{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c7a45e0a-d390-54e4-9098-9ccbdd949440", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxt@3.12.3-tuxcare.9", "type": "library", "name": "nuxt", "version": "3.12.3-tuxcare.9", "purl": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:9739b1c2-9e97-598b-ad12-14775e9b67dc", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for nuxt 3.12.3-tuxcare.9. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:ac2d053c-7133-5c51-8368-6c3e4871d473", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:bb6fec21-541e-5b08-a7b5-12a8630ad58c", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:dcce2c95-43d8-58c4-ae31-79f940ffcaa2", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:e8f74077-4653-581f-b2be-14d18ce46741", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:05702a4f-4d1d-5904-8326-5d9b8eae4af0", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:fa327fdb-2f97-55bd-8a43-4f9fee3d17c9", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:95de7060-bf82-53ef-ba6d-484fdbcc4af6", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:ebad794b-f176-5991-a895-d1ed472faf1d", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 3.12.3-tuxcare.9. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:eb6c3faa-6f38-5b19-8a7a-d72f24866f6e", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:bfa11148-e3de-5d7f-816c-ee28e5105030", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:dbdc1b95-2e86-52af-b173-4bc19584afbd", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:c9556f38-08a7-5116-9d23-57bd97040c17", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:417be093-3883-5c3e-b132-9354d6b5fac7", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:49b256df-8885-5569-94d2-96670190217a", "id": "CVE-2026-56317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:1bc11ae7-b529-5469-b138-7bdfaf1c83e5", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:e63f52c8-cc84-57cd-a4df-1dba4e14bbc4", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:380e6093-d9e8-571f-9533-babff3af9839", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.9 of nuxt. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:2772ab3f-c7c9-5d4c-95b0-4dc05c3e8bb6", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:2b1a1a7f-e64e-5162-bfd1-238bb1683e80", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:cd321c67-c870-5073-8ef4-9665e126d9d6", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:dae1b6a0-839d-51cd-8136-f084e621c241", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.9 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:fdb32357-89b5-5523-a7ed-4bad32f1003e", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.9 of nuxt. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:c5dd2fe2-fc40-5cfd-b4ae-8aff91aa85a3", "id": "GHSA-xppm-jmw6-fhmf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for nuxt 3.12.3-tuxcare.9." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] } ], "dependencies": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.9" } ] }