{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dd8b42a9-f7be-5633-bdc6-009adf2172b8", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxt@3.12.3-tuxcare.8", "type": "library", "name": "nuxt", "version": "3.12.3-tuxcare.8", "purl": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:449c8f37-000b-59b7-943c-35d85b15b67b", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for nuxt 3.12.3-tuxcare.8. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ee8a66c4-50f5-5b92-b9c1-f4a479ea710f", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3027dd14-0b61-58a0-a161-5717eba3c31f", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:885c5c0a-26ad-5351-8262-3e0be7d63c1f", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:35fdd65d-8df7-51af-890d-4c024ec930d3", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e4262170-a0be-5194-89a9-bdb9f496d824", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8319b839-46b6-5490-bf85-609ea200efed", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0798c7de-7daa-5277-a1cb-1ab3fa28dcc4", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:bcbb6e4b-a637-5a8b-8b93-e071259c37eb", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 3.12.3-tuxcare.8. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3bab28a5-a39c-50b1-a84b-e9ed1e84dedc", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8cd48aa7-5a23-5de2-9e9d-e8bcfa001a4b", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d06b5eb3-7c1d-505c-ad96-72b59aeef781", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a9828375-0b29-543c-bf20-94dd7163ea69", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b6a7702f-b71e-5a66-9d3f-fa9d11990e25", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:24768771-bdf8-5f94-9438-6dfec5e9e766", "id": "CVE-2026-56317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e9750753-3609-5e26-804f-b367393bc19d", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8de14a80-cbe5-5895-a4f3-daa3f00b47b5", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5e40a83f-9b36-51e2-b61b-cb487215d888", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.8 of nuxt. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8ec7d289-36f0-544e-a58a-0add04820016", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5f4bc8c5-ca4f-54e4-a573-6ce561007841", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:95edbd02-6585-5cb6-ba9a-4efcc9a788ab", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:034d3222-3c26-589e-8975-90fa34f2ad77", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:cdeaf178-44b2-562a-bab0-8f0a18658f3a", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.8 of nuxt. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f8a8144c-f33a-5d93-a067-71c1699594cb", "id": "GHSA-xppm-jmw6-fhmf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for nuxt 3.12.3-tuxcare.8." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.8" } ] }