{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d4475cc0-1d28-527b-a93c-3eab4a19485e", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9", "type": "library", "name": "@nuxt/vite-builder", "version": "3.12.3-tuxcare.9", "purl": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:2067b4c1-1b53-5f2f-9ed9-32584be0edfa", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/vite-builder 3.12.3-tuxcare.9. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:4336da9b-e8a7-5622-954a-fc68eb61ed4d", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:8d619aa7-6064-50ee-95eb-3a3068a320aa", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:6faa66fc-7305-53bf-8ba8-51010c95dedf", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:3b890a56-59a8-58bd-b01e-afa9a73502ae", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b13f085a-58a8-552a-9aa7-14cf2fbc8968", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:33f46213-4e71-56fe-818c-f5cef68ec873", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:31719f81-91a4-59b8-ad01-5da11cc867d1", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:2009aafb-a128-549f-ac69-495284fd54d1", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/vite-builder 3.12.3-tuxcare.9. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:773f7844-5e15-517c-a07e-b5c4978e4403", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b08fa525-68b4-54fa-a8c6-921e538c72eb", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:fa77e488-19d8-55aa-bcc6-4d01899d358f", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:148243a4-c527-55b1-919b-2811315d0ad4", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d6aef7c5-6039-5b50-b077-bbb821b29799", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b321ea49-fd68-5152-bd14-e62f1d08ce5f", "id": "CVE-2026-56317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:5239ce92-6f49-5e65-8bae-f453a5c25e11", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:aa926411-2331-57fe-a8cd-8c1a4af27523", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:c488e235-c167-5f92-ac52-9a50473d698b", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.9 of @nuxt/vite-builder. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:324ddfba-e528-54ae-97d4-0885520afb05", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:8ae8d66c-e16f-58a8-833e-e9d128bc25c3", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:81c5d02b-7830-53bf-8d53-3e0cd8afdcfd", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:72759090-0d54-591c-a655-1b907e76d32f", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.9 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:18704e32-5752-5c4c-8057-11c4e374432c", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.9 of @nuxt/vite-builder. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:e93de9ed-bd8a-5c00-b644-91cbcd87e2cf", "id": "GHSA-xppm-jmw6-fhmf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/vite-builder 3.12.3-tuxcare.9." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.9" } ] }