a pre-1.0 Nuxt 1.x release with a completely different architecture from Nuxt 3.x. Exhaustive searches for island-related code, the `/__nuxt_island` endpoint, and any dev-only API endpoints that accept component na...", "justification": "code_not_present" } }, { "id": "CVE-2024-34343", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:28186d8f-2d24-5c06-b2d2-662524d2a92b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 0.10.7-tuxcare.4 of nuxt." } }, { "id": "CVE-2024-34344", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:2c54b093-6626-5356-8652-1cf54acca8af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34344 affects version 0.10.7-tuxcare.4 of nuxt." } }, { "id": "CVE-2025-27415", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:56a9f3e7-f343-5b81-b067-1ea0ae04c6cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 0.10.7-tuxcare.4 of nuxt." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:165f19fd-7460-5757-abd0-c827c563b0f9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59414 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 0.10.7 does not contain the Islands feature or payload revival mechanism vulnerable to CVE-2025-59414. The Islands feature was introduced in Nuxt 3.x (2022), while version 0.10.7 is from 2017, predating it by approximately 5 years. The target uses a completely different architecture with no `__nuxt_island` object handling, no `devalue` deserialization, no `revive-payload` mechanism, and no...", "justification": "code_not_present" } }, { "id": "CVE-2026-114130", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:d8ac6511-249a-56e0-9f30-46e6b134968e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114130 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 Nuxt version 0.10.7-tuxcare.4 is NOT AFFECTED by CVE-2026-114130. The vulnerability requires applications running without a `pages/` directory where Nuxt registers its own custom router in place of vue-router. Version 0.10.7 MANDATES a pages directory (build process exits with error if missing) and always uses vue-router for link rendering. The vulnerable code path (custom router for `pages: fa...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-114131", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:6670f997-27a3-590d-abbd-b8ef3331c027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114131 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 CVE-2026-114131 describes a route rule bypass vulnerability in Nuxt's `routeRules` feature, where percent-encoded paths can bypass middleware protections. However, Nuxt v0.10.7-tuxcare.5 predates this feature entirely. The `routeRules` configuration system was introduced in Nuxt 3 (2022), while this target is a pre-1.0 version from circa 2017. The repository lacks routeRules, appMiddleware, def...", "justification": "code_not_present" } }, { "id": "CVE-2026-114132", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:71d5d9a9-32a2-5d09-8992-3d198a729149", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114132 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 0.10.7 is not affected by CVE-2026-114132. The vulnerability concerns case-sensitivity mismatches in server-side route rules matching (routeRules configuration with Nitro server), a feature introduced in Nuxt 3. Nuxt 0.10.7 (2017) predates Nuxt 3 (2022) and lacks: (1) Nitro server engine, (2) routeRules configuration, (3) server-side route rules for redirect/headers/proxy/ssr controls. The...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-114133", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:b67eac5a-1221-58d3-afb6-7112a1a3b860", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114133 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 Version 0.10.7 is not affected by CVE-2026-114133. The vulnerability requires both the `useHeadSafe` composable (introduced in Nuxt v3.3.0) and server islands with head support (added in v3.13.0). Version 0.10.7 predates both features by several major versions, using the vue-meta library for head management instead. The vulnerable code path does not exist in this architecture.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-119200", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:2c7a130f-3cce-5544-a34e-351675ef2723", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-119200 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 0.10.7-tuxcare.5 is NOT affected by CVE-2026-119200. The vulnerability was introduced in Nuxt 4.6.0 where the framework began resolving dot segments (`.`, `..`, `%2e`) for page routing while middleware still saw unresolved paths, creating an authorization bypass. Version 0.10.7 predates this architectural change - both the router and middleware see the same unresolved path representation. ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-120309", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:70128790-da81-549f-bef4-ca877049eb23", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-120309 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 0.10.7 is not affected by CVE-2026-120309. The vulnerability requires getRouterParam/getRouterParams functions and h3 router architecture introduced in Nuxt 4.x. Version 0.10.7 uses vue-router with a single parameter source (router.currentRoute.params), making the dual-source parameter confusion attack impossible. The vulnerable code pattern does not exist in this architecture.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:47521e32-87f1-5aba-9c87-771f0ceaa491", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45669 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 0.10.7 is not affected by CVE-2026-45669. The vulnerability requires server-generated HTML redirect bodies with meta-refresh tags that insufficiently encode HTML-significant characters. Version 0.10.7 uses a fundamentally different redirect architecture: pure HTTP 302 redirects with Location headers (properly encoded via encodeURI()), with no HTML body generation. The vulnerable code patte...