{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3f55acef-c312-5b04-82c7-f507a8455ad9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@3.12.4-tuxcare.11", "type": "library", "bom-ref": "pkg:npm/nuxt@3.12.4-tuxcare.11", "version": "3.12.4-tuxcare.11", "pedigree": { "ancestors": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@3.12.4", "type": "library", "version": "3.12.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25852", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:2cdf5a71-d3dd-51da-b2f9-b5587ecc5886", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for nuxt 3.12.4-tuxcare.11. CVE-2022-25852 is a wrong-project match. The advisory concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt.js version 3.12.4-tuxcare.9, a Vue.js web application framework. The Product-Identity Check found no connection between the projects: (a) target identity is Nuxt.js per package.json and README; (b) advisory product is pg-native/libpq; (c) exhaustive containment search found zero occurrences of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. No native addons or PostgreSQL-related code exists anywhere in the repository." } }, { "id": "CVE-2023-3224", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:86edc926-2409-54f2-9147-dde4f22b0a9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-3224 does not affect version 3.12.4-tuxcare.11 of nuxt. not_affected \u2014 CVE-2023-3224 affects Nuxt dev server versions 3.4.0-3.4.3 (specifically 3.4.0-3.4.1 based on git history). The vulnerability allowed arbitrary file read via the `/__nuxt_vite_node__/module/` endpoint, which accepted unsanitized file paths. Target version 3.12.4 contains the upstream fix (commit 886350a27, April 18, 2023) that adds `isFileServingAllowed()` validation to restrict file access to ...", "justification": "code_not_present" } }, { "id": "CVE-2024-34343", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:4a0e50e5-2ae0-50bc-9fb7-c75e6298ad85", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-34343 does not affect version 3.12.4-tuxcare.11 of nuxt. not_affected \u2014 CVE-2024-34343 (XSS via script protocol bypass in navigateTo) is NOT present in target version 3.12.4. The vulnerable code pattern that used ufo's parseURL function was already fixed in the upstream release via commit 5f0693a69 (May 7, 2024) by Daniel Roe. The target code uses the native URL() constructor instead of the vulnerable parseURL function, and properly validates protocols with isScrip...", "justification": "code_not_present" } }, { "id": "CVE-2024-34344", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:0714a3b9-9881-5043-b36c-cd29bda3a2f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34344 affects version 3.12.4-tuxcare.11 of nuxt." } }, { "id": "CVE-2025-24361", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:215d1837-5e93-53f0-84df-f3b0e1ef5c72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24361 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.16." } }, { "id": "CVE-2025-27415", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:f6769e20-0ebd-506a-8e97-1cd04301dc18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.12." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:e0f26231-206b-5be7-91ea-0e31b40e8c4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59414 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.12." } }, { "id": "CVE-2026-114130", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:c90a9624-f98d-57f2-87f7-f0d8a3a10ef2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114130 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.20." } }, { "id": "CVE-2026-114131", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:eb4f8c08-6c61-5e02-9bfb-a1fbfde90133", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114131 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.20." } }, { "id": "CVE-2026-114132", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:b80db270-4779-5446-8eb5-e10ecb0b8f5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114132 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.19." } }, { "id": "CVE-2026-114133", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:1360a065-68b3-5b4f-a548-67fa72a7480c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114133 does not affect version 3.12.4-tuxcare.11 of nuxt. not_affected \u2014 Target version 3.12.4 is not affected by CVE-2026-114133. The vulnerability requires full head support for server islands, which was introduced in Nuxt v3.13.0 (commit 3f1db54b8). In version 3.12.4, server island responses only serialize link and style tags, not the complete head entries (bodyAttrs, meta, scripts, etc.) that could contain unsafe content from useHeadSafe. The vulnerable code pat...", "justification": "code_not_present" } }, { "id": "CVE-2026-119200", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:716fb6d9-eb06-5ac4-b6ce-1c9092c04d31", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-119200 does not affect version 3.12.4-tuxcare.11 of nuxt. not_affected \u2014 Nuxt 3.12.4-tuxcare.19 is NOT affected by CVE-2026-119200. The CVE explicitly states that only Nuxt 4.6.0-4.6.2 is vulnerable, and that \"Nuxt 3.x and 4.0.0 to 4.5.x\" are not affected because they \"pass the path to the page router unchanged, so these requests 404.\" The target version (3.12.4) does not contain the vulnerable code pattern introduced in Nuxt 4.6.0.", "justification": "code_not_present" } }, { "id": "CVE-2026-120309", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:5aaecf82-0ba6-5825-b6f5-8e3e6722c87e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-120309 does not affect version 3.12.4-tuxcare.11 of nuxt. not_affected \u2014 CVE-2026-120309 affects Nuxt 4.6.0 before 4.6.2 and concerns route parameter confusion in the getRouterParam and getRouterParams helper functions. Nuxt 3.12.4 predates these functions by multiple major versions - they were introduced in commit 158901fde (September 2026) which is only present in versions 4.6.0+. Exhaustive search confirms these functions do not exist in the target codebase. The ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41305", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:3c5dfcd2-8ea4-5f08-ba3e-2bccc78967ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.4-tuxcare.11 of nuxt." } }, { "id": "CVE-2026-42338", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:24f03b41-574c-5c97-993c-e52150e0bf3d", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 3.12.4-tuxcare.11. false_positive \u2014 CVE-2026-42338 is a false positive match for this repository. The CVE concerns the 'ip-address' npm package (specifically XSS vulnerabilities in the Address6 class), but this repository is 'nuxt' (Nuxt.js web framework version 3.12.4-tuxcare.5). Exhaustive search confirmed that the ip-address package is not present in this repository as the project itself, as a vendored/bundled copy, or as a de..." } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:b9d3bf16-c94e-5cf9-abde-31f1a631284d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.12." } }, { "id": "CVE-2026-45670", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:e7da2e00-d602-50c5-a267-85e7d39d4ad7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45670 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.16." