{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5e3e316a-03e4-542d-9b41-9f71e547039d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@3.2.0-tuxcare.9", "type": "library", "bom-ref": "pkg:npm/nuxt@3.2.0-tuxcare.9", "version": "3.2.0-tuxcare.9", "pedigree": { "ancestors": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@3.2.0", "type": "library", "version": "3.2.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25852", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:562aacf5-f877-5d2d-a42c-ad7e105b1c4b", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for nuxt 3.2.0-tuxcare.9. CVE-2022-25852 is a false positive for this repository. The CVE affects pg-native and libpq npm packages (PostgreSQL database client bindings), but this repository is the Nuxt.js web framework (version 3.2.0-tuxcare.4). Exhaustive containment search found no pg-native/libpq code in the repository - not as the project itself, not as a vendored/bundled copy, and not as a declared dependency. This is a wrong-project match." } }, { "id": "CVE-2023-3224", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:0d0b385f-47cf-5ad7-b6dc-c4faeba2685c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3224 affects version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2024-34343", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:45e55c57-654a-593e-bb2b-3c1b92d3d40c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2024-34344", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:411cf870-9d38-57d5-b034-0b528e1638e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34344 affects version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2025-24361", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:0edbfd6d-30b0-5364-b534-8d3cc4fb289b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2025-27415", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:23b33176-26ea-5d28-8f59-5320e0e584a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:860241c6-3f8f-57af-9af6-628d32fb8cad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59414 does not affect version 3.2.0-tuxcare.9 of nuxt. not_affected \u2014 Version 3.2.0 is NOT AFFECTED by CVE-2025-59414. The vulnerability requires the revive-payload mechanism (revive-payload.server.ts and revive-payload.client.ts) which does not exist in this version. These files were introduced in commit 19fc2828f (v3.5.3+), 726 commits after v3.2.0. Without the payload revival mechanism, the attack chain described in the CVE (deserializing __nuxt_island objects...", "justification": "code_not_present" } }, { "id": "CVE-2026-114130", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:ea5c637d-fac5-5827-b947-aecc2e97bdaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114130 affects version 3.2.0-tuxcare.9 of nuxt, and is fixed in 3.2.0-tuxcare.12." } }, { "id": "CVE-2026-114131", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:4bacc491-091c-5e5d-871f-5359c79e7765", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114131 affects version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-114132", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:f1f1710d-5c53-5510-a0da-3a7eb2293790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114132 affects version 3.2.0-tuxcare.9 of nuxt, and is fixed in 3.2.0-tuxcare.11." } }, { "id": "CVE-2026-114133", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:958012f1-f817-5016-b859-80c7fe2f150e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114133 does not affect version 3.2.0-tuxcare.9 of nuxt. not_affected \u2014 The target (Nuxt 3.2.0-tuxcare.11) is not affected by CVE-2026-114133. This version has limited island head support that only includes link and style tags in island responses. The vulnerable code path - serializing full head objects including bodyAttrs (with event handlers like onload) and executable script tags through useHeadSafe in server islands - does not exist in this version. The CVE exp...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-119200", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:6015401d-9e1c-58dd-9211-ac9435cdb29a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-119200 does not affect version 3.2.0-tuxcare.9 of nuxt. not_affected \u2014 Nuxt 3.2.0 is NOT AFFECTED by CVE-2026-119200. The vulnerability only affects Nuxt 4.6.0-4.6.2, where a new rendering architecture resolves dot segments in request paths before page rendering, creating a mismatch between middleware path checks and actual rendered pages. Nuxt 3.2.0 uses a fundamentally different architecture that passes paths unchanged to vue-router, causing requests like `/%2e/...", "justification": "code_not_present" } }, { "id": "CVE-2026-120309", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:5fb53008-bee3-561e-82fb-be84f999540e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-120309 