{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d30bfe68-5b89-5a64-8fe3-581fb0c272eb", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxt@1.4.5-tuxcare.5", "type": "library", "name": "nuxt", "version": "1.4.5-tuxcare.5", "purl": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:8a5b6b9b-33eb-5c9a-98f7-dcab1dceadd9", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 1.4.5-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fb5c1900-f301-5549-b251-a4d03be482b7", "id": "CVE-2026-45669", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45669 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-45669. The vulnerability targets Nuxt 3.x/4.x's `navigateTo(url, { external: true })` composable, which generates server-side HTML redirect bodies containing `` tags with insufficiently encoded URLs. Nuxt 1.4.5 uses a completely different redirect architecture: server-side redirects are implemented via standard HTTP 302 responses..." }, "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ccc5bda6-71b3-5b2f-855e-ae6dcf66ec24", "id": "CVE-2026-46342", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-46342 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 Nuxt 1.4.5 does not have the Component Islands feature or the `/__nuxt_island/*` endpoint that CVE-2026-46342 targets. Component Islands were introduced in Nuxt 3.x (experimental) years after this version was released. The target uses classic Vue 2.x SSR with full-page rendering via vue-server-renderer, not the Nitro server engine with island handlers. The vulnerable code path does not exist in..." }, "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:70f9529a-8efd-51e5-9ad6-1adca5b1f7e1", "id": "CVE-2026-47200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 Target repository (Nuxt 1.4.5) does not contain the vulnerable component islands feature. The vulnerability (CVE-2026-47200) is specific to Nuxt 3.x/4.x with experimental.componentIslands enabled, which was introduced ~4 years after this version. The /__nuxt_island/ endpoint pattern and associated island context handling do not exist in the target's architecture." }, "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e30bd30e-63d8-50c8-86eb-4b1ed537ab4e", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 1.4.5-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4b45a20f-d428-5e06-973c-11777b2c1d30", "id": "CVE-2026-56317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 1.4.5-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8d9e24ef-a32e-5921-9f74-8a5f6b1372d4", "id": "CVE-2026-56326", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 Nuxt 1.4.5 is not affected by CVE-2026-56326. This CVE targets the path-normalization vulnerability in the navigateTo composable (Nuxt 3.x/4.x), which does not exist in Nuxt 1.4.5's architecture. The vulnerability requires URL constructor normalization that transforms /..//evil.com into //evil.com before output, enabling protocol-relative URL redirects. Nuxt 1.4.5 uses a redirect helper with st..." }, "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a8743aad-7d79-5b6c-b06c-e2eff0087050", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 1.4.5-tuxcare.5 of nuxt. Nuxt 1.4.5 is not affected by CVE-2026-71316. The vulnerability requires `/_payload.json` endpoints that can return cached SSR data before route middleware enforcement - a feature that doesn't exist in Nuxt 1.4.5's architecture. This version uses a fundamentally different SSR model where all data is embedded in HTML responses and middleware is always enforced before rendering. The `_payload.json` endpoint pattern and `import.meta.prerender` mechanism are features of Nuxt 4.x's Nitro server architecture, not present in Nuxt 1.x's Connect-based architecture." }, "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2074d7a5-5d62-5d09-829d-099b528935b5", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 The target repository (Nuxt 1.4.5) is not affected by GHSA-c9cv-mq2m-ppp3. The three vulnerabilities described in this advisory target APIs (navigateTo and reloadNuxtApp) that were introduced in Nuxt 3.x and do not exist in version 1.4.5. The target uses a fundamentally different navigation architecture that does not exhibit the vulnerable path-normalization behavior present in Nuxt 3.x/4.x." }, "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a69d7485-f652-5d72-957b-90afee8ad393", "id": "GHSA-fj93-7wm4-8x2g", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-fj93-7wm4-8x2g is fixed in version 1.4.5-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@1.4.5-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:46386088-f830-53ab-9a84-75b99408aaec", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 1.4.5-tuxcare.5 of nuxt. not_affected \u2014 Nuxt 1.4.5 does not contain the vulnerable