{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:287c2478-5f3f-59e6-950c-39f7a0ae9d00",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/fast-xml-parser@3.17.5-tuxcare.1",
      "type": "library",
      "name": "fast-xml-parser",
      "version": "3.17.5-tuxcare.1",
      "purl": "pkg:npm/fast-xml-parser@3.17.5-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:9bdcb0a5-f7e1-55a0-9566-9828ffc166e0",
      "id": "CVE-2023-26920",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-26920 is fixed in version 3.17.5-tuxcare.1 of fast-xml-parser."
      },
      "affects": [
        {
          "ref": "pkg:npm/fast-xml-parser@3.17.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a0bd8b0e-dcdb-5fa6-9186-31da8d77276e",
      "id": "CVE-2026-25128",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-25128 does not affect version 3.17.5-tuxcare.1 of fast-xml-parser. Version 3.17.5-tuxcare.1 is not affected by CVE-2026-25128. The vulnerability requires numeric entity processing code that calls String.fromCodePoint() with out-of-range values, causing a RangeError crash. This version lacks the entity processing architecture entirely - it has no OrderedObjParser.js file, no String.fromCodePoint usage, and no entity conversion logic. XML numeric entities (e.g., �) remain as literal strings in the parsed output rather than being converted to characters. The vulnerable code path introduced in version 5.x does not exist in the version 3.x codebase architecture."
      },
      "affects": [
        {
          "ref": "pkg:npm/fast-xml-parser@3.17.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d3acaf21-6fcd-5301-9fe4-69fcebffaace",
      "id": "CVE-2026-41650",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41650 is fixed in version 3.17.5-tuxcare.1 of fast-xml-parser."
      },
      "affects": [
        {
          "ref": "pkg:npm/fast-xml-parser@3.17.5-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/fast-xml-parser@3.17.5-tuxcare.1"
    }
  ]
}