{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5e35d623-57cb-527a-a960-e74578cfd848", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@2.18.1-tuxcare.9", "type": "library", "bom-ref": "pkg:npm/nuxt@2.18.1-tuxcare.9", "version": "2.18.1-tuxcare.9", "pedigree": { "ancestors": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@2.18.1", "type": "library", "version": "2.18.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-3224", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:664e4d5c-6ae1-5e7e-91f0-af1b41b0eefe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-3224 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected \u2014 CVE-2023-3224 targets Nuxt 3.4.0-3.4.3 dev server with Vite/Nitro architecture. Target Nuxt 2.18.1 uses a completely different Webpack-based dev server implementation. The vulnerable code path involving Nuxt 3's Vite/Nitro components is absent from Nuxt 2.x. No alternative code injection mechanism exists in Nuxt 2.18.1's dev server implementation. Confirmed by: (1) no Vite/Nitro packages in cod...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-34343", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:95f5bca5-7bd0-5c4b-8cfa-5730a42944db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 2.18.1-tuxcare.9 of nuxt." } }, { "id": "CVE-2024-34344", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:71a8a867-f7df-5fb5-b2fe-dc7818658f87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34344 affects version 2.18.1-tuxcare.9 of nuxt." } }, { "id": "CVE-2025-27415", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:f63da2ee-441d-526e-9457-fbe4a3034436", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 2.18.1-tuxcare.9 of nuxt." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:c868305b-6b05-56b3-b00a-656e2d57a23d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59414 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected \u2014 Nuxt 2.18.1 is not affected by CVE-2025-59414. The vulnerability affects Nuxt 3.x/4.x's Islands component feature and revive-payload mechanism, neither of which exist in Nuxt 2.x. The Islands architecture (allowing server components to be fetched as JSON payloads via `/__nuxt_island/{key}.json` endpoints) was introduced in Nuxt 3 and has no equivalent in Nuxt 2. The vulnerable code path (`packa...", "justification": "code_not_present" } }, { "id": "CVE-2026-114130", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:07c922e5-25b1-5b0b-ad2c-7df53ac08b09", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114130 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected \u2014 Nuxt 2.18.1 is NOT affected by CVE-2026-114130. This CVE specifically targets the router implementation used when `pages: false` (no pages directory), where Nuxt registers its own router instead of vue-router. Nuxt 2.x does not have this architectural mode\u2014it always uses vue-router for routing. The CVE explicitly states \"Applications using vue-router are not affected.\" Additionally, the CVE des...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-114131", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:4ba89e80-2e23-5062-bc98-51e4de5c5bdf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114131 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected \u2014 CVE-2026-114131 affects Nuxt 3.x and 4.x's routeRules feature, which allows configuration-based route protection via path-string matching. The vulnerability arises when routeRules keys are compared against raw (percent-encoded) request paths while the router decodes paths during resolution, enabling middleware bypass via percent-encoding. The target repository is Nuxt 2.18.1-tuxcare.9, which pr...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-114132", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:491e12a0-40a3-5d9a-bceb-5a86dbca5fb1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114132 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected \u2014 Nuxt 2.18.1 is not affected by CVE-2026-114132. The vulnerability concerns a case-sensitivity mismatch between Nitro's route-rule matcher and the page router in Nuxt 3/4. Nuxt 2 uses a completely different architecture (Connect middleware) and does not have the vulnerable components: no Nitro server engine, no `routeRules` configuration feature, and no pattern-based route rule matching system. ...", "justification": "code_not_present" } }, { "id": "CVE-2026-114133", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:e8ffd367-75aa-5729-be46-18632c307c9a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114133 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected \u2014 Nuxt 2.18.1 is not affected by CVE-2026-114133. The vulnerability is specific to server islands (experimental feature introduced in Nuxt 3.13+) where useHeadSafe entries are serialized without SafeInputPlugin filtering. Nuxt 2.18.1 lacks the entire server islands architecture, useHeadSafe composable, Nitro server, and vulnerable code path. The CVE explicitly states \"Nuxt 2 is not affected.