{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:27b93dc3-d2fd-5990-b3a3-6395f9953c88", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@1.4.5-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/nuxt@1.4.5-tuxcare.6", "version": "1.4.5-tuxcare.6", "pedigree": { "ancestors": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@1.4.5", "type": "library", "version": "1.4.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-3224", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:43a696e9-3be3-5a8e-ac57-51a68260919f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-3224 does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 CVE-2023-3224 affects Nuxt 3.4.0-3.4.3 dev server with code injection when exposed publicly. Target is Nuxt 1.4.5, a fundamentally different major version. Nuxt 3 is a complete architectural rewrite (Vue 3, h3/nitro handlers, monorepo) versus Nuxt 1 (Vue 2, connect middleware, single package). Analysis of git history shows recent Nuxt 3/4 security fixes adding Host header validation (commits f8...", "justification": "code_not_present" } }, { "id": "CVE-2024-34343", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:bc3e4b53-87b3-5497-b51e-bd2562be63ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 1.4.5-tuxcare.6 of nuxt." } }, { "id": "CVE-2024-34344", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:c41553cd-d533-58b4-8197-9820afb62f00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34344 affects version 1.4.5-tuxcare.6 of nuxt." } }, { "id": "CVE-2025-27415", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:32143ae1-f46a-5f21-b9c6-b6e9d096bd62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 1.4.5-tuxcare.6 of nuxt." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:f152bafe-cd1b-5167-a4b9-cf331e5af284", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59414 does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2025-59414. The vulnerability exists in the Island component payload revival mechanism, which was introduced in Nuxt 3.x. This target version (1.4.5) predates that feature and uses a fundamentally different architecture for SSR hydration. The vulnerable code pattern (__nuxt_island objects, devalue serialization, Island payload revival) does not exist in this ve...", "justification": "code_not_present" } }, { "id": "CVE-2026-114130", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:6ac8f9aa-546d-57a3-b9a3-05550e42559c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114130 affects version 1.4.5-tuxcare.6 of nuxt, and is fixed in 1.4.5-tuxcare.7." } }, { "id": "CVE-2026-114131", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:ba3ee252-6e1f-5fb0-ac35-9e790e04efc4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114131 does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 CVE-2026-114131 describes a percent-encoding bypass vulnerability in Nuxt's `routeRules` configuration, where route rules are matched against raw (unencoded) request paths while the router decodes paths, allowing attackers to bypass middleware protections by percent-encoding path characters. The target repository (Nuxt 1.4.5-tuxcare.6) is NOT AFFECTED because it uses a fundamentally different a...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-114132", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:81a88685-d7d8-581e-bf56-c873b9b337a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114132 does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-114132. The vulnerability concerns case-sensitive route rule matching in Nitro (Nuxt 3/4's server framework), but Nuxt 1.x predates Nitro and uses a completely different architecture. The target lacks the `routeRules` configuration feature, `router.options.sensitive` setting, and Nitro's route rule matcher that are central to the vulnerability. The affecte...", "justification": "code_not_present" } }, { "id": "CVE-2026-114133", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:328bc09e-2e59-58fe-84d2-8cdc0ba1de08", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114133 does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 The target (Nuxt 1.4.5-tuxcare.6) is not affected by CVE-2026-114133. This vulnerability affects Nuxt >=3.13.0 where server islands with `useHeadSafe` were introduced. The target uses a completely different architecture (vue-meta v1.4.3 for head management) that predates the vulnerable feature by multiple major versions. The CVE explicitly states \"Nuxt 2 is not affected\" and the target is Nuxt ...", "justification": "code_not_present" } }, { "id": "CVE-2026-119200", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:7c2e2f27-8a29-5fba-8ae9-673580f3ee3a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-119200 does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 CVE-2026-119200 does not affect Nuxt 1.4.5-tuxcare.6. The vulnerability requires the Nitro server architecture introduced in Nuxt 4.6.0, which creates a mismatch between how Nitro's middleware sees request paths versus how Nuxt's page renderer resolves them. Version 1.4.5 predates Nitro entirely, uses connect middleware and vue-server-renderer directly, and both layers see the same unresolved p...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-120309", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:d7625abe-ae24-565e-931f-c72c0e0d9c6e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-120309 does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 CVE-2026-120309 affects Nuxt 4.6.0-4.6.1 and involves route parameter confusion between getRouterParam/getRouterParams helper functions and h3's event.context.params. The target version (Nuxt 1.4.5-tuxcare.6) predates this vulnerability by several major versions. The vulnerable code patterns, functions, and architecture do not exist in this version. Nuxt 1.4.5 uses vue-router with a single para...", "justification": "code_not_present" } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:327686bc-22be-5430-86ba-c6c3a78e799a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45669 does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-45669. The vulnerability targets Nuxt 3.x/4.x's `navigateTo(url, { external: true })` composable, which generates server-side HTML redirect bodies containing `` tags with insufficiently encoded URLs. Nuxt 1.4.5 uses a completely different redirect architecture: server-side redirects are implemented via standard HTTP 302 responses...