does not affect version 3.2.0-tuxcare.9 of nuxt. not_affected \u2014 Target version 3.2.0-tuxcare.11 is not affected by CVE-2026-120309. The vulnerability requires two distinct route parameter extraction mechanisms (getRouterParam/getRouterParams helpers vs event.context.params) that can return divergent values when processing encoded question marks (%3F). Version 3.2.0 only provides a single mechanism (event.context.params), making parameter confusion impossibl...", "justification": "code_not_present" } }, { "id": "CVE-2026-41305", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:d1d17d95-9ec6-5dc2-8706-d1c845a27e55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-42338", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:86afa5ae-a97d-5465-9f97-07831df18528", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 3.2.0-tuxcare.9. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (IPv6/IPv4 address parsing), but this repository is Nuxt v3.2.0-tuxcare.1 (a Vue.js meta-framework). The affected component is not present in this repository as a vendored copy, dependency, or in any other form. This is a wrong-project match." } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:38c52eac-b8e6-5cda-9082-4027e0cc156c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45669 does not affect version 3.2.0-tuxcare.9 of nuxt. not_affected - CVE-2026-45669 requires the SSR redirect body that navigateTo(url, {external:true}) builds in packages/nuxt/src/app/composables/router.ts (nuxtApp.ssrContext['~renderResponse'] with only the double quote percent-encoded). In nuxt 3.2.0 that code does not exist: the server-side external branch of navigateTo delegates to h3 sendRedirect(event, redirectLocation, code) and builds no HTML body. Grep over the branch: '%22' - 0 hits in source, 'renderResponse' - only packages/nuxt/src/core/runtime/nitro/renderer.ts. The sink appears in later majors: 4.0.3 has it and carries patches/CVE-2026-45669.patch." } }, { "id": "CVE-2026-45670", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:3b2b8e90-abf1-5038-9bf7-db9142ffda4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45670 is fixed in version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:f8bfdeac-f6d5-55c4-917e-e0b9acbbcd6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:2864b03e-277c-59e1-b5b5-20c6f2dee01e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 3.2.0-tuxcare.9 of nuxt. not_affected \u2014 Nuxt version 3.2.0 does not contain the server-only pages feature that is the prerequisite for CVE-2026-47200. The vulnerable code pattern (`.server.vue` pages rendered as islands via `/__nuxt_island/page_*` endpoint) was introduced in Nuxt v3.11.0, which is 2,059 commits after v3.2.0. The target version predates the feature by multiple major versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-49993", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:c7f734d0-1b03-5482-835b-df5464a409e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49993 is fixed in version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:c7d7ca53-4390-539f-9d12-faee7b5be9dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:53f63e96-d2f0-5072-8b9f-4f1927785813", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-56301", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:56c7dca8-f27d-5d2b-9901-cc642549a86d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56301 does not affect version 3.2.0-tuxcare.9 of nuxt. not_affected \u2014 Version 3.2.0-tuxcare.11 is NOT AFFECTED by CVE-2026-56301. The vulnerability requires Nuxt's Unix socket IPC server for vite-node, which binds to a Linux abstract-namespace socket without authentication. This feature was introduced in commit db35e7492 (June 25, 2025), over 2 years after v3.2.0 was released (February 9, 2023). The target version uses HTTP middleware for vite-node communication ...", "justification": "code_not_present" } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:02b3f989-ef71-5e86-9794-a386e90c9e3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:390c5021-f3ef-5175-b1a2-f16f4f18e3a3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 3.2.0-tuxcare.9 of nuxt. not_affected \u2014 Version 3.2.0 does not contain the vulnerable code pattern. The vulnerability exists in the encodeURL() function which was introduced on June 26, 2024, over a year after version 3.2.0 (released February 9, 2023). The target uses a simpler redirect architecture without the vulnerable encodeURL() function.", "justification": "code_not_present" } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:5f4aaef5-51bb-5b8a-9082-adfb9f896be8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.2.0-tuxcare.9 of nuxt, and is fixed in 