{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7b5591dd-0990-5222-a435-a6dd8b1d88b3",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/h3@1.15.11",
      "type": "library",
      "name": "h3",
      "version": "1.15.11",
      "purl": "pkg:npm/h3@1.15.11"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:c75b8f16-9ed7-5225-b768-f53cfa2d87b4",
      "id": "CVE-2026-33128",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33128 affects version 1.15.11 of h3."
      },
      "affects": [
        {
          "ref": "pkg:npm/h3@1.15.11"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:54f9f2bb-4bdc-5f28-b2f4-503a8c505b70",
      "id": "CVE-2026-33129",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-33129 does not affect version 1.15.11 of h3. not_affected \u2014 Version 1.15.11 is not affected by CVE-2026-33129. The Basic Auth timing side-channel vulnerability does not exist in this version because the affected auth module (requireBasicAuth and basicAuth functions) was never introduced in the 1.x release line. The vulnerable code was introduced in the 2.0.x development branch after the 1.x line had diverged, specifically in commit 837d16f (June 2025). ..."
      },
      "affects": [
        {
          "ref": "pkg:npm/h3@1.15.11"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6c8424a0-561a-5a0b-85d9-5c391c6db83d",
      "id": "CVE-2026-33490",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33490 affects version 1.15.11 of h3."
      },
      "affects": [
        {
          "ref": "pkg:npm/h3@1.15.11"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:66fffc5d-3c87-54d1-a848-dc20513e8510",
      "id": "GHSA-4hxc-9384-m385",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-4hxc-9384-m385 does not affect version 1.15.11 of h3. not_affected \u2014 The target h3 v1.15.11 is not affected by GHSA-4hxc-9384-m385 (SSE carriage return injection vulnerability). The vulnerability was fixed by upstream maintainer Pooya Parsa in commit ba3c3fe, which was included in the upstream v1.15.9 release. The target is v1.15.11, which inherits this fix. The fix is present at src/utils/sse/utils.ts:19, where data.split(/\\r\\n|\\r|\\n/) correctly splits on all S..."
      },
      "affects": [
        {
          "ref": "pkg:npm/h3@1.15.11"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0144f12e-5217-55b5-8ab1-bc3c5ff05099",
      "id": "GHSA-wr4h-v87w-p3r7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-wr4h-v87w-p3r7 affects version 1.15.11 of h3."
      },
      "affects": [
        {
          "ref": "pkg:npm/h3@1.15.11"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/h3@1.15.11"
    }
  ]
}