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:e165883b-589f-5da7-b555-4610a06e13ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.12." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:f5584c53-646b-57fb-8913-145c15fc4c0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.12." } }, { "id": "CVE-2026-49993", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:c60f40c3-a1ec-5427-a145-cec43cc34e72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49993 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.16." } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:7f2042ab-d766-5a2c-bb7f-a5683a7dca9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.4-tuxcare.11 of nuxt." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:cb7ea10b-9e74-5c59-9dc9-b34e248fb125", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.4-tuxcare.11 of nuxt." } }, { "id": "CVE-2026-56301", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:b94ed315-6eaa-59d8-be51-4751fe634ef9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56301 does not affect version 3.12.4-tuxcare.11 of nuxt. not_affected \u2014 Version 3.12.4-tuxcare.19 is not affected by CVE-2026-56301. The vulnerability affects Nuxt versions that use Unix socket IPC servers for vite-node communication, specifically on Linux with abstract-namespace sockets that lack filesystem permissions. Version 3.12.4 predates the introduction of this Unix socket architecture entirely - it uses the older HTTP middleware approach at `/__nuxt_vite_n...", "justification": "code_not_present" } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:077726ab-82e1-5ef8-9f19-bb172990a5c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56317 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.12." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:f96d47c2-b54a-53fc-9159-fa9641239f22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.12." } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:88acb9fc-ebe2-555c-b3f1-bc4bc3df0942", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.12." } }, { "id": "CVE-2026-71315", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:87903fbe-8a58-59da-a031-38a92a68f15e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71315 affects version 3.12.4-tuxcare.11 of nuxt." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:f2d81eeb-2c6c-54ad-8387-452ed7e4ac7f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.4-tuxcare.11 of nuxt. Nuxt version 3.12.4 is NOT affected by CVE-2026-71316. The vulnerability is specific to Nuxt 4.4.0-4.5.1 and relies on runtime payload caching architecture introduced in Nuxt 4.x. In version 3.12.4, the payload cache mechanism is tied to `import.meta.prerender` and designed exclusively for build-time static site generation, not runtime request caching. The vulnerable code path that returns cached payloads before middleware execution is not reachable in normal production deployments of Nuxt 3.x because the cache is only populated during prerendering and contains static data, not user-specific SSR data. Between versions 3.12.4 and 4.4.0, Nuxt underwent a major architecture change (renderer.ts was removed/relocated, and a new runtime caching system was introduced) that fundamentally altered how payload caching works.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:6d64d2c4-dc21-582c-a050-303901381094", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.12." } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:41b31ba0-f3da-58f5-8998-f44ea66600f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.12." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:2c6b5501-7c4f-52c9-90f2-205cc629730c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.12.4-tuxcare.11 of nuxt, and is fixed in 3.12.4-tuxcare.12." } }, { "id": "CVE-2026-72744", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:e6fdf102-7d6d-5315-ae09-135f4135dcb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-72744 does not affect version 3.12.4-tuxcare.11 of nuxt. not_affected \u2014 The Chrome DevTools workspace endpoint feature that CVE-2026-72744 affects does not exist in Nuxt v3.12.4. The feature was introduced in v3.18.0 (commit 59ae82959) and fixed for CVE-2026-72744 in v3.21.10 (commit 00f71bb6) and v4.5.1 (commit 0769c4f9b). Since the target version 3.12.4 predates the feature introduction, the vulnerable code path is not present in this version.", "justification": "code_not_present" } }, { "id": "GHSA-2x6f-57hp-86fx", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:06423b5f-1cd9-54fc-a315-1e13d1c4e188", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-2x6f-57hp-86fx is a false positive for nuxt 3.12.4-tuxcare.11." } }, { "id": "GHSA-4jjw-pwvw-q6w3", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:a9bdb58c-ce33-5137-8f1f-dadf6caf2a20", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4jjw-pwvw-q6w3 is a false positive for nuxt 3.12.4-tuxcare.11." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:aff6a2a5-47b2-5101-8dbb-c2d2928853f5", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.4-tuxcare.11 of nuxt." } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:728653a1-7217-579d-bd0f-8e163403494a", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.4-tuxcare.11 of nuxt. not_affected \u2014 Target version (nuxt@3.12.4-tuxcare.5) is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerability was introduced 1754 commits AFTER v3.12.4 when Nuxt upgraded from unhead v1 to v2 in v3.16.0. The target uses a fundamentally different, older implementation that does not contain the vulnerable innerHTML pattern.", "justification": "code_not_present" } }, { "id": "GHSA-rq7w-g337-39qq", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:9c4164b3-65b5-5694-a5c2-392668587ede", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-rq7w-g337-39qq does not affect version 3.12.4-tuxcare.11 of nuxt. not_affected \u2014 Target Nuxt 3.12.4 is NOT affected by GHSA-rq7w-g337-39qq. The vulnerability concerns a Chrome DevTools workspace integration feature that exposes filesystem paths via an unauthenticated dev-server route `/.well-known/appspecific/com.chrome.devtools.json`. This feature was introduced in Nuxt 4.0.0-alpha.1 and does not exist in any 3.x version. The CVE explicitly states \"3.x is not affected.\" Ex...", "justification": "code_not_present" } }, { "id": "GHSA-xppm-jmw6-fhmf", "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ], "bom-ref": "urn:uuid:20f3f9a3-cecd-5693-bbaa-37a5eddaa1b0", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for nuxt 3.12.4-tuxcare.11." } } ], "dependencies": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.11" } ] }