{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c9d1fb98-c265-5654-9ed0-dd85a29da87b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "nuxt",
      "purl": "pkg:npm/nuxt@1.4.5-tuxcare.7",
      "type": "library",
      "bom-ref": "pkg:npm/nuxt@1.4.5-tuxcare.7",
      "version": "1.4.5-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "nuxt",
            "purl": "pkg:npm/nuxt@1.4.5",
            "type": "library",
            "version": "1.4.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-3224",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:f28e2351-d9ee-5edd-97af-8a9a99e1cd73",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-3224 does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 CVE-2023-3224 affects Nuxt 3.4.0-3.4.3 dev server with code injection when exposed publicly. Target is Nuxt 1.4.5, a fundamentally different major version. Nuxt 3 is a complete architectural rewrite (Vue 3, h3/nitro handlers, monorepo) versus Nuxt 1 (Vue 2, connect middleware, single package). Analysis of git history shows recent Nuxt 3/4 security fixes adding Host header validation (commits f8...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-34343",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:794d33fb-523a-58c0-bc57-193ba0bef303",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-34343 is fixed in version 1.4.5-tuxcare.7 of nuxt."
      }
    },
    {
      "id": "CVE-2024-34344",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:593bfb8b-44cc-5d03-8645-203b9650d1c1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-34344 affects version 1.4.5-tuxcare.7 of nuxt."
      }
    },
    {
      "id": "CVE-2025-27415",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:aa05b675-d80b-542c-8154-bb7ebf9ba631",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-27415 affects version 1.4.5-tuxcare.7 of nuxt."
      }
    },
    {
      "id": "CVE-2025-59414",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0697bd36-6bf4-5594-861d-ce5a42fe367c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-59414 does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2025-59414. The vulnerability exists in the Island component payload revival mechanism, which was introduced in Nuxt 3.x. This target version (1.4.5) predates that feature and uses a fundamentally different architecture for SSR hydration. The vulnerable code pattern (__nuxt_island objects, devalue serialization, Island payload revival) does not exist in this ve...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-114130",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:357b291a-dcc6-5398-b48c-0eb085a4b2ef",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-114130 is fixed in version 1.4.5-tuxcare.7 of nuxt."
      }
    },
    {
      "id": "CVE-2026-114131",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:887cf2bd-63ae-5011-b969-4491fa3cf7a1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-114131 does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 CVE-2026-114131 describes a percent-encoding bypass vulnerability in Nuxt's `routeRules` configuration, where route rules are matched against raw (unencoded) request paths while the router decodes paths, allowing attackers to bypass middleware protections by percent-encoding path characters. The target repository (Nuxt 1.4.5-tuxcare.6) is NOT AFFECTED because it uses a fundamentally different a...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-114132",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9613ce35-900e-57ed-ba9f-1b78f59fc58e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-114132 does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-114132. The vulnerability concerns case-sensitive route rule matching in Nitro (Nuxt 3/4's server framework), but Nuxt 1.x predates Nitro and uses a completely different architecture. The target lacks the `routeRules` configuration feature, `router.options.sensitive` setting, and Nitro's route rule matcher that are central to the vulnerability. The affecte...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-114133",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:f249b058-eb3c-566b-a7be-4a8069bcda15",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-114133 does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 The target (Nuxt 1.4.5-tuxcare.6) is not affected by CVE-2026-114133. This vulnerability affects Nuxt >=3.13.0 where server islands with `useHeadSafe` were introduced. The target uses a completely different architecture (vue-meta v1.4.3 for head management) that predates the vulnerable feature by multiple major versions. The CVE explicitly states \"Nuxt 2 is not affected\" and the target is Nuxt ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-119200",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:f48aa081-55f8-526f-86f1-3a72d567c3a7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-119200 does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 CVE-2026-119200 does not affect Nuxt 1.4.5-tuxcare.6. The vulnerability requires the Nitro server architecture introduced in Nuxt 4.6.0, which creates a mismatch between how Nitro's middleware sees request paths versus how Nuxt's page renderer resolves them. Version 1.4.5 predates Nitro entirely, uses connect middleware and vue-server-renderer directly, and both layers see the same unresolved p...