{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bb4ec531-ee36-512c-8fce-825f7c3394c2", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9", "type": "library", "name": "@nuxt/webpack-builder", "version": "3.12.3-tuxcare.9", "purl": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:321c32f5-303f-5e50-8481-4e0f2909bd11", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/webpack-builder 3.12.3-tuxcare.9. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:88ab11d8-fb2a-58d0-98b5-9d9cf1b9e30e", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:bffe35c3-330f-57dd-bc23-f7952e511efc", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:1dc459ec-b05b-597d-bbe6-05b50b322cb1", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:e4d25985-fe8a-5b76-82e5-9db2fe289a09", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:5ebc93d5-d266-5ea9-990f-a8673446d464", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:3b7831d8-e960-5ae1-bcfb-63f82ce5e05e", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d4809c11-3f12-59aa-b802-6ecf6499efa2", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d60efa0d-d40f-5878-bbb1-c42c9602f320", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/webpack-builder 3.12.3-tuxcare.9. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:6a47587c-6f1a-5f2b-ad95-10bdeba8e94a", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:632fd019-0468-5e2d-a056-ccd471934771", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d45d73c4-6b78-5b0e-9564-890e4d18e5d5", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:f8a24cd5-8b15-5667-b784-09e18fc45fbc", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:3c76fe88-6751-55a5-b3df-47cb4efd97bb", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:940d0759-baab-5f0b-9331-544be4255200", "id": "CVE-2026-56317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:0ef4f12b-4c82-5a5a-ac45-11b628fe7f00", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b9baf3ad-ae81-534b-bd09-4d51e4dabdfb", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:96d8ab77-0b2c-5605-bcfd-8fe006b9814f", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.9 of @nuxt/webpack-builder. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:9f80d587-6188-5cf4-b7c7-75db35da1afb", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:411e9521-e0b8-524f-aabf-f13687645a67", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d4c3f841-7f8f-5a9a-a9d6-6f1f2dbb2e2d", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:5ff124d5-5b57-5bd2-b993-4a491206da2f", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.9 of @nuxt/webpack-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:c6701628-af4f-5136-8817-1d8d77fa4d02", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.9 of @nuxt/webpack-builder. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:a6446e16-bcd8-5257-adad-5e0be03abd01", "id": "GHSA-xppm-jmw6-fhmf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for @nuxt/webpack-builder 3.12.3-tuxcare.9." }, "affects": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.9" } ] }