\" Com...", "justification": "code_not_present" } }, { "id": "CVE-2026-119200", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:5281b77d-d472-5984-8768-b81b07211c77", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-119200 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected \u2014 Nuxt 2.18.1 does not have the vulnerable dot-segment resolution feature introduced in Nuxt 4.6.0. The target uses consistent path handling throughout: both server middleware and page router see the same un-resolved path via normalizeURL() from the ufo library, which does NOT resolve dot segments or decode percent-encoded path components. Requests with dot segments like /%2e/admin fail to match ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-120309", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:615ea907-3ea2-5f2f-916f-2617ab6997f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-120309 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected \u2014 CVE-2026-120309 describes a route parameter confusion vulnerability in Nuxt's getRouterParam/getRouterParams helpers (versions 4.6.0-4.6.2) where encoded question marks (%3F) cause parameter value divergence between Nuxt's helpers and h3's event.context.params. Nuxt 2.18.1 is not affected because: (1) it uses a fundamentally different architecture (Connect + Vue Router vs h3 + Nitro), (2) the v...", "justification": "code_not_present" } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:f6462f07-0428-5041-847e-f06e5844221f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45669 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected - CVE-2026-45669 is an XSS in the SSR branch of the Nuxt 3/4 navigateTo(url, {external:true}) composable, which builds a response body in packages/nuxt/src/app/composables/router.ts and percent-encodes only the double quote. nuxt 2.18.1 is the Nuxt 2 codebase: packages/nuxt/src/app/composables/router.ts does not exist and there is no navigateTo() composable at all - the only navigateTo mention on this branch is a comment inside the CVE-2024-34343 backport in packages/vue-app/template/components/nuxt-link.server.js. The vulnerable sink is absent." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:dd54924d-3d07-5206-aa6a-c83933f7c846", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-46342 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected - CVE-2026-46342 is a cache-poisoning / stored-XSS issue in the Nuxt 3/4 server-components (islands) feature: the /__nuxt_island/* endpoint renders any island component from attacker-controlled props without validating the _.json hash server-side. nuxt 2.18.1 does not implement islands at all - a blob search over the whole branch returns 0 files for '__nuxt_island', 'NuxtIsland', 'componentIslands' and even the bare substring 'island'. There is no such endpoint, no NuxtIsland component and no island renderer, so the vulnerable surface does not exist. For contrast, nuxt 4.0.3 (VPV 82361) carries the full implementation in packages/nuxt/src/app/components/nuxt-island.ts, island-renderer.ts and app/island-hash.ts." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:b0272603-7ef9-5203-afc3-e0d62f92e693", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected \u2014 The target repository (Nuxt 2.18.1-tuxcare.1) is not affected by CVE-2026-47200. This vulnerability requires the experimental.componentIslands feature and /__nuxt_island/ endpoint, which were introduced in Nuxt 3 and do not exist in Nuxt 2.x. The target uses a fundamentally different architecture where all SSR requests flow through a single unified middleware stack with no bypass mechanism.", "justification": "code_not_present" } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:edf7b112-ae8d-5df8-b730-590b5028c450", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 2.18.1-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:8dcdd698-6447-5667-92cc-0c053de3697c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 2.18.1-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-56301", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:6e7d3ae2-597b-5c54-8208-91759dd6ce52", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56301 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected \u2014 Nuxt 2.18.1 is not affected by CVE-2026-56301. The vulnerability exists in Nuxt 3+/4+'s vite-node IPC server, which binds to an abstract namespace Unix socket on Linux without permission checks, allowing local unprivileged users to read arbitrary files. Nuxt 2.18.1 uses Webpack (not Vite) and does not contain the vite-node component. The affected file (packages/vite/src/plugins/vite-node.ts) an...", "justification": "code_not_present" } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:17a6a07e-23bb-5403-92fe-9c0a12589a0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 2.18.1-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:2d046527-80d0-5e40-a162-7052e74d9edb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected - CVE-2026-56326 covers three weaknesses in the Nuxt 3/4 client-navigation APIs: the SSR open redirect in navigateTo() (hasProtocol path-normalisation bypass feeding the Location header and the meta-refresh body), reflected XSS via navigateTo(url, {open: {...