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-120309",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:883ae370-0181-581a-94ab-8edba73351c6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-120309 does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 CVE-2026-120309 affects Nuxt 4.6.0-4.6.1 and involves route parameter confusion between getRouterParam/getRouterParams helper functions and h3's event.context.params. The target version (Nuxt 1.4.5-tuxcare.6) predates this vulnerability by several major versions. The vulnerable code patterns, functions, and architecture do not exist in this version. Nuxt 1.4.5 uses vue-router with a single para...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-45669",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:dea2593c-805e-554e-9c22-601390487647",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-45669 does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-45669. The vulnerability targets Nuxt 3.x/4.x's `navigateTo(url, { external: true })` composable, which generates server-side HTML redirect bodies containing `<meta http-equiv=\"refresh\">` tags with insufficiently encoded URLs. Nuxt 1.4.5 uses a completely different redirect architecture: server-side redirects are implemented via standard HTTP 302 responses...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-46342",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:7edeb89d-74f3-5045-aed1-ddd21293d43c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-46342 does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 Nuxt 1.4.5 does not have the Component Islands feature or the `/__nuxt_island/*` endpoint that CVE-2026-46342 targets. Component Islands were introduced in Nuxt 3.x (experimental) years after this version was released. The target uses classic Vue 2.x SSR with full-page rendering via vue-server-renderer, not the Nitro server engine with island handlers. The vulnerable code path does not exist in...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47200",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:7524d7dd-a301-5c70-ae93-a9f2ca484e28",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47200 does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 Target repository (Nuxt 1.4.5) does not contain the vulnerable component islands feature. The vulnerability (CVE-2026-47200) is specific to Nuxt 3.x/4.x with experimental.componentIslands enabled, which was introduced ~4 years after this version. The /__nuxt_island/ endpoint pattern and associated island context handling do not exist in the target's architecture.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-53721",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:81ac089a-9452-5843-b12c-8e08e9739b56",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53721 affects version 1.4.5-tuxcare.7 of nuxt."
      }
    },
    {
      "id": "CVE-2026-53722",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ccbd8826-a054-5708-994c-955e9f198e35",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53722 is fixed in version 1.4.5-tuxcare.7 of nuxt."
      }
    },
    {
      "id": "CVE-2026-56301",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:8d5ac2ac-d971-5c98-9c9d-1e443ce1458a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-56301 does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 Nuxt 1.4.5-tuxcare.6 is not affected by CVE-2026-56301. The vulnerability exists in Nuxt's vite-node IPC server component, which was introduced in Nuxt 3.x (2022+) when the framework migrated from webpack to Vite. Version 1.4.5 (released ~2018) uses webpack exclusively and has no vite-node integration. Exhaustive searches confirmed zero vite/vite-node code, no node:net IPC server, and no Unix s...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-56317",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d679a879-dfc4-56df-980d-d433f3d094e7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-56317 is fixed in version 1.4.5-tuxcare.7 of nuxt."
      }
    },
    {
      "id": "CVE-2026-56326",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:52eeb35f-7f23-5ce0-9ff8-22120511dca7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-56326 does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-56326. This CVE targets the path-normalization vulnerability in the navigateTo composable (Nuxt 3.x/4.x), which does not exist in Nuxt 1.4.5's architecture. The vulnerability requires URL constructor normalization that transforms /..//evil.com into //evil.com before output, enabling protocol-relative URL redirects. Nuxt 1.4.5 uses a redirect helper with st...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-71314",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e8fd0a1c-6511-5082-a734-2c0d6a292f40",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-71314 affects version 1.4.5-tuxcare.7 of nuxt."
      }
    },
    {
      "id": "CVE-2026-71315",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:2c6273ff-7f8d-5b3b-a810-6827be46b773",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-71315 affects version 1.4.5-tuxcare.7 of nuxt."
