{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:32b407b3-6691-54e3-8e87-66bed8d81d20",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "nuxt",
      "purl": "pkg:npm/nuxt@1.4.5-tuxcare.4",
      "type": "library",
      "bom-ref": "pkg:npm/nuxt@1.4.5-tuxcare.4",
      "version": "1.4.5-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "nuxt",
            "purl": "pkg:npm/nuxt@1.4.5",
            "type": "library",
            "version": "1.4.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-3224",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:5116daa5-e9e1-5adb-9e01-21f14b00ce6a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-3224 does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 CVE-2023-3224 affects Nuxt 3.4.0-3.4.3 dev server with code injection when exposed publicly. Target is Nuxt 1.4.5, a fundamentally different major version. Nuxt 3 is a complete architectural rewrite (Vue 3, h3/nitro handlers, monorepo) versus Nuxt 1 (Vue 2, connect middleware, single package). Analysis of git history shows recent Nuxt 3/4 security fixes adding Host header validation (commits f8...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-34343",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:a6c02d21-7e99-5e20-a935-6e19cb20b73c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-34343 is fixed in version 1.4.5-tuxcare.4 of nuxt."
      }
    },
    {
      "id": "CVE-2024-34344",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:156d8255-c619-53c5-9cde-76cad7784d8e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-34344 affects version 1.4.5-tuxcare.4 of nuxt."
      }
    },
    {
      "id": "CVE-2025-27415",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:614045d9-e123-5ca4-a301-ad42b90561e3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-27415 affects version 1.4.5-tuxcare.4 of nuxt."
      }
    },
    {
      "id": "CVE-2025-59414",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:e5f18dd8-5d60-51c6-84fc-ef4178afbcb4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-59414 does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2025-59414. The vulnerability exists in the Island component payload revival mechanism, which was introduced in Nuxt 3.x. This target version (1.4.5) predates that feature and uses a fundamentally different architecture for SSR hydration. The vulnerable code pattern (__nuxt_island objects, devalue serialization, Island payload revival) does not exist in this ve...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-114130",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1b2a8e4b-b16f-5d1a-8ca0-02fa5eb73ef1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-114130 affects version 1.4.5-tuxcare.4 of nuxt, and is fixed in 1.4.5-tuxcare.7."
      }
    },
    {
      "id": "CVE-2026-114131",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:2fdb5989-a5cb-59a4-b7dc-5b5986dd4f90",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-114131 does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 CVE-2026-114131 describes a percent-encoding bypass vulnerability in Nuxt's `routeRules` configuration, where route rules are matched against raw (unencoded) request paths while the router decodes paths, allowing attackers to bypass middleware protections by percent-encoding path characters. The target repository (Nuxt 1.4.5-tuxcare.6) is NOT AFFECTED because it uses a fundamentally different a...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-114132",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:02cf4223-8c36-506e-9cc8-1f4661d6fc15",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-114132 does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-114132. The vulnerability concerns case-sensitive route rule matching in Nitro (Nuxt 3/4's server framework), but Nuxt 1.x predates Nitro and uses a completely different architecture. The target lacks the `routeRules` configuration feature, `router.options.sensitive` setting, and Nitro's route rule matcher that are central to the vulnerability. The affecte...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-114133",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:9fb79a08-e528-504a-a64e-cd32ac2572fc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-114133 does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 The target (Nuxt 1.4.5-tuxcare.6) is not affected by CVE-2026-114133. This vulnerability affects Nuxt >=3.13.0 where server islands with `useHeadSafe` were introduced. The target uses a completely different architecture (vue-meta v1.4.3 for head management) that predates the vulnerable feature by multiple major versions. The CVE explicitly states \"Nuxt 2 is not affected\" and the target is Nuxt ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-119200",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:dbe4d313-25ca-5c6c-b102-d49e27966e61",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-119200 does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 CVE-2026-119200 does not affect Nuxt 1.4.5-tuxcare.6. The vulnerability requires the Nitro server architecture introduced in Nuxt 4.6.0, which creates a mismatch between how Nitro's middleware sees request paths versus how Nuxt's page renderer resolves them. Version 1.4.5 predates Nitro entirely, uses connect middleware and vue-server-renderer directly, and both layers see the same unresolved p...