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:a56ae8aa-b607-518e-8d4f-17f29f1924f7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-46342 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 Nuxt version 0.10.7-tuxcare.2 does not contain the vulnerable island components feature. CVE-2026-46342 affects the `/__nuxt_island/*` endpoint and island components introduced in Nuxt 3.x/4.x as an experimental feature (`experimental.componentIslands`). Version 0.10.7 from 2017 predates this feature entirely. The target has no island endpoints, no island component code, no experimental configu...", "justification": "code_not_present" } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:4de2e904-1653-53cd-8b5a-8c2dc9f39cd4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 The target repository (Nuxt 0.10.7, circa 2017) does not contain the vulnerable feature. CVE-2026-47200 affects the component islands feature (experimental.componentIslands) introduced in Nuxt 3+ (2022+), which allows .server.vue pages to be rendered via the /__nuxt_island/ endpoint without executing route middleware. This feature and endpoint do not exist in Nuxt 0.10.7.", "justification": "code_not_present" } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:625e2e62-114d-55aa-a01f-c2482d70829a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 0.10.7-tuxcare.4 of nuxt." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:5ab464db-31d2-55ec-af4e-2d3000729d59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 0.10.7-tuxcare.4 of nuxt." } }, { "id": "CVE-2026-56301", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:5591428d-430c-54c3-b8f7-e41ce8d39a44", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56301 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 0.10.7 is not affected by CVE-2026-56301. The vulnerability exists in the vite-node IPC server plugin (packages/vite/src/plugins/vite-node.ts) which binds to an unprotected abstract-namespace Unix socket on Linux. This component does not exist in version 0.10.7, which predates Vite's existence and uses a Webpack-based build system with a standard HTTP development server on TCP port. The vu...", "justification": "code_not_present" } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:8c8c6097-5030-59a7-9648-10c3d437011f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 0.10.7-tuxcare.4 of nuxt." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:99dd11b6-3b5c-57aa-b381-f89225dc47a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 0.10.7 is not affected by CVE-2026-56326. The vulnerability requires URL constructor path normalization (turning /..//evil.com into //evil.com) which is specific to Nuxt 3.x/4.x architecture. Nuxt 0.10.7 uses a different redirect mechanism (ctx.redirect with urlJoin) that collapses multiple slashes before setting the Location header, preventing protocol-relative URL formation through any c...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:cbd10c6f-f7fc-5579-bfab-3abc2f52646d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 0.10.7-tuxcare.4 of nuxt." } }, { "id": "CVE-2026-71315", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:f883edbf-24ca-5ecd-be7b-3fd62aec0685", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71315 affects version 0.10.7-tuxcare.4 of nuxt." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:0faf2d60-1506-5edf-bdaf-a5512d9e97a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 0.10.7-tuxcare.4 of nuxt. Nuxt 0.10.7 is not affected by CVE-2026-71316. The vulnerability concerns a feature specific to Nuxt 4.4.0-4.5.1 where /_payload.json endpoints can serve cached SSR data before route middleware executes. This endpoint pattern and the associated runtime payload caching mechanism do not exist in Nuxt 0.10.7. The target version uses a fundamentally different SSR architecture where data is serialized directly into HTML as window.__NUXT__ and middleware always executes during the rendering pipeline.", "justification": "code_not_present" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:6c25e852-f1fa-5346-8dd4-842064f5e63b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71318 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 The target Nuxt version 0.10.7-tuxcare.5 is not affected by CVE-2026-71318. This CVE concerns server islands accepting props via the `/__nuxt_island/` endpoint, a feature introduced in Nuxt v3.1.0. The target version (0.10.7 from 2017) predates even Nuxt 2, which the CVE explicitly states is not affected. The server islands feature, including the vulnerable endpoint and prop-forwarding mechanis...", "justification": "code_not_present" } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:6d3dc983-c61d-5345-afb6-614b9e8f0b3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 0.10.7-tuxcare.4 of nuxt." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:1c7dce8e-7d7d-52cb-99b5-4fce0e24ddb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 0.10.7-tuxcare.4 of nuxt." } }, { "id": "CVE-2026-72744", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:e5987dcc-de0b-5c53-9466-2c64f0974b97", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-72744 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 The target repository (Nuxt 0.10.7-tuxcare.5) is not affected by CVE-2026-72744. This CVE concerns a Chrome DevTools workspace endpoint information disclosure vulnerability in Nuxt 3.x/4.x that relies on the Nitro server engine and the experimental.chromeDevtoolsProjectSettings feature. Nuxt 0.10.7, released in 2017, predates these components by approximately 5 years and uses a fundamentally di...", "justification": "code_not_present" } }, { "id": "GHSA-2x6f-57hp-86fx", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:2d982861-2335-5356-996c-1f3452623369", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-2x6f-57hp-86fx is a false positive for nuxt 0.10.7-tuxcare.4." } }, { "id": "GHSA-4jjw-pwvw-q6w3", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:a1313858-1182-5514-bc2b-b59317d1864a", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4jjw-pwvw-q6w3 is a false positive for nuxt 0.10.7-tuxcare.4." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:8ced25be-468b-51d5-8f2b-c14a189ce6d2", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 Target repository (Nuxt v0.10.7) uses a different architecture that predates the vulnerable APIs (navigateTo, reloadNuxtApp). The existing redirect mechanism has equivalent protections via the urlJoin() function that prevent the path-normalization bypass. The other two vulnerabilities target APIs that do not exist in this version.", "justification": "code_not_reachable" } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.4" } ], "bom-ref": "urn:uuid:6def5178-6ee3-5dd9-aab6-6c070393ee28", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 0.10.7-tuxcare.4 of nuxt. not_affected \u2014 Nuxt v0.10.7-tuxcare.1 does not contain the vulnerable