{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f0e2df76-38eb-5b5f-8cec-f08ffd9e43e5", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5", "type": "library", "name": "@nuxt/kit", "version": "3.2.0-tuxcare.5", "purl": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:0c53e257-5fb3-5cdb-9cb2-91693176caef", "id": "CVE-2016-10735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-10735 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:50a667ba-ca06-5421-a6a3-5c8b70e284d4", "id": "CVE-2018-14040", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14040 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:59a19a34-675a-5d22-ab4a-5662565024a2", "id": "CVE-2018-14042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14042 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e6939057-f3c3-523e-a5c4-c0ac533afefa", "id": "CVE-2018-16487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-16487 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:413e42af-d6d8-5fd1-bbf4-4a8f05816437", "id": "CVE-2018-20676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20676 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1d177527-e17a-52aa-9627-cdda756e5ab6", "id": "CVE-2018-20677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20677 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7428a5f6-878f-55ff-b28a-23e8830f700b", "id": "CVE-2018-3721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-3721 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e00fddd7-fd26-5f39-a044-169cce025d6e", "id": "CVE-2019-10744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10744 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a4638c46-bf8b-5030-8990-4d067bfc4974", "id": "CVE-2019-14862", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-14862 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f3a88c4b-0fb3-5ab4-979c-2959dc7c409a", "id": "CVE-2019-8331", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-8331 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8c363ad8-c760-5d42-8ded-f25390d36712", "id": "CVE-2020-36049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-36049 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:de18809a-56a9-5c8b-9c1d-efb31fabbb42", "id": "CVE-2020-8203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-8203 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1953004f-2c68-5cb0-9f18-9634a712d35d", "id": "CVE-2021-23337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23337 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:eaad5ef5-aceb-59c1-8a44-d5a5522ea46a", "id": "CVE-2022-2421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2421 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:30b1fb8f-6b8d-5df6-8cb3-129e84ef31ef", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/kit 3.2.0-tuxcare.5. CVE-2022-25852 is a false positive for this repository. The CVE affects pg-native and libpq npm packages (PostgreSQL database client bindings), but this repository is the Nuxt.js web framework (version 3.2.0-tuxcare.4). Exhaustive containment search found no pg-native/libpq code in the repository - not as the project itself, not as a vendored/bundled copy, and not as a declared dependency. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bb98d1c1-513e-573e-bbd0-93709a455d3d", "id": "CVE-2023-32695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-32695 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ffc4f9d6-1fc6-5c8f-b788-f3148cd05c44", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:63139529-ecfa-536c-9cf8-f589998c6b7c", "id": "CVE-2024-6484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6484 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b78d4cd2-7ee2-5d99-8350-b52a92a4ce92", "id": "CVE-2024-6485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6485 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4dc9fa5c-0fee-5b43-922e-025d22ca1247", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:05b20ca5-27d6-5fa2-9f0f-db0bbe59a11b", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2b07fbee-3d3f-5b1d-b69f-1ca59b26a70e", "id": "CVE-2026-33151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33151 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:171a4af2-a257-58c9-a8dc-bd99aec25f4b", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:07964862-47ac-5be6-b049-bf8b1e2abe32", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/kit 3.2.0-tuxcare.5. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (IPv6/IPv4 address parsing), but this repository is Nuxt v3.2.0-tuxcare.1 (a Vue.js meta-framework). The affected component is not present in this repository as a vendored copy, dependency, or in any other form. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b6a3b133-257b-5e10-84a7-c33f77204bde", "id": "CVE-2026-45669", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45669 does not affect version 3.2.0-tuxcare.5 of @nuxt/kit. not_affected - CVE-2026-45669 requires the SSR redirect body that navigateTo(url, {external:true}) builds in packages/nuxt/src/app/composables/router.ts (nuxtApp.ssrContext['~renderResponse'] with only the double quote percent-encoded). In nuxt 3.2.0 that code does not exist: the server-side external branch of navigateTo delegates to h3 sendRedirect(event, redirectLocation, code) and builds no HTML body. Grep over the branch: '%22' - 0 hits in source, 'renderResponse' - only packages/nuxt/src/core/runtime/nitro/renderer.ts. The sink appears in later majors: 4.0.3 has it and carries patches/CVE-2026-45669.patch." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4cf66191-e133-542d-9de6-235c4d259a19", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:abd19c4a-036d-5429-b003-0e4e75fb80e3", "id": "CVE-2026-47200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 3.2.0-tuxcare.5 of @nuxt/kit. not_affected \u2014 Nuxt version 3.2.0 does not contain the server-only pages feature that is the prerequisite for CVE-2026-47200. The vulnerable code pattern (`.server.vue` pages rendered as islands via `/__nuxt_island/page_*` endpoint) was introduced in Nuxt v3.11.0, which is 2,059 commits after v3.2.0. The target version predates the feature by multiple major versions." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:63a3ba84-a354-5ecc-8f51-73d0878b75b4", "id": "CVE-2026-4800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-4800 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0110bb7b-69ac-59d1-ad06-4f39bd81af00", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:52f0ecd7-3ee5-5902-a8c9-87a1d0fd226c", "id": "CVE-2026-56317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:594ba918-0592-52da-a6a1-9bb0a2b76896", "id": "CVE-2026-56326", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 3.2.0-tuxcare.5 of @nuxt/kit. not_affected \u2014 Version 3.2.0 does not contain the vulnerable code pattern. The vulnerability exists in the encodeURL() function which was introduced on June 26, 2024, over a year after version 3.2.0 (released February 9, 2023). The target uses a simpler redirect architecture without the vulnerable encodeURL() function." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b35cda7f-c165-520a-81b5-f0a674dd7fa4", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:74acadd4-0e11-5570-9751-b23e8fae125e", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.2.0-tuxcare.5 of @nuxt/kit. Nuxt.js version 3.2.0 is not affected by CVE-2026-71316. The vulnerability requires runtime payload caching (introduced in Nuxt 4.x) where _payload.json entries are served before route middleware. Version 3.2.0 only has build-time prerender cache (null during runtime), uses _payload.js files (not .json), and all runtime payload requests undergo full SSR rendering with route rules enforcement. The vulnerable code path (runtime cache bypass) does not exist in this version's architecture." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1ff209bb-8646-502a-9f0f-c916b291336e", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7c0c9999-b2a5-5dfa-8642-18f43fa2cfa1", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.2.0-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:270dcbd6-63e9-580c-b854-f5ec7f19c4ff", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 3.2.0-tuxcare.5 of @nuxt/kit. not_affected \u2014 Target repository Nuxt version 3.2.0 is NOT affected by GHSA-c9cv-mq2m-ppp3. All three vulnerability sinks described in the CVE (SSR open redirect via path-normalization, script execution via navigateTo open option, and protocol-relative bypass in reloadNuxtApp) require code features that were introduced AFTER version 3.2.0. The vulnerable encodeURL function with WHATWG URL parsing was added in..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2ac15e6b-82d7-5c28-91df-561232111c97", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.2.0-tuxcare.5 of @nuxt/kit. not_affected \u2014 Version 3.2.0 is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerable innerHTML pattern was introduced in v3.16.0 (March 2025), two years after this version. The target uses noscript.children instead of the vulnerable noscript.innerHTML assignment." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:71843646-47b1-58b9-8462-d9d8190f253e", "id": "GHSA-xppm-jmw6-fhmf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/kit 3.2.0-tuxcare.5." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/kit@3.2.0-tuxcare.5" } ] }