{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ef364137-6421-5339-af50-15b60a6a67ba", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@1.4.5-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/nuxt@1.4.5-tuxcare.5", "version": "1.4.5-tuxcare.5", "pedigree": { "ancestors": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@1.4.5", "type": "library", "version": "1.4.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-3224", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:e85d5cd7-2794-5e54-8864-75dab09f1b1d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-3224 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 CVE-2023-3224 affects Nuxt 3.4.0-3.4.3 dev server with code injection when exposed publicly. Target is Nuxt 1.4.5, a fundamentally different major version. Nuxt 3 is a complete architectural rewrite (Vue 3, h3/nitro handlers, monorepo) versus Nuxt 1 (Vue 2, connect middleware, single package). Analysis of git history shows recent Nuxt 3/4 security fixes adding Host header validation (commits f8...", "justification": "code_not_present" } }, { "id": "CVE-2024-34343", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:8a5b6b9b-33eb-5c9a-98f7-dcab1dceadd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 1.4.5-tuxcare.5 of nuxt." } }, { "id": "CVE-2024-34344", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:cef01b17-3cf3-5c53-932b-e48ca890951b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34344 affects version 1.4.5-tuxcare.5 of nuxt." } }, { "id": "CVE-2025-27415", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:1e77c967-a2a8-5981-90ff-ca13d5903f62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 1.4.5-tuxcare.5 of nuxt." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:6da1229a-c1fd-548b-a40a-0393b2f0d8f6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59414 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2025-59414. The vulnerability exists in the Island component payload revival mechanism, which was introduced in Nuxt 3.x. This target version (1.4.5) predates that feature and uses a fundamentally different architecture for SSR hydration. The vulnerable code pattern (__nuxt_island objects, devalue serialization, Island payload revival) does not exist in this ve...", "justification": "code_not_present" } }, { "id": "CVE-2026-114130", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:58405704-9ba0-55de-9ca3-e23d619fcb35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114130 affects version 1.4.5-tuxcare.5 of nuxt, and is fixed in 1.4.5-tuxcare.7." } }, { "id": "CVE-2026-114131", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:95f4575e-8b7d-58cf-bf2c-b13da9b85e03", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114131 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 CVE-2026-114131 describes a percent-encoding bypass vulnerability in Nuxt's `routeRules` configuration, where route rules are matched against raw (unencoded) request paths while the router decodes paths, allowing attackers to bypass middleware protections by percent-encoding path characters. The target repository (Nuxt 1.4.5-tuxcare.6) is NOT AFFECTED because it uses a fundamentally different a...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-114132", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:4bec0282-1193-56c7-be38-176893b5489f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114132 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-114132. The vulnerability concerns case-sensitive route rule matching in Nitro (Nuxt 3/4's server framework), but Nuxt 1.x predates Nitro and uses a completely different architecture. The target lacks the `routeRules` configuration feature, `router.options.sensitive` setting, and Nitro's route rule matcher that are central to the vulnerability. The affecte...", "justification": "code_not_present" } }, { "id": "CVE-2026-114133", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:14c07890-2210-5136-aec8-5f8d18f2db82", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114133 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 The target (Nuxt 1.4.5-tuxcare.6) is not affected by CVE-2026-114133. This vulnerability affects Nuxt >=3.13.0 where server islands with `useHeadSafe` were introduced. The target uses a completely different architecture (vue-meta v1.4.3 for head management) that predates the vulnerable feature by multiple major versions. The CVE explicitly states \"Nuxt 2 is not affected\" and the target is Nuxt ...", "justification": "code_not_present" } }, { "id": "CVE-2026-119200", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:18183efb-ed57-5334-ba60-bdef93de6b88", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-119200 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 CVE-2026-119200 does not affect Nuxt 1.4.5-tuxcare.6. The vulnerability requires the Nitro server architecture introduced in Nuxt 4.6.0, which creates a mismatch between how Nitro's middleware sees request paths versus how Nuxt's page renderer resolves them. Version 1.4.5 predates Nitro entirely, uses connect middleware and vue-server-renderer directly, and both layers see the same unresolved p...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-120309", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:f39f3239-fe8c-53cf-91af-471b99b620ab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-120309 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 CVE-2026-120309 affects Nuxt 4.6.0-4.6.1 and involves route parameter confusion between getRouterParam/getRouterParams helper functions and h3's event.context.params. The target version (Nuxt 1.4.5-tuxcare.6) predates this vulnerability by several major versions. The vulnerable code patterns, functions, and architecture do not exist in this version. Nuxt 1.4.5 uses vue-router with a single para...", "justification": "code_not_present" } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:fb5c1900-f301-5549-b251-a4d03be482b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45669 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-45669. The vulnerability targets Nuxt 3.x/4.x's `navigateTo(url, { external: true })` composable, which generates server-side HTML redirect bodies containing `` tags with insufficiently encoded URLs. Nuxt 1.4.5 uses a completely different redirect architecture: server-side redirects are implemented via standard HTTP 302 responses...