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:3d9c6749-1537-5203-b6f0-762e1d1e84f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-46342 does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 Nuxt 1.4.5 does not have the Component Islands feature or the `/__nuxt_island/*` endpoint that CVE-2026-46342 targets. Component Islands were introduced in Nuxt 3.x (experimental) years after this version was released. The target uses classic Vue 2.x SSR with full-page rendering via vue-server-renderer, not the Nitro server engine with island handlers. The vulnerable code path does not exist in...", "justification": "code_not_present" } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:1f47e5dd-da34-5111-9267-eb3ec2ba21df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 Target repository (Nuxt 1.4.5) does not contain the vulnerable component islands feature. The vulnerability (CVE-2026-47200) is specific to Nuxt 3.x/4.x with experimental.componentIslands enabled, which was introduced ~4 years after this version. The /__nuxt_island/ endpoint pattern and associated island context handling do not exist in the target's architecture.", "justification": "code_not_present" } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:5be937ac-3803-5808-98f6-5adb5d07aeea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 1.4.5-tuxcare.6 of nuxt." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:0658c66a-9a52-5eec-a41e-e6f3d590e08a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 1.4.5-tuxcare.6 of nuxt." } }, { "id": "CVE-2026-56301", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:e6056809-54cb-5f95-91db-ca477f7858db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56301 does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 Nuxt 1.4.5-tuxcare.6 is not affected by CVE-2026-56301. The vulnerability exists in Nuxt's vite-node IPC server component, which was introduced in Nuxt 3.x (2022+) when the framework migrated from webpack to Vite. Version 1.4.5 (released ~2018) uses webpack exclusively and has no vite-node integration. Exhaustive searches confirmed zero vite/vite-node code, no node:net IPC server, and no Unix s...", "justification": "code_not_present" } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:8511fc36-3d96-56e6-b790-19228eef07d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 1.4.5-tuxcare.6 of nuxt." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:2623e2d6-bf81-59f7-b31a-904735772d42", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-56326. This CVE targets the path-normalization vulnerability in the navigateTo composable (Nuxt 3.x/4.x), which does not exist in Nuxt 1.4.5's architecture. The vulnerability requires URL constructor normalization that transforms /..//evil.com into //evil.com before output, enabling protocol-relative URL redirects. Nuxt 1.4.5 uses a redirect helper with st...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:3481414c-c414-5a7d-8a86-3880a37fd59d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 1.4.5-tuxcare.6 of nuxt." } }, { "id": "CVE-2026-71315", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:e8e0309d-e67a-5a34-aa81-aec0136ed814", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71315 affects version 1.4.5-tuxcare.6 of nuxt." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:1d9adf35-2497-5dc3-a2e2-6fd330393db3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 1.4.5-tuxcare.6 of nuxt. Nuxt 1.4.5 is not affected by CVE-2026-71316. The vulnerability requires `/_payload.json` endpoints that can return cached SSR data before route middleware enforcement - a feature that doesn't exist in Nuxt 1.4.5's architecture. This version uses a fundamentally different SSR model where all data is embedded in HTML responses and middleware is always enforced before rendering. The `_payload.json` endpoint pattern and `import.meta.prerender` mechanism are features of Nuxt 4.x's Nitro server architecture, not present in Nuxt 1.x's Connect-based architecture.", "justification": "code_not_present" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:51c782fb-96eb-53a6-b910-e3c2a6dd0299", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71318 does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-71318. The vulnerability concerns server islands (a feature that accepts props via the `/__nuxt_island/` endpoint and enables dynamic component resolution). Server islands were introduced in Nuxt 3.1.0 and do not exist in Nuxt 1.4.5. The target uses traditional Vue SSR with bundleRenderer and build-time component resolution, with no mechanism for accepting...", "justification": "code_not_present" } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:39bb92c0-e93a-5baf-be30-795c975273b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 1.4.5-tuxcare.6 of nuxt." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:2ccce405-6dcd-596f-96ed-ef2c475600e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 1.4.5-tuxcare.6 of nuxt." } }, { "id": "CVE-2026-72744", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:217e4ceb-8575-5eef-b55b-810105bc36e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-72744 does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-72744. The vulnerability concerns the Chrome DevTools workspace endpoint (/.well-known/appspecific/com.chrome.devtools.json) and the experimental.chromeDevtoolsProjectSettings feature, which were introduced in Nuxt 3.x/4.x with the Nitro server architecture. This endpoint and feature do not exist in Nuxt 1.4.5, which predates the Nitro engine and uses a si...", "justification": "code_not_present" } }, { "id": "GHSA-2x6f-57hp-86fx", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:b1497fcb-eb06-57c4-9540-6f9aa99989f5", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-2x6f-57hp-86fx is a false positive for nuxt 1.4.5-tuxcare.6." } }, { "id": "GHSA-4jjw-pwvw-q6w3", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:44b61780-e533-5053-b4f7-9b229f14da4c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4jjw-pwvw-q6w3 is a false positive for nuxt 1.4.5-tuxcare.6." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:e81423d9-e163-5fcb-bebb-93ff18e3ab51", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 The target repository (Nuxt 1.4.5) is not affected by GHSA-c9cv-mq2m-ppp3. The three vulnerabilities described in this advisory target APIs (navigateTo and reloadNuxtApp) that were introduced in Nuxt 3.x and do not exist in version 1.4.5. The target uses a fundamentally different navigation architecture that does not exhibit the vulnerable path-normalization behavior present in Nuxt 3.x/4.x.", "justification": "code_not_present" } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.6" } ], "bom-ref": "urn:uuid:56ca8bd2-1be3-55f6-86a6-3ee808cf7df9", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 1.4.5-tuxcare.6 of nuxt. not_affected \u2014 Nuxt 1.4.5 does not contain the vulnerable