{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:87cf07f4-a108-522c-a47c-b8f4582d780d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5", "type": "library", "name": "@nuxt/test-utils", "version": "3.2.0-tuxcare.5", "purl": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:bc3e5391-1f66-51aa-8a66-b44438d722d4", "id": "CVE-2016-10735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-10735 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:55ed951b-6188-5d16-95ed-f4a51d98365a", "id": "CVE-2018-14040", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14040 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fe0f89b4-2846-5425-968f-e58313a16807", "id": "CVE-2018-14042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14042 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8c33224d-8984-58ed-bc49-ee373cf67e45", "id": "CVE-2018-16487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-16487 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c9f4c5af-d7ab-54a1-a760-2f75c8ff6b88", "id": "CVE-2018-20676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20676 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:34240038-499c-5a48-9074-4699da621709", "id": "CVE-2018-20677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20677 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8e669274-4b4b-5985-a7fd-76c90574cf05", "id": "CVE-2018-3721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-3721 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4fdc78b8-df99-5b78-ac2b-c14498369ae3", "id": "CVE-2019-10744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10744 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cc183e4d-029a-5cb8-b044-d2bc598375e4", "id": "CVE-2019-14862", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-14862 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ed797d5d-b799-5f1c-b97c-35709aee21db", "id": "CVE-2019-8331", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-8331 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d70eb676-1e9a-5521-b25f-ebabf7fd5bd5", "id": "CVE-2020-36049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-36049 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:359057d8-bd6e-54a8-94ba-ebb65310bfd2", "id": "CVE-2020-8203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-8203 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3953e214-42ef-5816-91ba-ae5c6b087ef7", "id": "CVE-2021-23337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23337 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d0b146b7-d87f-5564-914e-8f68adbecda9", "id": "CVE-2022-2421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2421 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:271c4d18-54a9-5627-9570-0bf8cfc0d35d", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/test-utils 3.2.0-tuxcare.5. CVE-2022-25852 is a false positive for this repository. The CVE affects pg-native and libpq npm packages (PostgreSQL database client bindings), but this repository is the Nuxt.js web framework (version 3.2.0-tuxcare.4). Exhaustive containment search found no pg-native/libpq code in the repository - not as the project itself, not as a vendored/bundled copy, and not as a declared dependency. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:24907609-8a4c-54cc-8745-0b5a1184b40d", "id": "CVE-2023-32695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-32695 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:322276b2-a47e-5bb4-8151-867d51354ad6", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c0f37af4-26a8-5722-b136-d5fa08601de1", "id": "CVE-2024-6484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6484 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:40f00839-edf8-5f5a-a3b5-a5ec0bcb721b", "id": "CVE-2024-6485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6485 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:350b13fa-99da-5a95-ac81-20f5ec8e35e1", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:874ad839-cc85-57f3-a112-fabf1e281e42", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f2b9ae96-b2a2-56c7-b24f-d585db0b9378", "id": "CVE-2026-33151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33151 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b7152f42-3468-5481-948e-1d8bc715b21d", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:21f59e42-dccd-5930-b60d-0a5f17589bba", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/test-utils 3.2.0-tuxcare.5. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (IPv6/IPv4 address parsing), but this repository is Nuxt v3.2.0-tuxcare.1 (a Vue.js meta-framework). The affected component is not present in this repository as a vendored copy, dependency, or in any other form. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2f0aeb57-82a9-59bf-8778-0393bc0aa5ba", "id": "CVE-2026-45669", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45669 does not affect version 3.2.0-tuxcare.5 of @nuxt/test-utils. not_affected - CVE-2026-45669 requires the SSR redirect body that navigateTo(url, {external:true}) builds in packages/nuxt/src/app/composables/router.ts (nuxtApp.ssrContext['~renderResponse'] with only the double quote percent-encoded). In nuxt 3.2.0 that code does not exist: the server-side external branch of navigateTo delegates to h3 sendRedirect(event, redirectLocation, code) and builds no HTML body. Grep over the branch: '%22' - 0 hits in source, 'renderResponse' - only packages/nuxt/src/core/runtime/nitro/renderer.ts. The sink appears in later majors: 4.0.3 has it and carries patches/CVE-2026-45669.patch." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3a8162d7-966f-5e0d-9097-0721c2187fe0", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8164171f-e592-5cdb-a71c-fea3e595717c", "id": "CVE-2026-47200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 3.2.0-tuxcare.5 of @nuxt/test-utils. not_affected \u2014 Nuxt version 3.2.0 does not contain the server-only pages feature that is the prerequisite for CVE-2026-47200. The vulnerable code pattern (`.server.vue` pages rendered as islands via `/__nuxt_island/page_*` endpoint) was introduced in Nuxt v3.11.0, which is 2,059 commits after v3.2.0. The target version predates the feature by multiple major versions." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a0f01b79-aca6-5054-8f04-d5152e119ad8", "id": "CVE-2026-4800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-4800 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:534cf299-9082-56b9-8db6-5e95e926f107", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:18e7f8c2-b2f0-5c7f-bc14-0cf6911e4b62", "id": "CVE-2026-56317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f918d135-f097-517c-85ed-a78a0a6a775b", "id": "CVE-2026-56326", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 3.2.0-tuxcare.5 of @nuxt/test-utils. not_affected \u2014 Version 3.2.0 does not contain the vulnerable code pattern. The vulnerability exists in the encodeURL() function which was introduced on June 26, 2024, over a year after version 3.2.0 (released February 9, 2023). The target uses a simpler redirect architecture without the vulnerable encodeURL() function." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ccda9980-7de1-5463-a3cd-cd1751f6966b", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f57fef86-b05f-5e2a-8aaa-0b21084b3c05", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.2.0-tuxcare.5 of @nuxt/test-utils. Nuxt.js version 3.2.0 is not affected by CVE-2026-71316. The vulnerability requires runtime payload caching (introduced in Nuxt 4.x) where _payload.json entries are served before route middleware. Version 3.2.0 only has build-time prerender cache (null during runtime), uses _payload.js files (not .json), and all runtime payload requests undergo full SSR rendering with route rules enforcement. The vulnerable code path (runtime cache bypass) does not exist in this version's architecture." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cced7746-e146-51e8-9c43-70a03c490f78", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3f3d5a6c-5cf2-5dfb-9ca9-b07a3dd2eb37", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.2.0-tuxcare.5 of @nuxt/test-utils." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5b21ac04-865c-59e9-95a7-5aa7de3641dd", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 3.2.0-tuxcare.5 of @nuxt/test-utils. not_affected \u2014 Target repository Nuxt version 3.2.0 is NOT affected by GHSA-c9cv-mq2m-ppp3. All three vulnerability sinks described in the CVE (SSR open redirect via path-normalization, script execution via navigateTo open option, and protocol-relative bypass in reloadNuxtApp) require code features that were introduced AFTER version 3.2.0. The vulnerable encodeURL function with WHATWG URL parsing was added in..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d705ac46-6346-5766-bf3d-ef81603b9fdd", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.2.0-tuxcare.5 of @nuxt/test-utils. not_affected \u2014 Version 3.2.0 is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerable innerHTML pattern was introduced in v3.16.0 (March 2025), two years after this version. The target uses noscript.children instead of the vulnerable noscript.innerHTML assignment." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8583732f-c66c-53c7-8163-65ebf984753c", "id": "GHSA-xppm-jmw6-fhmf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/test-utils 3.2.0-tuxcare.5." }, "affects": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/test-utils@3.2.0-tuxcare.5" } ] }