{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5d3e4bbc-0994-51f0-97e4-be973c0b57de", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5", "type": "library", "name": "@nuxt/vite-builder", "version": "3.2.0-tuxcare.5", "purl": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:fcc0bc72-72e3-58ef-b008-2a495e4b257e", "id": "CVE-2016-10735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-10735 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3e0026e1-223e-55fc-8b92-912929ada0e9", "id": "CVE-2018-14040", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14040 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c95e4337-dc0e-5ab3-8b87-e5358b47434b", "id": "CVE-2018-14042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14042 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:852dcb91-7943-55f1-b7d4-e7758ae6cf42", "id": "CVE-2018-16487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-16487 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5aeec26e-824f-5899-b0e6-3754bea92816", "id": "CVE-2018-20676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20676 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c84b2062-f70c-5d3d-8b37-6890e5c2fc35", "id": "CVE-2018-20677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20677 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8cbff222-aa2b-5e0f-b402-abab7c2d8230", "id": "CVE-2018-3721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-3721 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:26bbcef1-930e-56be-bd61-b414638f014b", "id": "CVE-2019-10744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10744 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4c4659f0-bde9-5112-a8d9-91dfcd4a115b", "id": "CVE-2019-14862", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-14862 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fd19e89a-df2d-5d58-aa9c-48672de9e8f4", "id": "CVE-2019-8331", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-8331 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:24bdb3dd-adc2-5ab2-b33b-a4fa774a8ba3", "id": "CVE-2020-36049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-36049 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d8caa975-fe2f-52ce-bcf1-49f31a4543e2", "id": "CVE-2020-8203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-8203 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e4c02f4e-acc8-58f3-baab-11061dcbcae9", "id": "CVE-2021-23337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23337 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:16d39cad-3375-5eda-8747-5d901ccc2ac9", "id": "CVE-2022-2421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2421 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2a91d0da-9d93-5656-b08f-484aaa1d6975", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/vite-builder 3.2.0-tuxcare.5. CVE-2022-25852 is a false positive for this repository. The CVE affects pg-native and libpq npm packages (PostgreSQL database client bindings), but this repository is the Nuxt.js web framework (version 3.2.0-tuxcare.4). Exhaustive containment search found no pg-native/libpq code in the repository - not as the project itself, not as a vendored/bundled copy, and not as a declared dependency. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:35c173a9-1637-5d46-8a77-a8896bed9a11", "id": "CVE-2023-32695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-32695 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d15a9f3a-b039-5615-8075-70999dce0451", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7d677b16-3f43-5a23-8ad1-11dfb15ad124", "id": "CVE-2024-6484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6484 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:87ad6f80-807c-5c0d-9e00-8a850134de11", "id": "CVE-2024-6485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6485 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:093bda97-43fc-50e4-b25c-981693faef7e", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:91071612-f9b1-5438-8682-034e54be953e", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:86495e2f-8b71-5068-8098-89ea2f0766f7", "id": "CVE-2026-33151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33151 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:563aa2ac-68c8-5216-a64c-ea227fc2102d", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e085e3c4-ae29-5c7c-8a3b-d996316bcc07", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/vite-builder 3.2.0-tuxcare.5. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (IPv6/IPv4 address parsing), but this repository is Nuxt v3.2.0-tuxcare.1 (a Vue.js meta-framework). The affected component is not present in this repository as a vendored copy, dependency, or in any other form. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:271d6ba2-85e4-5c35-9fd9-7b33d3db69a1", "id": "CVE-2026-45669", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45669 does not affect version 3.2.0-tuxcare.5 of @nuxt/vite-builder. not_affected - CVE-2026-45669 requires the SSR redirect body that navigateTo(url, {external:true}) builds in packages/nuxt/src/app/composables/router.ts (nuxtApp.ssrContext['~renderResponse'] with only the double quote percent-encoded). In nuxt 3.2.0 that code does not exist: the server-side external branch of navigateTo delegates to h3 sendRedirect(event, redirectLocation, code) and builds no HTML body. Grep over the branch: '%22' - 0 hits in source, 'renderResponse' - only packages/nuxt/src/core/runtime/nitro/renderer.ts. The sink appears in later majors: 4.0.3 has it and carries patches/CVE-2026-45669.patch." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7e2e83d3-ac1c-5834-8115-cf3fb7292089", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:04324122-83e2-5fe6-8cb8-0b294a3e6c97", "id": "CVE-2026-47200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 3.2.0-tuxcare.5 of @nuxt/vite-builder. not_affected \u2014 Nuxt version 3.2.0 does not contain the server-only pages feature that is the prerequisite for CVE-2026-47200. The vulnerable code pattern (`.server.vue` pages rendered as islands via `/__nuxt_island/page_*` endpoint) was introduced in Nuxt v3.11.0, which is 2,059 commits after v3.2.0. The target version predates the feature by multiple major versions." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:753703f0-d39a-53c9-9244-2f00d7c093f2", "id": "CVE-2026-4800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-4800 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6b9cfee5-d397-575a-a26a-610f4e6db32b", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:55bf5305-62f3-5d3d-83da-b87923ffe775", "id": "CVE-2026-56317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ec98402a-b7de-5cab-8199-25f8956ec97c", "id": "CVE-2026-56326", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 3.2.0-tuxcare.5 of @nuxt/vite-builder. not_affected \u2014 Version 3.2.0 does not contain the vulnerable code pattern. The vulnerability exists in the encodeURL() function which was introduced on June 26, 2024, over a year after version 3.2.0 (released February 9, 2023). The target uses a simpler redirect architecture without the vulnerable encodeURL() function." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:aa8c5aeb-c706-5060-9d96-b49470260c7b", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5d64e3fd-011c-5d1a-bb33-612af35d4b65", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.2.0-tuxcare.5 of @nuxt/vite-builder. Nuxt.js version 3.2.0 is not affected by CVE-2026-71316. The vulnerability requires runtime payload caching (introduced in Nuxt 4.x) where _payload.json entries are served before route middleware. Version 3.2.0 only has build-time prerender cache (null during runtime), uses _payload.js files (not .json), and all runtime payload requests undergo full SSR rendering with route rules enforcement. The vulnerable code path (runtime cache bypass) does not exist in this version's architecture." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bd3dc575-cb88-5bdb-8458-c7381d254177", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d58b7296-6cf3-507e-a419-b39eec6f2a20", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.2.0-tuxcare.5 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5185c1ea-65fc-5b85-9de8-43db531538e4", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 3.2.0-tuxcare.5 of @nuxt/vite-builder. not_affected \u2014 Target repository Nuxt version 3.2.0 is NOT affected by GHSA-c9cv-mq2m-ppp3. All three vulnerability sinks described in the CVE (SSR open redirect via path-normalization, script execution via navigateTo open option, and protocol-relative bypass in reloadNuxtApp) require code features that were introduced AFTER version 3.2.0. The vulnerable encodeURL function with WHATWG URL parsing was added in..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a7d5a765-ca6f-571c-8393-5982b74e9052", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.2.0-tuxcare.5 of @nuxt/vite-builder. not_affected \u2014 Version 3.2.0 is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerable innerHTML pattern was introduced in v3.16.0 (March 2025), two years after this version. The target uses noscript.children instead of the vulnerable noscript.innerHTML assignment." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8d95266f-9fa6-549e-a448-bcf04b67ca1a", "id": "GHSA-xppm-jmw6-fhmf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/vite-builder 3.2.0-tuxcare.5." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.2.0-tuxcare.5" } ] }