{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:86c5b51b-cf8d-5d7c-9ec4-f220db772516",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@hono/node-server",
      "purl": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1",
      "version": "1.19.11-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "@hono/node-server",
            "purl": "pkg:npm/%40hono/node-server@1.19.11",
            "type": "library",
            "version": "1.19.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-118663",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0ec0fcc9-b7e7-58ee-b98c-d4d804a98e1d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-118663 affects version 1.19.11-tuxcare.1 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-39406",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:54169727-ed1c-5f5c-ab04-cf1835479d7b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-39406 is fixed in version 1.19.11-tuxcare.1 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-73565",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6a4bf538-5f3f-54cc-aa31-9dd6870abd1e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-73565 does not affect version 1.19.11-tuxcare.1 of @hono/node-server. not_affected \u2014 The target version 1.19.11 does not contain the WebSocket functionality that is affected by CVE-2026-73565. The WebSocket feature (including the vulnerable waiter-map cleanup logic) was introduced upstream in version 2.0.0 via commit 35c1dfc. The target predates this feature entirely. The file src/websocket.ts does not exist, no WebSocket dependencies are present, and no code processes WebSocke...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-9mqv-5hh9-4cgg",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:94ce3c4a-97b6-5115-8059-3b0b1eba6851",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-9mqv-5hh9-4cgg does not affect version 1.19.11-tuxcare.1 of @hono/node-server. not_affected \u2014 Target version 1.19.11 is not affected by GHSA-9mqv-5hh9-4cgg. The vulnerability exists in the WebSocket upgrade handling code (src/websocket.ts), but this file and all WebSocket functionality were first introduced in version 2.0.0-rc.2 (commit 35c1dfc). Version 1.19.11 predates WebSocket support entirely and contains no code to receive or process WebSocket upgrade requests. Rule 5 Type A1 sati...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-frvp-7c67-39w9",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c46c0526-ef99-5f96-96bf-eb656bdbee24",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-frvp-7c67-39w9 is fixed in version 1.19.11-tuxcare.1 of @hono/node-server."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1"
    }
  ]
}