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-120309",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:0bb67fc4-95cd-53c8-91c7-fcfcf9714409",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-120309 does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 CVE-2026-120309 affects Nuxt 4.6.0-4.6.1 and involves route parameter confusion between getRouterParam/getRouterParams helper functions and h3's event.context.params. The target version (Nuxt 1.4.5-tuxcare.6) predates this vulnerability by several major versions. The vulnerable code patterns, functions, and architecture do not exist in this version. Nuxt 1.4.5 uses vue-router with a single para...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-45669",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b86f6c1c-2c2d-5714-bcd2-bcfb678d3bc8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-45669 does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-45669. The vulnerability targets Nuxt 3.x/4.x's `navigateTo(url, { external: true })` composable, which generates server-side HTML redirect bodies containing `<meta http-equiv=\"refresh\">` tags with insufficiently encoded URLs. Nuxt 1.4.5 uses a completely different redirect architecture: server-side redirects are implemented via standard HTTP 302 responses...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-46342",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:25616643-1051-5f30-9249-38dd76414f8a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-46342 does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 1.4.5 does not have the Component Islands feature or the `/__nuxt_island/*` endpoint that CVE-2026-46342 targets. Component Islands were introduced in Nuxt 3.x (experimental) years after this version was released. The target uses classic Vue 2.x SSR with full-page rendering via vue-server-renderer, not the Nitro server engine with island handlers. The vulnerable code path does not exist in...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47200",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:7c38616c-a1ed-52cc-a514-3c6f1cd37e88",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47200 does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 Target repository (Nuxt 1.4.5) does not contain the vulnerable component islands feature. The vulnerability (CVE-2026-47200) is specific to Nuxt 3.x/4.x with experimental.componentIslands enabled, which was introduced ~4 years after this version. The /__nuxt_island/ endpoint pattern and associated island context handling do not exist in the target's architecture.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-53721",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:afc74aa1-49a8-5f46-bf04-8bd9665fa02e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53721 affects version 1.4.5-tuxcare.4 of nuxt."
      }
    },
    {
      "id": "CVE-2026-53722",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:44667ad8-6c9d-52e0-98e3-dad7c5dbe9c4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53722 is fixed in version 1.4.5-tuxcare.4 of nuxt."
      }
    },
    {
      "id": "CVE-2026-56301",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:2a25b295-edff-5777-ba82-5a2f007ed3c0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-56301 does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 1.4.5-tuxcare.6 is not affected by CVE-2026-56301. The vulnerability exists in Nuxt's vite-node IPC server component, which was introduced in Nuxt 3.x (2022+) when the framework migrated from webpack to Vite. Version 1.4.5 (released ~2018) uses webpack exclusively and has no vite-node integration. Exhaustive searches confirmed zero vite/vite-node code, no node:net IPC server, and no Unix s...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-56317",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:067af0c6-e9a6-51e1-b3fd-f947020eef10",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56317 affects version 1.4.5-tuxcare.4 of nuxt, and is fixed in 1.4.5-tuxcare.5."
      }
    },
    {
      "id": "CVE-2026-56326",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:726b9558-be5d-5397-ae2a-1043f817587c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-56326 does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-56326. This CVE targets the path-normalization vulnerability in the navigateTo composable (Nuxt 3.x/4.x), which does not exist in Nuxt 1.4.5's architecture. The vulnerability requires URL constructor normalization that transforms /..//evil.com into //evil.com before output, enabling protocol-relative URL redirects. Nuxt 1.4.5 uses a redirect helper with st...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-71314",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:41de3eec-6d7c-5380-ab2b-d582137a64d2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-71314 affects version 1.4.5-tuxcare.4 of nuxt."
      }
    },
    {
      "id": "CVE-2026-71315",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:3471f261-6f88-5564-9e8a-4f111620fa07",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-71315 affects version 1.4.5-tuxcare.4 of nuxt."
