{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3da1afeb-68c4-5125-aff6-3fadd26adc0f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2", "type": "library", "name": "@next/react-refresh-utils", "version": "16.0.6-tuxcare.2", "purl": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:084bb52f-48e6-5e1d-86fe-bf700651d2ce", "id": "CVE-2025-59471", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59471 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:21109f18-8af1-51b9-a9e0-4bba7114d771", "id": "CVE-2025-59472", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59472 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f233f983-3c2b-5c49-9e0d-2cb2af233e3a", "id": "CVE-2026-27977", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27977 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dbb727da-7f77-5626-9ceb-03d522d105d0", "id": "CVE-2026-27978", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27978 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:78dc07ce-375c-5486-a215-2f50a694f202", "id": "CVE-2026-27979", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27979 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4de8d385-fe36-50f2-8806-316ad1c02c39", "id": "CVE-2026-44572", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44572 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a56af4f6-0127-5a81-978e-107dfc4cd7ea", "id": "CVE-2026-44573", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44573 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a7c63f6f-bf5b-5e51-81e0-7e88123e1dea", "id": "CVE-2026-44574", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44574 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a22996b4-6373-5689-a8aa-6535c7400fa5", "id": "CVE-2026-44575", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44575 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c502a479-25ac-5705-b707-0a62e1eabe1f", "id": "CVE-2026-44576", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44576 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1af55ffd-92ad-52f3-bb41-1e835c689a93", "id": "CVE-2026-44577", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44577 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8f1a0844-62d2-57bb-8364-2215e4db3dae", "id": "CVE-2026-44578", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44578 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0cf39301-47ae-5b77-9553-6583a9cef06d", "id": "CVE-2026-44579", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44579 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7a7a7b7b-4ce2-50a8-90da-786b3e47128d", "id": "CVE-2026-44580", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44580 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:aca0d1e8-92be-5771-9b15-af07ff414cd1", "id": "CVE-2026-44581", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44581 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:901f7ce4-02c2-549e-aa27-0afa654e20f2", "id": "CVE-2026-44582", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44582 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:00c7d444-23f9-5d1c-9100-cfe46907524e", "id": "CVE-2026-45109", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45109 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ace6fce4-7aee-5904-a46e-83d96f81309f", "id": "CVE-2026-64641", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64641 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dfefa023-ee87-525c-9573-705c5d98ab8e", "id": "CVE-2026-64642", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64642 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bdc3d1d2-41fa-5596-9ca2-f83efbd2d161", "id": "CVE-2026-64643", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64643 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ff611814-b4ca-5b53-b059-ce36afd07c97", "id": "CVE-2026-64644", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64644 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0d7c51c4-c010-5c91-a870-69afb75cba86", "id": "CVE-2026-64645", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64645 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:462fb5cb-bd44-59ad-b859-a427135f9318", "id": "CVE-2026-64646", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64646 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:202f272f-e970-51c1-8adf-cd9d8082d9af", "id": "CVE-2026-64647", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64647 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a42bc10a-f0b7-55c8-ae85-d49ffb9d61b1", "id": "CVE-2026-64648", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64648 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:569b4ca6-e47e-5ddc-b897-7b9fe8e5b776", "id": "CVE-2026-64649", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64649 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:97413a3e-f35e-5a82-9437-dcd9493e3aa0", "id": "GHSA-8h8q-6873-q5fj", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-8h8q-6873-q5fj affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ea87b0e6-33ec-5512-adbf-b80bf20cb9fa", "id": "GHSA-9qr9-h5gf-34mp", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-9qr9-h5gf-34mp affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:391d5f28-d271-5e36-9817-82b761d27dcf", "id": "GHSA-h25m-26qc-wcjf", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-h25m-26qc-wcjf affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dc1cef4f-7c9b-534e-8e6e-76e56b24c42c", "id": "GHSA-mwv6-3258-q52c", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-mwv6-3258-q52c does not affect version 16.0.6-tuxcare.2 of @next/react-refresh-utils. Target version 16.0.6 is NOT AFFECTED. The target uses React version 52684925-20251110 (November 10, 2025), which predates the introduction of the vulnerable code by one month. The vulnerability (unbounded for loop in ReactPromise.prototype.then causing infinite CPU consumption during thenable chain inspection) was introduced in commit 4e20596af8 with React c689797a-20251209 (December 10, 2025) and fixed in commit 9a0dc9c555 with React 419bf4ac-20251211 (December 11, 2025). The target's React implementation does not contain the vulnerable code pattern, so the attack path from malicious serialized data to server hang does not exist." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7fb65b2f-e648-5b4e-a29d-bbd1208dc8cb", "id": "GHSA-q4gf-8mx6-v5v3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-q4gf-8mx6-v5v3 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f29cd762-3564-50d8-b79f-3b87a73161b2", "id": "GHSA-w37m-7fhw-fmv9", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-w37m-7fhw-fmv9 affects version 16.0.6-tuxcare.2 of @next/react-refresh-utils." }, "affects": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40next/react-refresh-utils@16.0.6-tuxcare.2" } ] }