3.2.0-tuxcare.10." } }, { "id": "CVE-2026-71315", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:7b6f46c8-74de-5f96-8aa3-033538a0d762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71315 affects version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:c9d0ea21-a1b1-5244-93de-9f4bef8ae87f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.2.0-tuxcare.9 of nuxt. Nuxt.js version 3.2.0 is not affected by CVE-2026-71316. The vulnerability requires runtime payload caching (introduced in Nuxt 4.x) where _payload.json entries are served before route middleware. Version 3.2.0 only has build-time prerender cache (null during runtime), uses _payload.js files (not .json), and all runtime payload requests undergo full SSR rendering with route rules enforcement. The vulnerable code path (runtime cache bypass) does not exist in this version's architecture.", "justification": "code_not_present" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:675412e8-d4db-5268-a2f8-564aac1f658d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71318 does not affect version 3.2.0-tuxcare.9 of nuxt. nuxt 3.2.0 has no vue.runtimeCompiler support, so the Vue runtime compiler is never bundled. The upstream fix is explicitly gated on runtimeCompiler because a `template` island prop is harmless without it, so the exploit's prerequisite does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:87013370-5aaf-5d08-811c-f01fd37f1575", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:c3c2b90a-eec1-5266-bea8-1d1f1a31c5e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71321 is fixed in version 3.2.0-tuxcare.9 of nuxt." } }, { "id": "CVE-2026-72744", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:f258704c-42c3-5352-8298-1d9091e9e139", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-72744 does not affect version 3.2.0-tuxcare.9 of nuxt. not_affected \u2014 The target version (3.2.0-tuxcare.11) is NOT affected by CVE-2026-72744. The vulnerable Chrome DevTools workspace endpoint (/.well-known/appspecific/com.chrome.devtools.json) does not exist in this version. The feature was introduced in upstream commit 59ae82959, first released in v3.18.0, which is over a year newer than the 3.2.0 target. Comprehensive searches found no endpoint registration, n...", "justification": "code_not_present" } }, { "id": "GHSA-2x6f-57hp-86fx", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:2cbcfbea-7ef2-5f50-8417-2dca41efedcf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-2x6f-57hp-86fx is a false positive for nuxt 3.2.0-tuxcare.9." } }, { "id": "GHSA-4jjw-pwvw-q6w3", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:cd4d3f19-97f1-54ee-a7dd-5653548f8b3c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4jjw-pwvw-q6w3 is a false positive for nuxt 3.2.0-tuxcare.9." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:c630d5c3-d288-5a4e-bc40-c93b8506b37a", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 3.2.0-tuxcare.9 of nuxt. not_affected \u2014 Target repository Nuxt version 3.2.0 is NOT affected by GHSA-c9cv-mq2m-ppp3. All three vulnerability sinks described in the CVE (SSR open redirect via path-normalization, script execution via navigateTo open option, and protocol-relative bypass in reloadNuxtApp) require code features that were introduced AFTER version 3.2.0. The vulnerable encodeURL function with WHATWG URL parsing was added in...", "justification": "code_not_present" } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:2f6a64db-b5b0-5522-93a2-7ee657f3f246", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.2.0-tuxcare.9 of nuxt. not_affected \u2014 Version 3.2.0 is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerable innerHTML pattern was introduced in v3.16.0 (March 2025), two years after this version. The target uses noscript.children instead of the vulnerable noscript.innerHTML assignment.", "justification": "code_not_present" } }, { "id": "GHSA-rq7w-g337-39qq", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:f56ed063-9b37-5caf-995c-c1d6d5496eb0", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-rq7w-g337-39qq does not affect version 3.2.0-tuxcare.9 of nuxt. not_affected \u2014 Nuxt 3.2.0 is not affected by GHSA-rq7w-g337-39qq. The vulnerable Chrome DevTools workspace endpoint (/.well-known/appspecific/com.chrome.devtools.json) does not exist in this version. The feature was introduced in Nuxt 3.17.7+ via commit 59ae82959, which is NOT an ancestor of the target commit 899c4304d (v3.2.0-tuxcare.11). The CVE explicitly states \"3.x is not affected\" for versions before 4....", "justification": "code_not_present" } }, { "id": "GHSA-xppm-jmw6-fhmf", "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ], "bom-ref": "urn:uuid:4edb0be4-837c-57f4-b380-07742ba02d2b", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for nuxt 3.2.0-tuxcare.9." } } ], "dependencies": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.9" } ] }