{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c6fded55-5364-5ca3-b5b1-76e3e6dcaf2b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9", "type": "library", "name": "@nuxt/kit", "version": "3.12.3-tuxcare.9", "purl": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:7d434caa-0926-5938-b364-14f592109c79", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/kit 3.12.3-tuxcare.9. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d5e9bc70-121e-509d-889c-4a53207f49cd", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:18e89b8a-80d0-5ebb-bf0c-3f0613fb2052", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:a62afdfe-b286-5578-abfe-7c65a7d03a38", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:7d643d89-1592-5c67-ba1a-777b70a11882", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:eb60ce76-39a9-5d54-b31e-5f4724f6b1d3", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:ce03ad34-eb54-58b5-af9a-fe8e70e9ea4b", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:a0ae54e2-f7c7-57fd-a042-6b94b4ce7b53", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:ea902345-793e-58ce-82e3-e81016e66801", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/kit 3.12.3-tuxcare.9. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:fe676ff4-bddf-5ce3-b313-37d3d1294ae2", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:31f2596b-5403-5750-b223-860b5d5ef793", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:81ce5e36-a671-5049-9ab8-589d6f45b007", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:7d3d8c5a-d853-55ca-b267-bb1e50c99b7f", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:3a8ad546-a80a-529f-b835-edef780999b2", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:32a055d7-04bc-581b-a58e-f28d1c2f4574", "id": "CVE-2026-56317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:8cbee0d8-d688-5a79-830c-9a8adc227be4", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:55762d98-22f9-5cdd-9f30-0a604e0bb3b8", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:26b0ac5d-3e04-50b8-b065-509832b96581", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.9 of @nuxt/kit. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:dd38b3bc-dc5e-5209-930c-dd653ca3a937", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b8753b83-19da-550d-ad23-ab41de8b5491", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:994bce52-c204-5cc2-b2df-a7bc7c169813", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:40d37af1-6488-562a-8b5e-97c58e720270", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.9 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:ffa044c0-c1ff-51dc-81f8-c65a72a33b7e", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.9 of @nuxt/kit. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b797e42d-1e7d-5ce9-aa5c-1378d3ccd876", "id": "GHSA-xppm-jmw6-fhmf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/kit 3.12.3-tuxcare.9." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.9" } ] }