{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9c7afc16-039f-5873-b25d-04e912810393", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8", "type": "library", "name": "@nuxt/vite-builder", "version": "3.12.3-tuxcare.8", "purl": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:6112f287-aab5-5c46-a976-d9b0491e0241", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/vite-builder 3.12.3-tuxcare.8. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d1e8a263-d6a4-5090-b42b-4fcef8bbfb68", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a58162bd-e616-59a3-a1e5-ba11be4e3c79", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:98e539fb-29ac-5282-9a4f-71ecbc844d2d", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:227e2e15-2365-571d-a10d-77c2c26afb55", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2f9ec84a-c992-5f36-8660-abdd246463a0", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a24a312e-0852-551b-bba2-0de2908443a8", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7ace06c0-d961-56d1-ac89-305ad28c7364", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:057634de-3436-5003-a01d-f05d7c086bc6", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/vite-builder 3.12.3-tuxcare.8. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9d6c66de-fcd4-5c70-bcd6-e79cac19de88", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c6bbe42e-be48-59ee-8819-6392385c0a81", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d83b3377-2dbb-53ba-a1b5-34f0242a2df5", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b5ce045d-6b2a-522f-a5da-f2e87e0c218d", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2de92f0a-80da-5d82-9f08-a51b6cd1a839", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:141b276c-8b18-5865-964e-b13bab2416ce", "id": "CVE-2026-56317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2eac2271-3e45-5440-a93c-4837ffd6a08c", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9e076cc1-934f-50e4-81ad-baa410ab5521", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:72df9b3c-0e2e-5224-902f-19539ca3f848", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.8 of @nuxt/vite-builder. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a6a5a03f-5129-54b5-8066-af4be1985909", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5e1ff118-8fe1-5cfc-9fba-facf51777957", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:416842c3-0868-519d-b556-ebd481cc1063", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:721e5a86-e120-5ccd-93b4-38b09445b6c1", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.8 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c75117a1-1fa5-52e6-8ba0-dc48b19ab473", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.8 of @nuxt/vite-builder. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:979f9a82-ba20-55f9-a4dc-e952e69e0fed", "id": "GHSA-xppm-jmw6-fhmf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/vite-builder 3.12.3-tuxcare.8." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.8" } ] }