{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4620ec20-501a-5730-b19c-9edde2910a21",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@hono/node-server",
      "purl": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.2",
      "type": "library",
      "bom-ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.2",
      "version": "1.19.9-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "@hono/node-server",
            "purl": "pkg:npm/%40hono/node-server@1.19.9",
            "type": "library",
            "version": "1.19.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-118663",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4fbce0f8-8622-5023-93c2-ae564bbe6927",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-118663 affects version 1.19.9-tuxcare.2 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-29087",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:aeb28782-a584-5ce9-89d8-5aab55522223",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29087 is fixed in version 1.19.9-tuxcare.2 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-39406",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:02e79591-1531-5ef2-a9e7-869b93b2fd7d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-39406 is fixed in version 1.19.9-tuxcare.2 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-73565",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2dc3eb27-9bde-58e9-85bc-9fd4d82a1239",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-73565 does not affect version 1.19.9-tuxcare.2 of @hono/node-server. not_affected \u2014 Version 1.19.9 of @hono/node-server is not affected by CVE-2026-73565. The vulnerability exists in the WebSocket handling code (src/websocket.ts and the upgradeWebSocket function), which was only introduced in version 2.0.0. Version 1.19.9 is on the v1.x maintenance line that never included WebSocket support. Since the vulnerable feature does not exist in this version, the memory leak cannot oc...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-9mqv-5hh9-4cgg",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:03a2e065-8028-5f15-ad10-c257fb8f5deb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-9mqv-5hh9-4cgg does not affect version 1.19.9-tuxcare.2 of @hono/node-server. not_affected \u2014 The target @hono/node-server version 1.19.9 does not contain the vulnerable WebSocket functionality. The WebSocket feature, including the vulnerable upgradeWebSocket route handler and the internal waiterMap that causes the memory leak, was first introduced in version 2.0.0 (commit 35c1dfc). The target version predates this feature entirely. Since the target cannot receive or process WebSocket u...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-frvp-7c67-39w9",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b3a7c9e3-4cdb-520d-b879-495c0872b84d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-frvp-7c67-39w9 affects version 1.19.9-tuxcare.2 of @hono/node-server."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.2"
    }
  ]
}