{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:62b7261d-cdea-5397-93d3-a217882f973a", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5", "type": "library", "name": "@nuxt/schema", "version": "3.2.0-tuxcare.5", "purl": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:6927a8dc-ec8d-5d02-9cba-ba312c083c1e", "id": "CVE-2016-10735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-10735 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:489c3236-0ec2-5d87-a6ba-44434fa02fc5", "id": "CVE-2018-14040", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14040 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a45e71b1-1114-576f-8448-1b495f355ae3", "id": "CVE-2018-14042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14042 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bbda141c-2f28-5abb-98a4-624f994545b0", "id": "CVE-2018-16487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-16487 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3892524e-c758-53c4-bf8a-f6ef0add1fd8", "id": "CVE-2018-20676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20676 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5cab00b9-b317-5f55-8872-32ac3b2e5b54", "id": "CVE-2018-20677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20677 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5cb1636b-c18c-5e1f-978c-7eff1493a175", "id": "CVE-2018-3721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-3721 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:740d5acf-3017-5c49-9d15-a2972beec2a8", "id": "CVE-2019-10744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10744 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d64597c2-056f-593d-8242-cc97d3a563ff", "id": "CVE-2019-14862", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-14862 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f1bbf6b2-632d-5c8a-82d1-23706026ce62", "id": "CVE-2019-8331", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-8331 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:054893bf-0b4c-5684-9f54-048e76a3e55e", "id": "CVE-2020-36049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-36049 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a0d28825-c7e2-50da-b269-f4403ba5a045", "id": "CVE-2020-8203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-8203 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e0a93d3c-d16e-5a8a-9db3-b744c8b104e8", "id": "CVE-2021-23337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23337 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cf18233e-f730-5e57-b3a8-c8d68228befb", "id": "CVE-2022-2421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2421 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:98ec53fb-4971-5262-8df0-38dae623c611", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/schema 3.2.0-tuxcare.5. CVE-2022-25852 is a false positive for this repository. The CVE affects pg-native and libpq npm packages (PostgreSQL database client bindings), but this repository is the Nuxt.js web framework (version 3.2.0-tuxcare.4). Exhaustive containment search found no pg-native/libpq code in the repository - not as the project itself, not as a vendored/bundled copy, and not as a declared dependency. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:73b16ebe-4a6d-54f0-9521-b19397361004", "id": "CVE-2023-32695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-32695 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:63f8d35b-4830-5048-80c4-6325b35f4152", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4727a46f-3a0c-512d-9f29-dc9c2244c2fc", "id": "CVE-2024-6484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6484 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0c615837-f2e8-5d6c-94b5-ff38669acf22", "id": "CVE-2024-6485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6485 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:14a9abca-cb53-56e9-a4e1-869279d5b075", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a7311bdc-47d9-5cb5-a31b-3b98333834e5", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7de19d03-8b50-5052-a0e2-b6be297991de", "id": "CVE-2026-33151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33151 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a1b3def9-739f-56e0-b83b-0f01bc003ff1", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:31bc3ff1-d3a4-5011-a5e1-32351cf60afd", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/schema 3.2.0-tuxcare.5. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (IPv6/IPv4 address parsing), but this repository is Nuxt v3.2.0-tuxcare.1 (a Vue.js meta-framework). The affected component is not present in this repository as a vendored copy, dependency, or in any other form. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b2b73009-a492-5cbf-9da0-fe1f68199973", "id": "CVE-2026-45669", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45669 does not affect version 3.2.0-tuxcare.5 of @nuxt/schema. not_affected - CVE-2026-45669 requires the SSR redirect body that navigateTo(url, {external:true}) builds in packages/nuxt/src/app/composables/router.ts (nuxtApp.ssrContext['~renderResponse'] with only the double quote percent-encoded). In nuxt 3.2.0 that code does not exist: the server-side external branch of navigateTo delegates to h3 sendRedirect(event, redirectLocation, code) and builds no HTML body. Grep over the branch: '%22' - 0 hits in source, 'renderResponse' - only packages/nuxt/src/core/runtime/nitro/renderer.ts. The sink appears in later majors: 4.0.3 has it and carries patches/CVE-2026-45669.patch." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:def3b021-537d-58de-b7c7-698153f1d0e5", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:dd8aa5bd-fc1a-506f-8544-08108decc029", "id": "CVE-2026-47200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 3.2.0-tuxcare.5 of @nuxt/schema. not_affected \u2014 Nuxt version 3.2.0 does not contain the server-only pages feature that is the prerequisite for CVE-2026-47200. The vulnerable code pattern (`.server.vue` pages rendered as islands via `/__nuxt_island/page_*` endpoint) was introduced in Nuxt v3.11.0, which is 2,059 commits after v3.2.0. The target version predates the feature by multiple major versions." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d6d46562-dcaa-52fd-8f4f-c9643c362737", "id": "CVE-2026-4800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-4800 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:27adf79d-c9bf-5320-a449-85eb86a36df9", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fe8c338b-5db2-5704-b87e-01d195609c22", "id": "CVE-2026-56317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:262373b5-c5a0-5601-b526-2f4d947422a2", "id": "CVE-2026-56326", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 3.2.0-tuxcare.5 of @nuxt/schema. not_affected \u2014 Version 3.2.0 does not contain the vulnerable code pattern. The vulnerability exists in the encodeURL() function which was introduced on June 26, 2024, over a year after version 3.2.0 (released February 9, 2023). The target uses a simpler redirect architecture without the vulnerable encodeURL() function." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0c476e8c-16d1-55a2-9154-482ec9e29941", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:eb39835d-707c-5a13-a90c-f0cacde90500", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.2.0-tuxcare.5 of @nuxt/schema. Nuxt.js version 3.2.0 is not affected by CVE-2026-71316. The vulnerability requires runtime payload caching (introduced in Nuxt 4.x) where _payload.json entries are served before route middleware. Version 3.2.0 only has build-time prerender cache (null during runtime), uses _payload.js files (not .json), and all runtime payload requests undergo full SSR rendering with route rules enforcement. The vulnerable code path (runtime cache bypass) does not exist in this version's architecture." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:20db1660-da83-539d-94a5-45edd040a77c", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:87a6eb72-6c5c-5c77-8843-b7288f6d8412", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.2.0-tuxcare.5 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b23fdfe8-f22e-53a5-a834-c2372127d1c3", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 3.2.0-tuxcare.5 of @nuxt/schema. not_affected \u2014 Target repository Nuxt version 3.2.0 is NOT affected by GHSA-c9cv-mq2m-ppp3. All three vulnerability sinks described in the CVE (SSR open redirect via path-normalization, script execution via navigateTo open option, and protocol-relative bypass in reloadNuxtApp) require code features that were introduced AFTER version 3.2.0. The vulnerable encodeURL function with WHATWG URL parsing was added in..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f5238652-b171-5c91-80f5-cb1cba23395f", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.2.0-tuxcare.5 of @nuxt/schema. not_affected \u2014 Version 3.2.0 is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerable innerHTML pattern was introduced in v3.16.0 (March 2025), two years after this version. The target uses noscript.children instead of the vulnerable noscript.innerHTML assignment." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9bf64237-1482-568d-8b9b-e521e7745eb1", "id": "GHSA-xppm-jmw6-fhmf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/schema 3.2.0-tuxcare.5." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.5" } ] }