{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:20ce2b54-84ab-5f22-a81a-80ca54522291", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9", "type": "library", "name": "@nuxt/schema", "version": "3.12.3-tuxcare.9", "purl": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f91d69cc-a4a9-5c04-a851-27c82b95ddba", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/schema 3.12.3-tuxcare.9. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:f45c8c78-f73a-53c3-bd1b-f947f42b701f", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:83aa0dd2-d0b0-54d2-8f0d-82f5f4feb546", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:cde38854-0dee-5e5d-a00d-6854a43345b7", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:8aafebf9-6dac-56e8-ad2e-556b5840beec", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:74f63c97-b0ea-595c-a96d-9465a0e42ef0", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:0738b06d-a7d5-5170-b721-8bc8a78cefc4", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:3ae4f24a-de9d-5aa5-be25-622e24165e17", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:edc4effd-993e-5f63-b6d8-fa411a7b00ae", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/schema 3.12.3-tuxcare.9. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:2362fb59-acf8-5ca9-b952-ed3f7bba93b0", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:6d380354-2798-5d9e-8bc9-694cebda3458", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:4bdab073-2b06-5517-81c5-e0a2edb4db2f", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:fc001bb2-f03f-5ba9-b8f5-ba08740ff7e1", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:86ff74f4-d269-5975-ab63-399e4cf22f8c", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b9eb742e-f0ef-5eac-a966-bd36075c1c4d", "id": "CVE-2026-56317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:881d83bd-418b-5cc5-97ab-b4758bfcaa51", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:0f630019-cef7-5317-a0c5-6f9425b98bde", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:49e76f7a-c12f-55f6-91d2-58fb682c20ea", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.9 of @nuxt/schema. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:07846ae8-a006-52c2-945a-cd677752755d", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d9b99157-6243-5997-b4e3-ff47f3553657", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:544dac23-6962-54f9-9b57-6c1549c46ade", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:f2c1202e-fe99-571d-9157-c3cbb7e9d4e2", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.9 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:bea0e610-c40d-5cb8-926e-112cd686c39d", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.9 of @nuxt/schema. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:2d2843eb-5988-5400-9204-15d9cd78954e", "id": "GHSA-xppm-jmw6-fhmf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/schema 3.12.3-tuxcare.9." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/schema@3.12.3-tuxcare.9" } ] }