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:ccc5bda6-71b3-5b2f-855e-ae6dcf66ec24", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-46342 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 Nuxt 1.4.5 does not have the Component Islands feature or the `/__nuxt_island/*` endpoint that CVE-2026-46342 targets. Component Islands were introduced in Nuxt 3.x (experimental) years after this version was released. The target uses classic Vue 2.x SSR with full-page rendering via vue-server-renderer, not the Nitro server engine with island handlers. The vulnerable code path does not exist in...", "justification": "code_not_present" } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:70f9529a-8efd-51e5-9ad6-1adca5b1f7e1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 Target repository (Nuxt 1.4.5) does not contain the vulnerable component islands feature. The vulnerability (CVE-2026-47200) is specific to Nuxt 3.x/4.x with experimental.componentIslands enabled, which was introduced ~4 years after this version. The /__nuxt_island/ endpoint pattern and associated island context handling do not exist in the target's architecture.", "justification": "code_not_present" } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:40c3bbdd-4b1f-5b1c-b584-0f1fa9c20848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 1.4.5-tuxcare.5 of nuxt." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:e30bd30e-63d8-50c8-86eb-4b1ed537ab4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 1.4.5-tuxcare.5 of nuxt." } }, { "id": "CVE-2026-56301", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:911de1a0-9cb4-519f-bb57-9fb432f65dc3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56301 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 Nuxt 1.4.5-tuxcare.6 is not affected by CVE-2026-56301. The vulnerability exists in Nuxt's vite-node IPC server component, which was introduced in Nuxt 3.x (2022+) when the framework migrated from webpack to Vite. Version 1.4.5 (released ~2018) uses webpack exclusively and has no vite-node integration. Exhaustive searches confirmed zero vite/vite-node code, no node:net IPC server, and no Unix s...", "justification": "code_not_present" } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:4b45a20f-d428-5e06-973c-11777b2c1d30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 1.4.5-tuxcare.5 of nuxt." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:8d9e24ef-a32e-5921-9f74-8a5f6b1372d4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-56326. This CVE targets the path-normalization vulnerability in the navigateTo composable (Nuxt 3.x/4.x), which does not exist in Nuxt 1.4.5's architecture. The vulnerability requires URL constructor normalization that transforms /..//evil.com into //evil.com before output, enabling protocol-relative URL redirects. Nuxt 1.4.5 uses a redirect helper with st...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:c189b4a3-ccf2-5ce4-934f-3bb3ee83b130", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 1.4.5-tuxcare.5 of nuxt." } }, { "id": "CVE-2026-71315", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:809705a1-33a3-519b-a2bc-0f7324947065", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71315 affects version 1.4.5-tuxcare.5 of nuxt." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:a8743aad-7d79-5b6c-b06c-e2eff0087050", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 1.4.5-tuxcare.5 of nuxt. Nuxt 1.4.5 is not affected by CVE-2026-71316. The vulnerability requires `/_payload.json` endpoints that can return cached SSR data before route middleware enforcement - a feature that doesn't exist in Nuxt 1.4.5's architecture. This version uses a fundamentally different SSR model where all data is embedded in HTML responses and middleware is always enforced before rendering. The `_payload.json` endpoint pattern and `import.meta.prerender` mechanism are features of Nuxt 4.x's Nitro server architecture, not present in Nuxt 1.x's Connect-based architecture.", "justification": "code_not_present" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:7e876266-528e-5429-9390-73f5e53b8815", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71318 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-71318. The vulnerability concerns server islands (a feature that accepts props via the `/__nuxt_island/` endpoint and enables dynamic component resolution). Server islands were introduced in Nuxt 3.1.0 and do not exist in Nuxt 1.4.5. The target uses traditional Vue SSR with bundleRenderer and build-time component resolution, with no mechanism for accepting...", "justification": "code_not_present" } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:2a738243-a954-5d03-adcb-8e862c64d61e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 1.4.5-tuxcare.5 of nuxt." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:522f9a77-1ce9-5d2c-91cb-8c8b947257c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 1.4.5-tuxcare.5 of nuxt." } }, { "id": "CVE-2026-72744", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:dd7f5d6b-dcec-5ec9-a96a-744ec9653650", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-72744 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-72744. The vulnerability concerns the Chrome DevTools workspace endpoint (/.well-known/appspecific/com.chrome.devtools.json) and the experimental.chromeDevtoolsProjectSettings feature, which were introduced in Nuxt 3.x/4.x with the Nitro server architecture. This endpoint and feature do not exist in Nuxt 1.4.5, which predates the Nitro engine and uses a si...", "justification": "code_not_present" } }, { "id": "GHSA-2x6f-57hp-86fx", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:1d8017d6-a18a-5ec7-a9aa-f9d1365d7ec7", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-2x6f-57hp-86fx is a false positive for nuxt 1.4.5-tuxcare.5." } }, { "id": "GHSA-4jjw-pwvw-q6w3", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:19fbe587-86f8-5be6-84e6-06a9248cfbbe", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4jjw-pwvw-q6w3 is a false positive for nuxt 1.4.5-tuxcare.5." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:2074d7a5-5d62-5d09-829d-099b528935b5", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 The target repository (Nuxt 1.4.5) is not affected by GHSA-c9cv-mq2m-ppp3. The three vulnerabilities described in this advisory target APIs (navigateTo and reloadNuxtApp) that were introduced in Nuxt 3.x and do not exist in version 1.4.5. The target uses a fundamentally different navigation architecture that does not exhibit the vulnerable path-normalization behavior present in Nuxt 3.x/4.x.", "justification": "code_not_present" } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "bom-ref": "urn:uuid:46386088-f830-53ab-9a84-75b99408aaec", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 Nuxt 1.4.5 does not contain the vulnerable