{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:12cea937-f68f-5762-af0d-7ec2fc995836", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6", "type": "library", "name": "@nuxt/vite-builder", "version": "3.12.3-tuxcare.6", "purl": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:087fb1e7-a8b3-59be-98d8-5ae25de1f177", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/vite-builder 3.12.3-tuxcare.6. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b4a4322e-42f7-527d-b6d9-0255bd30eeb6", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:14eadbf7-f3a4-5ede-9a2e-0428ca84b1af", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1b2dfb75-d8d9-5754-818a-09c381d9426a", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:322071c6-d3a2-5ca1-b939-43f9285eba61", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9ca1782c-b98d-5576-9c7e-92311908ca7a", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:35705c44-0f79-5da9-8888-c2f7ffd9d256", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f278a83c-be58-52e7-bf93-fbedcdcacf75", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5dfdb99a-9a65-5f39-acdf-5fca1f06d991", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/vite-builder 3.12.3-tuxcare.6. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6c24bdc4-dc19-5658-80a3-8a8971463439", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8c065be4-65dc-534b-aa79-5b12e32796e5", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:27941aa0-f870-553c-90c3-9f5710bf7c91", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:962adbfc-2762-5b5e-bd17-fd0e6f872639", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5cc0b591-23fb-5abc-92a7-9741ddb320a2", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:92d9bbed-52dc-57b6-ae35-f480e113dc8c", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e7e57e25-e11a-54a7-bbb1-7be2553ae8c0", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:11b4d58e-9bd6-5474-b078-5e29f7147b5a", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.6 of @nuxt/vite-builder. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f320ca04-ac96-51b0-a314-c612010797c6", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:541fec77-d312-50e1-9466-f0e6444d90ea", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:438a5b15-822e-5893-9669-9eb84bcf942e", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a485bfc3-265c-5ffb-af08-1cadfe3841bc", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.6 of @nuxt/vite-builder." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c15bd99f-d167-5f29-a5cc-032afbb6ab61", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.6 of @nuxt/vite-builder. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/vite-builder@3.12.3-tuxcare.6" } ] }