{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6eedcd1f-70bc-555a-b49e-2243f3f2005c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@3.12.3-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/nuxt@3.12.3-tuxcare.10", "version": "3.12.3-tuxcare.10", "pedigree": { "ancestors": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@3.12.3", "type": "library", "version": "3.12.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25852", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:500100bb-984a-5240-81d2-b86ab9736bf3", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for nuxt 3.12.3-tuxcare.10. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." } }, { "id": "CVE-2023-3224", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:259a5373-2e83-511c-8fd8-a103bf8ff332", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-3224 does not affect version 3.12.3-tuxcare.10 of nuxt. not_affected \u2014 CVE-2023-3224 affects Nuxt dev server versions 3.4.0-3.4.3 (April 2023). Target version 3.12.3 is significantly newer and includes the upstream fix that was applied in v3.5.0 (May 2023). The vulnerable code pattern is not present in the target. Multiple security protections are in place including file serving restrictions (fs.allow), access controls (isFileServingAllowed), and same-origin valid...", "justification": "code_not_present" } }, { "id": "CVE-2024-34343", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:961fc2c7-7b42-53c3-ae61-1a286fcf9f98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2024-34344", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:967a93c6-4b33-58e1-b223-288d865aff58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2025-24361", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:16779ade-ae3c-58df-b345-fbe10f6af2d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24361 affects version 3.12.3-tuxcare.10 of nuxt, and is fixed in 3.12.3-tuxcare.12." } }, { "id": "CVE-2025-27415", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:f6851959-621d-57f1-a56a-1971c4fded85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:800e550e-11e5-5894-bf0f-104bb6da01a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2026-114130", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:34904f51-a6ab-528f-804b-a5c88b35ea8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114130 affects version 3.12.3-tuxcare.10 of nuxt, and is fixed in 3.12.3-tuxcare.14." } }, { "id": "CVE-2026-114131", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:9b6051b8-293d-577a-9678-8ab785d842c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114131 affects version 3.12.3-tuxcare.10 of nuxt, and is fixed in 3.12.3-tuxcare.14." } }, { "id": "CVE-2026-114132", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:3a9495f1-c212-5867-9493-805b15c40a3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114132 affects version 3.12.3-tuxcare.10 of nuxt, and is fixed in 3.12.3-tuxcare.13." } }, { "id": "CVE-2026-114133", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:c6e0b2ad-b13c-5bbb-b228-2a80e8425653", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114133 does not affect version 3.12.3-tuxcare.10 of nuxt. not_affected \u2014 Version 3.12.3 is not affected by CVE-2026-114133. The vulnerability requires server islands to serialize full SerializableHead (including bodyAttrs with event handlers, executable script content, and meta tags) into island responses. However, version 3.12.3 only serializes 'link' and 'style' tags in island responses. The feature \"allow server islands to manipulate head\" (commit 3f1db54b8) that...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-119200", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:ba09fa33-dc72-51c5-bd23-0608ce6b8d39", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-119200 does not affect version 3.12.3-tuxcare.10 of nuxt. not_affected \u2014 Target version 3.12.3 is NOT AFFECTED by CVE-2026-119200. The vulnerability was introduced in Nuxt v4.6.0 via path normalization code in the packages/nitro-server module that does not exist in v3.x. The CVE explicitly states \"Not affected: Nuxt 3.x and 4.0.0 to 4.5.x, which pass the path to the page router unchanged, so these requests 404.\" Version 3.12.3 lacks the vulnerable code pattern entir...", "justification": "code_not_present" } }, { "id": "CVE-2026-120309", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:2dd7dc39-67c7-5da4-88c4-a271ffb44228", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-120309 does not affect version 3.12.3-tuxcare.10 of nuxt. not_affected \u2014 Nuxt 3.12.3-tuxcare.13 is not affected by CVE-2026-120309. The vulnerable functions `getRouterParam` and `getRouterParams` do not exist in this version\u2014they were introduced later in Nuxt 4.6.0. The route parameter confusion vulnerability described in the CVE cannot occur in version 3.12.3 because the affected code is not present.", "justification": "code_not_present" } }, { "id": "CVE-2026-41305", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:173ca1c0-ab27-5853-87ac-9480c80fa4dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2026-42338", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:28abf99e-170d-5a90-8f1d-24fcf3bf7ed9", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 3.12.3-tuxcare.10. