{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1cc1d39f-900e-54da-8b26-a2d1139d5ef3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@4.0.3-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/nuxt@4.0.3-tuxcare.8", "version": "4.0.3-tuxcare.8", "pedigree": { "ancestors": [ { "name": "nuxt", "purl": "pkg:npm/nuxt@4.0.3", "type": "library", "version": "4.0.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25852", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:c8ba98d6-357f-5034-aea1-cd9c17e46ffe", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for nuxt 4.0.3-tuxcare.8. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match." } }, { "id": "CVE-2023-3224", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:18fbe590-7a7b-5dc8-b267-3c9b2f4e1f69", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-3224 does not affect version 4.0.3-tuxcare.8 of nuxt. not_affected \u2014 CVE-2023-3224 affects Nuxt versions 3.4.0-3.4.3 where the vite-node dev server was exposed via an HTTP endpoint (/__nuxt_vite_node__/module/) that allowed remote code execution when publicly accessible. In version 4.0.3, this vulnerable HTTP endpoint no longer exists. The vite-node communication was replaced with a secure Unix socket implementation (with 0o700 directory and 0o600 file permissio...", "justification": "code_not_present" } }, { "id": "CVE-2024-34343", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:2c9f8b25-b169-5436-b249-7e72e37e4198", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-34343 does not affect version 4.0.3-tuxcare.8 of nuxt. not_affected \u2014 CVE-2024-34343 affects the ufo library (versions < 1.5.4) due to URL parsing bugs that allow javascript: protocol bypass. The target repository has ufo version 1.6.4, which includes the fix. The vulnerability was fixed in upstream Nuxt via renovate commit 78628587 (July 18, 2024) that updated ufo from 1.5.3 to 1.5.4. This fix was already present in the upstream Nuxt 4.0.3 release when TuxCare o...", "justification": "code_not_present" } }, { "id": "CVE-2024-34344", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:a7bc5a6a-de06-564a-8263-7693e02a527c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34344 affects version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2025-27415", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:407a0fd5-05f8-5e81-b1c0-78c5b4a1e977", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2025-59414", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:66c1b21b-5bd2-508a-8976-031d9295e490", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-114130", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:a11bf5b6-0b6b-5a90-b820-fe71020ed47a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114130 affects version 4.0.3-tuxcare.8 of nuxt, and is fixed in 4.0.3-tuxcare.12." } }, { "id": "CVE-2026-114131", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:45b6ec3a-9f0b-52bd-b176-c9bba1eecfbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114131 affects version 4.0.3-tuxcare.8 of nuxt, and is fixed in 4.0.3-tuxcare.12." } }, { "id": "CVE-2026-114132", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:2cb47c92-e856-5672-b97e-5214222f201b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114132 affects version 4.0.3-tuxcare.8 of nuxt, and is fixed in 4.0.3-tuxcare.10." } }, { "id": "CVE-2026-114133", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:ee99d435-af6c-5e1a-a477-5e55aba2e854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114133 affects version 4.0.3-tuxcare.8 of nuxt, and is fixed in 4.0.3-tuxcare.12." } }, { "id": "CVE-2026-119200", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:9525a948-e962-5cc0-8359-2c463a3681d7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-119200 does not affect version 4.0.3-tuxcare.8 of nuxt. not_affected \u2014 Nuxt 4.0.3 is not affected by CVE-2026-119200. The vulnerability requires path normalization logic that resolves dot segments (`.` and `..`) before rendering while leaving them unresolved in middleware checks. This creates a mismatch allowing bypass of path-based authentication. Version 4.0.3 lacks this normalization logic entirely - it passes paths unchanged to both middleware and the page rou...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-120309", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:fed1686c-a5ee-565c-88b8-24959526a510", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-120309 does not affect version 4.0.3-tuxcare.8 of nuxt. not_affected \u2014 Target version 4.0.3 is NOT AFFECTED by CVE-2026-120309. The vulnerable functions `getRouterParam` and `getRouterParams` do not exist in this version - they were only introduced in Nuxt 4.6.0 (commit 158901fde) and fixed in 4.6.2 (commit 010f6b43d). The target predates both the feature introduction and the vulnerability window. The attack chain is absent because there is no mechanism in 4.0.3 t...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-25128", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:e091a0e3-5d91-59cd-81f0-781e101f762c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25128 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-41305", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:3ef26e86-323a-5047-ba77-0099789a8a72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-42338", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:a246d535-6afc-5b0f-9505-31c4adf6aca8", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 4.0.3-tuxcare.8. