{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4c9678af-df04-5ca0-86c3-646b1512f221", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8", "type": "library", "name": "@nuxt/schema", "version": "3.12.3-tuxcare.8", "purl": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:43565dcd-b21b-5984-aaad-ec6bb7904a8b", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/schema 3.12.3-tuxcare.8. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d6315379-8f18-54d3-a850-27f59a7164a4", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ad9a7ca8-8a5f-5009-86f4-55482bb821b9", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:903f7db9-81c9-5fb0-a721-72ac25915bb1", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1d4a2237-7baf-52c4-9cdc-815d85deccb8", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:32424ff7-cde6-59cc-822a-e9cb067b46b5", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3d849c82-58b1-5a6b-9792-5534e7cf8720", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1671bce0-bcf8-544e-b265-7eeed7c32f90", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:44d233b0-e6a6-5714-8a2a-6f84bf100e1a", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/schema 3.12.3-tuxcare.8. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9c9fe7c2-446a-5140-a8a8-ea80e3f74c6f", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f50165b0-cf6a-5609-a9df-3f7a9b0db68e", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:6ebd859b-eccd-5af7-80a0-cdecf569cba9", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:30e05c95-74ee-59fd-8fa8-91fed19b3c55", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:226f7615-51e2-50af-8a0f-50c9c39912fe", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a7029735-0895-5eec-a01c-032944799995", "id": "CVE-2026-56317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f1313fe4-6d28-50d5-8627-9c35e67825de", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:edaa1e25-4975-5a5b-b778-2930dd95e387", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:773ddc6b-25a0-5a36-a71d-50b36373f0cb", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.8 of @nuxt/schema. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8fc51ac5-905a-5718-b570-17d7cc39cd58", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:bb0bfc99-95f9-538f-a971-2addd86c73bd", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3030f053-9d0c-55da-89d5-fedffbcd909e", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ec842f23-70d8-57d5-b70b-03e2fa60d1b8", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.8 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ca270823-2006-5b8f-bf56-d9825069724f", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.8 of @nuxt/schema. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:93fb7b07-aad7-57f0-affa-17d11753b16f", "id": "GHSA-xppm-jmw6-fhmf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/schema 3.12.3-tuxcare.8." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.8" } ] }