{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a81e2a24-309f-57d0-9e27-1a73cdce4811", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxt@3.2.0-tuxcare.5", "type": "library", "name": "nuxt", "version": "3.2.0-tuxcare.5", "purl": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c0cfd4fb-d52d-59d8-be52-4a528012b151", "id": "CVE-2016-10735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-10735 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0cef9e02-e94d-54f2-a7b2-72b752a32860", "id": "CVE-2018-14040", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14040 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3cff04ea-8e7d-5e13-b843-0c8b0af6120b", "id": "CVE-2018-14042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14042 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e120418e-b604-575b-95d9-d0dcae01851d", "id": "CVE-2018-16487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-16487 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:24039408-ecf6-54d8-b95e-eeff35adb97a", "id": "CVE-2018-20676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20676 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:260cb7e8-8984-5aa5-9a5d-cc6375c3d9be", "id": "CVE-2018-20677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20677 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1f771848-1477-553b-a824-7bae0107e824", "id": "CVE-2018-3721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-3721 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3efba894-21ec-5ff5-aad1-d1b2a4dd97af", "id": "CVE-2019-10744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10744 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d37cf080-3be9-5191-8fd7-dd67ca72386f", "id": "CVE-2019-14862", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-14862 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:825d9b51-0895-5799-80ac-42e031da77a1", "id": "CVE-2019-8331", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-8331 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:af592e11-68cb-51d7-90e6-04e926e1830a", "id": "CVE-2020-36049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-36049 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ad2dd1d1-1238-5ee7-b6ed-6bea73363298", "id": "CVE-2020-8203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-8203 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0bf30e9d-904f-5368-afb8-26bb4244d352", "id": "CVE-2021-23337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23337 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:12c0ce3a-76b1-51b7-ba2d-c859292ef227", "id": "CVE-2022-2421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2421 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:82b38bc0-6db8-5c1b-b210-0c68b84ffa9a", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for nuxt 3.2.0-tuxcare.5. CVE-2022-25852 is a false positive for this repository. The CVE affects pg-native and libpq npm packages (PostgreSQL database client bindings), but this repository is the Nuxt.js web framework (version 3.2.0-tuxcare.4). Exhaustive containment search found no pg-native/libpq code in the repository - not as the project itself, not as a vendored/bundled copy, and not as a declared dependency. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7bcdd939-37e4-54f6-ba21-dc912d36722e", "id": "CVE-2023-32695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-32695 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:77be8341-1e22-5a0a-92d1-cb26e3b3ff31", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:801879b1-ef13-5dc7-b1d2-67575ae72af3", "id": "CVE-2024-6484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6484 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:26506bfa-01f2-5d99-9e43-cdcce86d521f", "id": "CVE-2024-6485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6485 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f5eb8b37-a92d-54d0-b259-5d091e2859d0", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9cde186d-36cc-5f4c-b532-226035747709", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:21bbfb64-1534-5dfc-b2a3-b8cb1c7b46a3", "id": "CVE-2026-33151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33151 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a247c902-c209-5260-a383-a0d97619594d", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:57395401-62d0-58f0-9999-4c93ebed44fa", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 3.2.0-tuxcare.5. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (IPv6/IPv4 address parsing), but this repository is Nuxt v3.2.0-tuxcare.1 (a Vue.js meta-framework). The affected component is not present in this repository as a vendored copy, dependency, or in any other form. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:776cba51-0657-59ca-93e4-e6c59a054fef", "id": "CVE-2026-45669", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45669 does not affect version 3.2.0-tuxcare.5 of nuxt. not_affected - CVE-2026-45669 requires the SSR redirect body that navigateTo(url, {external:true}) builds in packages/nuxt/src/app/composables/router.ts (nuxtApp.ssrContext['~renderResponse'] with only the double quote percent-encoded). In nuxt 3.2.0 that code does not exist: the server-side external branch of navigateTo delegates to h3 sendRedirect(event, redirectLocation, code) and builds no HTML body. Grep over the branch: '%22' - 0 hits in source, 'renderResponse' - only packages/nuxt/src/core/runtime/nitro/renderer.ts. The sink appears in later majors: 4.0.3 has it and carries patches/CVE-2026-45669.patch." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f38f7794-82ee-59fc-a435-104ee77cbb44", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f93071b6-c268-5e90-89f2-1e33fd9c7183", "id": "CVE-2026-47200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 3.2.0-tuxcare.5 of nuxt. not_affected \u2014 Nuxt version 3.2.0 does not contain the server-only pages feature that is the prerequisite for CVE-2026-47200. The vulnerable code pattern (`.server.vue` pages rendered as islands via `/__nuxt_island/page_*` endpoint) was introduced in Nuxt v3.11.0, which is 2,059 commits after v3.2.0. The target version predates the feature by multiple major versions." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:42a42e96-662b-5696-980f-7653beba8a74", "id": "CVE-2026-4800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-4800 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3717c0c0-1067-5ed3-a0a0-0ef778f0321c", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ddbbcd30-ac8d-5dfb-8360-696153ed2971", "id": "CVE-2026-56317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-56317 is fixed in version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b5f835b5-af3e-5fb8-aa2e-d64844a7d861", "id": "CVE-2026-56326", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 3.2.0-tuxcare.5 of nuxt. not_affected \u2014 Version 3.2.0 does not contain the vulnerable code pattern. The vulnerability exists in the encodeURL() function which was introduced on June 26, 2024, over a year after version 3.2.0 (released February 9, 2023). The target uses a simpler redirect architecture without the vulnerable encodeURL() function." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:449d6e49-a0cb-56e5-b9ed-16149f598293", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0becde46-730e-500b-bc56-8748b6ed4690", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.2.0-tuxcare.5 of nuxt. Nuxt.js version 3.2.0 is not affected by CVE-2026-71316. The vulnerability requires runtime payload caching (introduced in Nuxt 4.x) where _payload.json entries are served before route middleware. Version 3.2.0 only has build-time prerender cache (null during runtime), uses _payload.js files (not .json), and all runtime payload requests undergo full SSR rendering with route rules enforcement. The vulnerable code path (runtime cache bypass) does not exist in this version's architecture." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c42fd425-a87b-5bb4-ab2f-f98aa9cfa621", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:21a6f485-5aea-5a3f-8252-7e9152a37505", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.2.0-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4c922b62-9d8a-5429-9ef2-fc35c17ec8b3", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 3.2.0-tuxcare.5 of nuxt. not_affected \u2014 Target repository Nuxt version 3.2.0 is NOT affected by GHSA-c9cv-mq2m-ppp3. All three vulnerability sinks described in the CVE (SSR open redirect via path-normalization, script execution via navigateTo open option, and protocol-relative bypass in reloadNuxtApp) require code features that were introduced AFTER version 3.2.0. The vulnerable encodeURL function with WHATWG URL parsing was added in..." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6cfed02c-f6f7-5129-ab99-4c47ac535c10", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.2.0-tuxcare.5 of nuxt. not_affected \u2014 Version 3.2.0 is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerable innerHTML pattern was introduced in v3.16.0 (March 2025), two years after this version. The target uses noscript.children instead of the vulnerable noscript.innerHTML assignment." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:72667f87-1912-5e0a-9508-17591678bd57", "id": "GHSA-xppm-jmw6-fhmf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-xppm-jmw6-fhmf is a false positive for nuxt 3.2.0-tuxcare.5." }, "affects": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:npm/nuxt@3.2.0-tuxcare.5" } ] }