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm package, but this repository is the 'nuxt' framework. The affected component (ip-address library) is completely absent from the repository - not as the project itself, not as vendored/bundled code, and not as a declared dependency. This is a wrong-project match." } }, { "id": "CVE-2026-45669", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:1efee02c-8031-5253-9dc4-2340d7a148a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45669 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-45670", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:80d21486-0e0b-5f5c-a4a0-7b831d309589", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45670 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-46342", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:63a14854-d5ce-5884-8198-58158c8ba159", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46342 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-47200", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:1c0f9ddc-787c-54f0-aafb-be2078c3df7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47200 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-49993", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:45521c74-07b7-5706-913e-20951bfc4579", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49993 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-53721", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:ce9a6d53-4675-57bf-9557-6ab64a409393", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-53722", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:bf79351e-b49a-524d-98ec-887a75465a68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-56301", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:734a88e6-9939-5dbc-963d-597360594b83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56301 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-56317", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:8cc70306-45df-5ee3-bbd8-db3613ed1fa8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-56326", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:f8c07b91-981b-52fa-95c6-8afa85684089", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56326 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-71314", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:ccd7343f-bb41-54bf-b369-a66bb0e991ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71314 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-71315", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:8da1a8bc-944f-5dc7-a0eb-91c6f3c0fd9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71315 affects version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-71316", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:ecf3044a-c134-5886-8fa8-d54d20121c4a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 4.0.3-tuxcare.8 of nuxt. Version 4.0.3 is not affected by CVE-2026-71316. The CVE explicitly states the vulnerability was introduced \"From 4.4.0 until 4.5.1\", and the target version (4.0.3) predates this introduction. While the target does handle `_payload.json` requests and has prerender caching mechanisms, the specific vulnerability pattern that allows runtime cache bypass of middleware/guards was introduced in version 4.4.0 and does not exist in version 4.0.3.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-71318", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:5be73d8a-8b9f-5506-b77f-0908d8eb5949", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71318 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-71320", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:71acb668-9b96-5f4a-8882-19a11b82b0c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71320 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-71321", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:d84e7370-3fc2-54bb-854b-c407008fec3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71321 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "CVE-2026-72744", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:536a65e0-d7b6-5616-8a75-4d2f405dadc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-72744 affects version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "GHSA-2x6f-57hp-86fx", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:663fd0bd-a8e6-52a3-9d79-ea1de89ba591", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-2x6f-57hp-86fx is a false positive for nuxt 4.0.3-tuxcare.8." } }, { "id": "GHSA-4jjw-pwvw-q6w3", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:8aa76cfa-eb92-53b0-84b9-6fbb235ca82d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4jjw-pwvw-q6w3 is a false positive for nuxt 4.0.3-tuxcare.8." } }, { "id": "GHSA-534h-c3cw-v3h9", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:5a655659-49b8-5afb-86c5-63f36b3e6703", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "GHSA-c9cv-mq2m-ppp3", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:b0a31a15-7ea5-5d3e-88ff-1711329b6ec8", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "GHSA-m3q2-p4fw-w38m", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:cc513758-1c30-56f8-a315-0978136758fb", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "GHSA-rq7w-g337-39qq", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:d81bca95-c7ac-5929-803f-2127657def17", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-rq7w-g337-39qq is fixed in version 4.0.3-tuxcare.8 of nuxt." } }, { "id": "GHSA-xppm-jmw6-fhmf", "affects": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:d264d73f-a9bd-58b6-bb1c-8ab454633d1c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for nuxt 4.0.3-tuxcare.8." } } ], "dependencies": [ { "ref": "pkg:npm/nuxt@4.0.3-tuxcare.8" } ] }