{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:400f4b61-bf65-535d-93b0-7e9ff8230c87",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/%40nuxt/webpack@2.18.1-tuxcare.2",
      "type": "library",
      "name": "@nuxt/webpack",
      "version": "2.18.1-tuxcare.2",
      "purl": "pkg:npm/%40nuxt/webpack@2.18.1-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:7a7b88a2-fcb7-5471-8e35-81f5364a60c5",
      "id": "AIKIDO-2026-10225",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability AIKIDO-2026-10225 is fixed in version 2.18.1-tuxcare.2 of @nuxt/webpack."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack@2.18.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e952e7c3-b639-5eed-99f5-b464f273b298",
      "id": "CVE-2024-34343",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-34343 is fixed in version 2.18.1-tuxcare.2 of @nuxt/webpack."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack@2.18.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:276799a5-f721-5e14-bbe8-edda810d7e37",
      "id": "CVE-2025-68458",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-68458 does not affect version 2.18.1-tuxcare.2 of @nuxt/webpack. CVE-2025-68458 in webpack 4.47.0 is not affected. Refer to webpack 4.47.0 for details."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack@2.18.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2ce7ec71-1f8b-50f8-bf14-606982f0c32d",
      "id": "CVE-2026-45669",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-45669 does not affect version 2.18.1-tuxcare.2 of @nuxt/webpack. not_affected - CVE-2026-45669 is an XSS in the SSR branch of the Nuxt 3/4 navigateTo(url, {external:true}) composable, which builds a <meta http-equiv=\"refresh\"> response body in packages/nuxt/src/app/composables/router.ts and percent-encodes only the double quote. nuxt 2.18.1 is the Nuxt 2 codebase: packages/nuxt/src/app/composables/router.ts does not exist and there is no navigateTo() composable at all - the only navigateTo mention on this branch is a comment inside the CVE-2024-34343 backport in packages/vue-app/template/components/nuxt-link.server.js. The vulnerable sink is absent."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack@2.18.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:736f7c51-79b7-554e-a112-184e9902ba72",
      "id": "CVE-2026-46342",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-46342 does not affect version 2.18.1-tuxcare.2 of @nuxt/webpack. not_affected - CVE-2026-46342 is a cache-poisoning / stored-XSS issue in the Nuxt 3/4 server-components (islands) feature: the /__nuxt_island/* endpoint renders any island component from attacker-controlled props without validating the <Name>_<hashId>.json hash server-side. nuxt 2.18.1 does not implement islands at all - a blob search over the whole branch returns 0 files for '__nuxt_island', 'NuxtIsland', 'componentIslands' and even the bare substring 'island'. There is no such endpoint, no NuxtIsland component and no island renderer, so the vulnerable surface does not exist. For contrast, nuxt 4.0.3 (VPV 82361) carries the full implementation in packages/nuxt/src/app/components/nuxt-island.ts, island-renderer.ts and app/island-hash.ts."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack@2.18.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7f464b72-8455-58bb-a719-eafec6e5ea52",
      "id": "CVE-2026-47200",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47200 does not affect version 2.18.1-tuxcare.2 of @nuxt/webpack. not_affected \u2014 The target repository (Nuxt 2.18.1-tuxcare.1) is not affected by CVE-2026-47200. This vulnerability requires the experimental.componentIslands feature and /__nuxt_island/ endpoint, which were introduced in Nuxt 3 and do not exist in Nuxt 2.x. The target uses a fundamentally different architecture where all SSR requests flow through a single unified middleware stack with no bypass mechanism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack@2.18.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b4462fa0-0351-5c70-98c8-588b10965d9e",
      "id": "CVE-2026-53722",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53722 affects version 2.18.1-tuxcare.2 of @nuxt/webpack."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack@2.18.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:53dedd51-fe43-5ac0-93e6-53b210187ccf",
      "id": "CVE-2026-56326",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-56326 does not affect version 2.18.1-tuxcare.2 of @nuxt/webpack. not_affected - CVE-2026-56326 covers three weaknesses in the Nuxt 3/4 client-navigation APIs: the SSR open redirect in navigateTo() (hasProtocol path-normalisation bypass feeding the Location header and the meta-refresh body), reflected XSS via navigateTo(url, {open: {...}}), and the protocol-relative bypass in reloadNuxtApp(). nuxt 2.18.1 is the Nuxt 2 codebase and exposes none of those APIs: there is no packages/nuxt/src/app/composables/router.ts, no navigateTo() composable and no reloadNuxtApp() anywhere on the branch (grep: 0 hits). hasProtocol exists only as an unrelated Nuxt 2 helper in packages/utils/src/lang.js, and the isScriptProtocol references in packages/vue-app/template/ belong to the earlier CVE-2024-34343 backport, not to the sinks in this advisory. Consistent with nuxt 0.10.7 (VPV 108302), 1.4.5 (VPV 108303) and 3.2.0 (VPV 108308), all already marked not_affected."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack@2.18.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:09b4bade-2ae5-563c-82e1-7f9353779e0d",
      "id": "CVE-2026-71316",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-71316 does not affect version 2.18.1-tuxcare.2 of @nuxt/webpack. Nuxt 2.18.1 is not affected by CVE-2026-71316. The vulnerability is specific to Nuxt 4.x (versions 4.4.0-4.5.1) and requires the Nitro server engine with runtime payload caching for `_payload.json` endpoints. Nuxt 2.18.1 uses a completely different architecture: it has no Nitro server, no `_payload.json` endpoints (uses `payload.js` with JSONP instead), no runtime caching mechanism, and no `import.meta.prerender` concept. The vulnerable code path does not exist in this version."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack@2.18.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4c7277f0-6938-5113-8d34-9cd7732ee4ab",
      "id": "GHSA-c9cv-mq2m-ppp3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 2.18.1-tuxcare.2 of @nuxt/webpack. not_affected \u2014 The target repository (Nuxt 2.18.1-tuxcare.1) is NOT affected by GHSA-c9cv-mq2m-ppp3. This CVE targets three specific vulnerabilities in Nuxt 3.x/4.x architecture: (1) path-normalization bypass in navigateTo, (2) script execution via navigateTo({open}), and (3) protocol-relative bypass in reloadNuxtApp. None of these code paths exist in Nuxt 2.x, which uses a fundamentally different architectur..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack@2.18.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0cc28acb-8f5a-50dd-9174-65b532b7b342",
      "id": "GHSA-m3q2-p4fw-w38m",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 2.18.1-tuxcare.2 of @nuxt/webpack. not_affected \u2014 Nuxt 2.18.1 is not affected by GHSA-m3q2-p4fw-w38m. The vulnerability targets the <NoScript> component from @unhead/vue library, which was introduced in Nuxt 3.x. Nuxt 2.18.1 uses vue-meta@2.4.0 for head management and does not have the vulnerable NoScript component. The GHSA explicitly lists affected versions as Nuxt 3.x (< 3.21.7) and 4.x (< 4.4.7), excluding all Nuxt 2.x versions."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack@2.18.1-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40nuxt/webpack@2.18.1-tuxcare.2"
    }
  ]
}