      }
    },
    {
      "id": "CVE-2026-71316",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:7e3593e0-40d2-5ab6-b9dd-ddcaeb641180",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-71316 does not affect version 1.4.5-tuxcare.7 of nuxt. Nuxt 1.4.5 is not affected by CVE-2026-71316. The vulnerability requires `/_payload.json` endpoints that can return cached SSR data before route middleware enforcement - a feature that doesn't exist in Nuxt 1.4.5's architecture. This version uses a fundamentally different SSR model where all data is embedded in HTML responses and middleware is always enforced before rendering. The `_payload.json` endpoint pattern and `import.meta.prerender` mechanism are features of Nuxt 4.x's Nitro server architecture, not present in Nuxt 1.x's Connect-based architecture.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-71318",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:4445dcf1-7ada-5947-a4e3-1974810cc9ac",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-71318 does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-71318. The vulnerability concerns server islands (a feature that accepts props via the `/__nuxt_island/` endpoint and enables dynamic component resolution). Server islands were introduced in Nuxt 3.1.0 and do not exist in Nuxt 1.4.5. The target uses traditional Vue SSR with bundleRenderer and build-time component resolution, with no mechanism for accepting...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-71320",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:204361e8-1930-5101-aa33-7ef0830848e7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-71320 affects version 1.4.5-tuxcare.7 of nuxt."
      }
    },
    {
      "id": "CVE-2026-71321",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:2a2b79a4-0be6-521c-bb8b-4606fe6040b9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-71321 affects version 1.4.5-tuxcare.7 of nuxt."
      }
    },
    {
      "id": "CVE-2026-72744",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:7fca75e8-d167-588b-89d5-b387a9db39c4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-72744 does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-72744. The vulnerability concerns the Chrome DevTools workspace endpoint (/.well-known/appspecific/com.chrome.devtools.json) and the experimental.chromeDevtoolsProjectSettings feature, which were introduced in Nuxt 3.x/4.x with the Nitro server architecture. This endpoint and feature do not exist in Nuxt 1.4.5, which predates the Nitro engine and uses a si...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-2x6f-57hp-86fx",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:08ba628e-e860-58bb-b7b0-d59203b5e2d8",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-2x6f-57hp-86fx is a false positive for nuxt 1.4.5-tuxcare.7."
      }
    },
    {
      "id": "GHSA-4jjw-pwvw-q6w3",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:5c1b296c-f696-53f7-812a-f38739eff9c5",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-4jjw-pwvw-q6w3 is a false positive for nuxt 1.4.5-tuxcare.7."
      }
    },
    {
      "id": "GHSA-c9cv-mq2m-ppp3",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:aee74d02-ce4d-5fa2-83eb-7e3b8f6c2b6b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 The target repository (Nuxt 1.4.5) is not affected by GHSA-c9cv-mq2m-ppp3. The three vulnerabilities described in this advisory target APIs (navigateTo and reloadNuxtApp) that were introduced in Nuxt 3.x and do not exist in version 1.4.5. The target uses a fundamentally different navigation architecture that does not exhibit the vulnerable path-normalization behavior present in Nuxt 3.x/4.x.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-m3q2-p4fw-w38m",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:fe25f359-2901-5b89-ab15-345e566077a0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 Nuxt 1.4.5 does not contain the vulnerable <NoScript> component. The vulnerability (GHSA-m3q2-p4fw-w38m) affects the <NoScript> component from @unhead/vue introduced in Nuxt 3.x. Version 1.4.5 uses a fundamentally different architecture (vue-meta library with config-based head management) that predates the vulnerable component by several years.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-rq7w-g337-39qq",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:fe202875-1880-5af1-9350-63dade995372",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-rq7w-g337-39qq does not affect version 1.4.5-tuxcare.7 of nuxt. not_affected \u2014 GHSA-rq7w-g337-39qq affects Nuxt 4.0.0-alpha.1 through 4.4.6 via an unauthenticated dev-server endpoint (/.well-known/appspecific/com.chrome.devtools.json) that exposes filesystem paths. The target is Nuxt 1.4.5-tuxcare.6, which predates version 3.x (explicitly marked as unaffected by the CVE). Version 1.4.5 uses Connect-based middleware without the Nitro server framework, the chrome devtools w...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-xppm-jmw6-fhmf",
      "affects": [
        {
          "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:a38233a5-1786-5345-8d8f-89a87a5734c9",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for nuxt 1.4.5-tuxcare.7."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/nuxt@1.4.5-tuxcare.7"
    }
  ]
}