{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d743d2e4-b481-5640-b8e9-4fcdd3d9686c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "fast-uri", "purl": "pkg:npm/fast-uri@2.4.2-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5", "version": "2.4.2-tuxcare.5", "pedigree": { "ancestors": [ { "name": "fast-uri", "purl": "pkg:npm/fast-uri@2.4.2", "type": "library", "version": "2.4.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-110095", "affects": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ], "bom-ref": "urn:uuid:628f81cf-7aae-5c9e-b7cd-bb618182eb8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-110095 is fixed in version 2.4.2-tuxcare.5 of fast-uri." } }, { "id": "CVE-2026-110180", "affects": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ], "bom-ref": "urn:uuid:5b72a462-a168-589d-b5cf-7d818a044faf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-110180 is fixed in version 2.4.2-tuxcare.5 of fast-uri." } }, { "id": "CVE-2026-110306", "affects": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ], "bom-ref": "urn:uuid:8ce85357-1d79-5a82-92f6-0e98fef9355a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-110306 is fixed in version 2.4.2-tuxcare.5 of fast-uri." } }, { "id": "CVE-2026-110725", "affects": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ], "bom-ref": "urn:uuid:4d6dedad-ccb1-5c4e-a5e8-e9761c7c7598", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-110725 is fixed in version 2.4.2-tuxcare.5 of fast-uri." } }, { "id": "CVE-2026-16221", "affects": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ], "bom-ref": "urn:uuid:499e584a-e1aa-5dd5-bf01-07a12c45a774", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-16221 is fixed in version 2.4.2-tuxcare.5 of fast-uri." } }, { "id": "CVE-2026-18446", "affects": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ], "bom-ref": "urn:uuid:a17ded2f-e2ee-5685-9802-caae0641a827", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-18446 is fixed in version 2.4.2-tuxcare.5 of fast-uri." } }, { "id": "CVE-2026-6321", "affects": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ], "bom-ref": "urn:uuid:be44e812-b337-5188-836e-9fc7e37a51f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-6321 does not affect version 2.4.2-tuxcare.5 of fast-uri. not_affected \u2014 The target repository fast-uri v2.4.2 already contains the vendor-authored fix for CVE-2026-6321. The vulnerability pattern (premature decoding of percent-encoded path-reserved characters) has been removed by upstream commit 23108bc authored by Matteo Collina on 2026-07-17, which introduced the normalizePathEncoding() defense that preserves %2F and %2E as encoded data during path processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-6322", "affects": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ], "bom-ref": "urn:uuid:4642da6b-7438-5e00-88b7-dcbc002f261a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-6322 does not affect version 2.4.2-tuxcare.5 of fast-uri. not_affected \u2014 The target repository (fast-uri v2.4.2) contains a complete fix for CVE-2026-6322. The vulnerability involved percent-encoded authority delimiters being decoded and serialized as literal characters, changing URI authority structure. The fix, introduced in commit 23108bc, adds reescapeHostDelimiters() function that re-encodes authority delimiters after percent-decoding. This fix was authored by ...", "justification": "code_not_present" } }, { "id": "CVE-2026-75899", "affects": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ], "bom-ref": "urn:uuid:5fd0a0b0-ec9d-5f8f-a1a4-9df7b0b3d5d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75899 is fixed in version 2.4.2-tuxcare.5 of fast-uri." } }, { "id": "CVE-2026-75931", "affects": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ], "bom-ref": "urn:uuid:0af37064-a233-5ab8-aa46-5d9cdf2e6d14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75931 is fixed in version 2.4.2-tuxcare.5 of fast-uri." } }, { "id": "CVE-2026-75975", "affects": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ], "bom-ref": "urn:uuid:99438f36-5496-59bf-8e33-02ff4f6eab96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75975 is fixed in version 2.4.2-tuxcare.5 of fast-uri." } }, { "id": "CVE-2026-76172", "affects": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ], "bom-ref": "urn:uuid:729149a7-8cc6-5141-9d5f-68b31991c24e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-76172 is fixed in version 2.4.2-tuxcare.5 of fast-uri." } }, { "id": "CVE-2026-84292", "affects": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ], "bom-ref": "urn:uuid:d95ee380-7996-572a-b97a-5bff59dccdcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84292 is fixed in version 2.4.2-tuxcare.5 of fast-uri." } }, { "id": "CVE-2026-84394", "affects": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ], "bom-ref": "urn:uuid:487d8e7c-d970-5b50-9dcd-c6b1a96824cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84394 is fixed in version 2.4.2-tuxcare.5 of fast-uri." } }, { "id": "CVE-2026-86472", "affects": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ], "bom-ref": "urn:uuid:a2924664-af5e-5ff3-835f-3f50e56a85d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-86472 is fixed in version 2.4.2-tuxcare.5 of fast-uri." } } ], "dependencies": [ { "ref": "pkg:npm/fast-uri@2.4.2-tuxcare.5" } ] }