{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0ccb9259-95be-591e-b34c-ffd113dadbef", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8", "type": "library", "name": "@nuxt/webpack-builder", "version": "3.12.3-tuxcare.8", "purl": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:38d95ce6-00ee-5b2f-96ed-f328d7baf920", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/webpack-builder 3.12.3-tuxcare.8. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:94c580af-03a6-585d-8143-d7b734f8cbca", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d80cbcd7-3c87-5944-9c16-9d9ce1c200eb", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:90be5a63-1077-5366-9aa0-b1ef1e5a6d5e", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f6d6904c-867f-5f98-b032-81e5fba164b8", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:425bd98e-4881-596d-99e3-75e82643c8ee", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:6f4c3258-2c9f-5b85-8645-6d49983d5332", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5d092ad5-69e6-5d8c-b8be-fd46ba58de38", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2944e892-aaef-5602-a720-fd98f5252700", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/webpack-builder 3.12.3-tuxcare.8. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:983a981b-f111-5ea3-94dc-ab8255cd3ad2", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9ae1ff89-bfc5-5ea6-bd4d-09aeb14b4d50", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4fbe0e01-4469-5be4-adf8-807ba7d64c19", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:56ecd8f6-9ddf-5df3-942c-4068a2693ed9", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2ef38847-30af-5e0b-b524-0e283a1fa30c", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:84bcae62-5f08-5e70-9b5b-41614a2a9642", "id": "CVE-2026-56317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:70fa27ce-00e0-50e8-bbdd-635007e16ed9", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:6fcc4fa4-0963-5b5b-a040-51892c1b259e", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7dca8271-2539-522d-9918-490ffdab9891", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.8 of @nuxt/webpack-builder. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1e305d8f-1a05-5e33-b46c-93569f56bf60", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:284a6d73-1b27-5906-97b0-0548af4426ea", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7d620965-bf16-53cb-891f-0342a1f1cac8", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:bc60f915-5f41-5011-b9b3-e89910a3dabf", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.8 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8d4fbc3e-2515-5557-9ad2-1a312e14f1d3", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.8 of @nuxt/webpack-builder. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:bd19951c-43bf-56dd-915b-9d527ea4101b", "id": "GHSA-xppm-jmw6-fhmf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/webpack-builder 3.12.3-tuxcare.8." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.8" } ] }