      }
    },
    {
      "id": "CVE-2026-71316",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:8d5e3f19-341a-5a18-9b02-398944fb8107",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-71316 does not affect version 1.4.5-tuxcare.4 of nuxt. Nuxt 1.4.5 is not affected by CVE-2026-71316. The vulnerability requires `/_payload.json` endpoints that can return cached SSR data before route middleware enforcement - a feature that doesn't exist in Nuxt 1.4.5's architecture. This version uses a fundamentally different SSR model where all data is embedded in HTML responses and middleware is always enforced before rendering. The `_payload.json` endpoint pattern and `import.meta.prerender` mechanism are features of Nuxt 4.x's Nitro server architecture, not present in Nuxt 1.x's Connect-based architecture.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-71318",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:9aba70ef-880e-50d8-9018-d5e064342ba6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-71318 does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-71318. The vulnerability concerns server islands (a feature that accepts props via the `/__nuxt_island/` endpoint and enables dynamic component resolution). Server islands were introduced in Nuxt 3.1.0 and do not exist in Nuxt 1.4.5. The target uses traditional Vue SSR with bundleRenderer and build-time component resolution, with no mechanism for accepting...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-71320",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:24994bbc-7b8d-5bd8-98b2-fbcd107f8266",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-71320 affects version 1.4.5-tuxcare.4 of nuxt."
      }
    },
    {
      "id": "CVE-2026-71321",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:72b3e0bf-188d-550b-b1d6-9debd737cb13",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-71321 affects version 1.4.5-tuxcare.4 of nuxt."
      }
    },
    {
      "id": "CVE-2026-72744",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1dfddc11-5703-54d5-9abd-8bdb468f6834",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-72744 does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-72744. The vulnerability concerns the Chrome DevTools workspace endpoint (/.well-known/appspecific/com.chrome.devtools.json) and the experimental.chromeDevtoolsProjectSettings feature, which were introduced in Nuxt 3.x/4.x with the Nitro server architecture. This endpoint and feature do not exist in Nuxt 1.4.5, which predates the Nitro engine and uses a si...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-2x6f-57hp-86fx",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:90a0f6e0-df1e-5b2e-ae56-aae5d42ddb00",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-2x6f-57hp-86fx is a false positive for nuxt 1.4.5-tuxcare.4."
      }
    },
    {
      "id": "GHSA-4jjw-pwvw-q6w3",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:dc82280a-e8f1-558d-abee-cf4fdc39527a",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-4jjw-pwvw-q6w3 is a false positive for nuxt 1.4.5-tuxcare.4."
      }
    },
    {
      "id": "GHSA-c9cv-mq2m-ppp3",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b4f06e47-366c-553c-b1a0-15a7487e08c2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 The target repository (Nuxt 1.4.5) is not affected by GHSA-c9cv-mq2m-ppp3. The three vulnerabilities described in this advisory target APIs (navigateTo and reloadNuxtApp) that were introduced in Nuxt 3.x and do not exist in version 1.4.5. The target uses a fundamentally different navigation architecture that does not exhibit the vulnerable path-normalization behavior present in Nuxt 3.x/4.x.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-m3q2-p4fw-w38m",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d109c2fc-a257-52f6-89e1-b3ee5c11fb06",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 Nuxt 1.4.5 does not contain the vulnerable <NoScript> component. The vulnerability (GHSA-m3q2-p4fw-w38m) affects the <NoScript> component from @unhead/vue introduced in Nuxt 3.x. Version 1.4.5 uses a fundamentally different architecture (vue-meta library with config-based head management) that predates the vulnerable component by several years.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-rq7w-g337-39qq",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:42ce5d4b-79d6-57c8-ad78-e45a173e8dd5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-rq7w-g337-39qq does not affect version 1.4.5-tuxcare.4 of nuxt. not_affected \u2014 GHSA-rq7w-g337-39qq affects Nuxt 4.0.0-alpha.1 through 4.4.6 via an unauthenticated dev-server endpoint (/.well-known/appspecific/com.chrome.devtools.json) that exposes filesystem paths. The target is Nuxt 1.4.5-tuxcare.6, which predates version 3.x (explicitly marked as unaffected by the CVE). Version 1.4.5 uses Connect-based middleware without the Nitro server framework, the chrome devtools w...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-xppm-jmw6-fhmf",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:bb68b3f0-a10f-5603-b2ea-ff2823b510cb",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for nuxt 1.4.5-tuxcare.4."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/nuxt@1.4.5-tuxcare.4"
    }
  ]
}