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:1cc9fc38-9e6b-5906-b306-466dd78a723f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2026-45670", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:cd76a738-1b16-58dc-ab14-f26eed519472", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45670 affects version 3.12.3-tuxcare.10 of nuxt, and is fixed in 3.12.3-tuxcare.12." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:75b7fd77-2771-5eec-bcac-150bd0a5c359", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:db5f64bc-b10e-5273-8de2-72b1a3937670", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47200 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2026-49993", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:f0669106-de95-5411-ac8b-d5d19f139bc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49993 affects version 3.12.3-tuxcare.10 of nuxt, and is fixed in 3.12.3-tuxcare.12." } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:e6e49f02-296a-5d3d-820a-84d5e21634e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:caab6453-b274-58e1-9532-9ee28e85521b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2026-56301", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:099fa909-833e-5e76-a4f4-460f34b2656c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56301 does not affect version 3.12.3-tuxcare.10 of nuxt. not_affected \u2014 Target version 3.12.3-tuxcare.13 does not contain the vulnerable socket-based vite-node IPC implementation. The vulnerability was introduced in Nuxt v3.18.0 (June 2025) when socket-based IPC with abstract namespace sockets replaced the HTTP middleware approach. Version 3.12.3 uses HTTP middleware with file-serving restrictions (isFileServingAllowed) and completely lacks the abstract namespace s...", "justification": "code_not_present" } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:fe3b03b5-1f18-5abe-9755-7201cdf4880a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:33c620c8-03d4-5bbd-9516-fc29520cd1af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:34764e00-6327-5dce-a7dd-249a9d2e5da0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71314 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2026-71315", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:0fa2f4f3-9f23-59c0-a9fd-2719f5224dfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71315 affects version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:e0afc520-aae5-5db9-8b7a-67403cd58628", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.10 of nuxt. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:dbb20ecc-5233-59cb-8a18-5741cdca13e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71318 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:6a576cc8-e3fc-5ab4-b3cd-316508a3e93e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71320 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:5fb8ffbe-a381-57bc-aed5-a09a55823885", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71321 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "CVE-2026-72744", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:ff9b7886-3ebc-5443-a364-ee06cb04675b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-72744 does not affect version 3.12.3-tuxcare.10 of nuxt. not_affected \u2014 Target version 3.12.3-tuxcare.13 is not affected by CVE-2026-72744 because the Chrome DevTools workspace endpoint feature was introduced in Nuxt v3.18.0, which is 5 minor versions after the target. The vulnerable endpoint `/.well-known/appspecific/com.chrome.devtools.json` and all related code (experimental.chromeDevtoolsProjectSettings, workspace.root, workspace.uuid disclosure) are absent fro...", "justification": "code_not_present" } }, { "id": "GHSA-2x6f-57hp-86fx", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:8b364f91-1aca-5f2b-96f6-a259e05bfed6", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-2x6f-57hp-86fx is a false positive for nuxt 3.12.3-tuxcare.10." } }, { "id": "GHSA-4jjw-pwvw-q6w3", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:8c9b3332-cae1-59a9-add2-b87ac8d0ced6", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4jjw-pwvw-q6w3 is a false positive for nuxt 3.12.3-tuxcare.10." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:beb78129-28cc-575a-b4d6-9ccb5cfd631b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.10 of nuxt." } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:7c86542d-e9c6-5390-ac70-6284b497ac50", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.10 of nuxt. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur...", "justification": "code_not_present" } }, { "id": "GHSA-rq7w-g337-39qq", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:141db731-7666-50c1-869d-c5a3d9b4dad3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-rq7w-g337-39qq does not affect version 3.12.3-tuxcare.10 of nuxt. not_affected \u2014 Target is Nuxt 3.12.3-tuxcare.13. The vulnerable chrome devtools endpoint (/.well-known/appspecific/com.chrome.devtools.json) does not exist in Nuxt 3.x. The CVE explicitly states \"Affected versions: nuxt@4.0.0-alpha.1 through nuxt@4.4.6. 3.x is not affected.\" The experimental.chromeDevtoolsProjectSettings feature and its associated endpoint were introduced in Nuxt 4.0.0-alpha.1, after the 3.x ...", "justification": "code_not_present" } }, { "id": "GHSA-xppm-jmw6-fhmf", "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ], "bom-ref": "urn:uuid:2178af7f-1ccc-507e-8c0f-6d5bf8f1b543", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for nuxt 3.12.3-tuxcare.10." } } ], "dependencies": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.10" } ] }