{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0e5ea4d6-a8e4-51be-a055-96edda847b13", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4", "type": "library", "name": "@nuxt/vite-builder", "version": "3.12.3-tuxcare.4", "purl": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:d6b5fa5a-18ab-5d3a-a6b0-3049d5b7d9c0", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/vite-builder 3.12.3-tuxcare.4. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b17d9651-f916-5507-9b1c-561d7bd3a52c", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d331558f-d3ec-5984-85a4-aadf40c2df2c", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:13c64c05-645f-5e45-990c-91bbd82902cd", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:155b3e9c-d431-5582-a435-857ba5967fed", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2fa9452c-97c6-59ec-840b-5e0d20302ad3", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f687d31b-cd90-5436-be4c-2cf118cb9397", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4d8c70e0-e45d-53f6-9faa-95116cbd5632", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3420f6c6-79c7-5039-a423-821b43fc3e21", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/vite-builder 3.12.3-tuxcare.4. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:add20296-2b9c-5a98-a2d8-42cf9d24b532", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e10f72d2-1709-5a45-b3b0-05a02b4f73e4", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:20e6464d-254b-5572-970b-8f18c2808c5a", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:09b1456d-fae4-5c8a-9faa-fe1b0bc62e96", "id": "CVE-2026-53721", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8886895a-b7c7-5450-9120-45e40242447d", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b040e443-f86a-570d-942f-64d12be8db86", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:99632f05-d172-50c9-a892-c16eb7f60b4e", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4d1d4aa1-dcee-5677-98a8-9b7a1d4f0bd7", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.4 of @nuxt/vite-builder. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fa7081f1-e5ee-524a-96cf-a3b53e7a51ef", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:77ad2290-dd21-5e13-890e-4e7d6ba076a8", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:16ab264e-5154-50a8-b75a-97c9d1e4d2ab", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ae5de182-b44a-5462-a2e1-4d578f4bef91", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.4 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b36ec6f2-8d50-594b-bd1b-e7bb2786a069", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.4 of @nuxt/vite-builder. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.4" } ] }