}}), and the protocol-relative bypass in reloadNuxtApp(). nuxt 2.18.1 is the Nuxt 2 codebase and exposes none of those APIs: there is no packages/nuxt/src/app/composables/router.ts, no navigateTo() composable and no reloadNuxtApp() anywhere on the branch (grep: 0 hits). hasProtocol exists only as an unrelated Nuxt 2 helper in packages/utils/src/lang.js, and the isScriptProtocol references in packages/vue-app/template/ belong to the earlier CVE-2024-34343 backport, not to the sinks in this advisory. Consistent with nuxt 0.10.7 (VPV 108302), 1.4.5 (VPV 108303) and 3.2.0 (VPV 108308), all already marked not_affected." } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:005a05f5-a97a-54bf-b752-23f8652b3e25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 2.18.1-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-71315", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:4975c6d4-d655-58a2-942f-cf542ea50a07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71315 affects version 2.18.1-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:b2233f40-e541-5d76-be80-b32598f19545", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 2.18.1-tuxcare.9 of nuxt. Nuxt 2.18.1 is not affected by CVE-2026-71316. The vulnerability is specific to Nuxt 4.x (versions 4.4.0-4.5.1) and requires the Nitro server engine with runtime payload caching for `_payload.json` endpoints. Nuxt 2.18.1 uses a completely different architecture: it has no Nitro server, no `_payload.json` endpoints (uses `payload.js` with JSONP instead), no runtime caching mechanism, and no `import.meta.prerender` concept. The vulnerable code path does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:39d046f2-cc10-558b-b924-6699f929c3b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71318 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected \u2014 Nuxt 2.18.1 is NOT affected by CVE-2026-71318. The vulnerability concerns server islands accepting props via the `/__nuxt_island/` endpoint and allowing arbitrary component instantiation through attribute fallthrough to polymorphic components. Server islands were introduced in Nuxt 3.1.0 and do not exist in Nuxt 2.x. The target lacks the entire server islands infrastructure: no `/__nuxt_island/...", "justification": "code_not_present" } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:8b8a3623-07c5-567f-9170-b723f35d718a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 2.18.1-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:496683e8-1f0f-5a53-86ff-cc33b635e557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 2.18.1-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-72744", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:4621db02-4144-5011-8131-77def1e5fa26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-72744 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected \u2014 The target Nuxt 2.18.1-tuxcare.9 is not affected by CVE-2026-72744. This CVE concerns the Chrome DevTools workspace endpoint (/.well-known/appspecific/com.chrome.devtools.json) that discloses absolute filesystem paths and workspace UUIDs in Nuxt 3.x/4.x versions. This endpoint and the associated Nitro server architecture do not exist in Nuxt 2.x. Nuxt 2.x uses a fundamentally different server a...", "justification": "code_not_present" } }, { "id": "GHSA-2x6f-57hp-86fx", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:33d09cc3-4fcb-538a-a28c-ed1263d7bd08", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-2x6f-57hp-86fx is a false positive for nuxt 2.18.1-tuxcare.9." } }, { "id": "GHSA-4jjw-pwvw-q6w3", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:839a714f-6170-5a4f-b80d-adb3d032196a", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4jjw-pwvw-q6w3 is a false positive for nuxt 2.18.1-tuxcare.9." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:93b42049-ad44-571f-ac91-3c0316fb31c1", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected \u2014 The target repository (Nuxt 2.18.1-tuxcare.1) is NOT affected by GHSA-c9cv-mq2m-ppp3. This CVE targets three specific vulnerabilities in Nuxt 3.x/4.x architecture: (1) path-normalization bypass in navigateTo, (2) script execution via navigateTo({open}), and (3) protocol-relative bypass in reloadNuxtApp. None of these code paths exist in Nuxt 2.x, which uses a fundamentally different architectur...", "justification": "code_not_present" } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/nuxt@2.18.1-tuxcare.9" } ], "bom-ref": "urn:uuid:43a29eca-df15-506c-b260-07be27780373", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 2.18.1-tuxcare.9 of nuxt. not_affected \u2014 Nuxt 2.18.1 is not affected by GHSA-m3q2-p4fw-w38m. The vulnerability targets the