{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8e14ad52-3b32-5940-a4b7-9db545d80406",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/fast-xml-parser@3.19.0-tuxcare.1",
      "type": "library",
      "name": "fast-xml-parser",
      "version": "3.19.0-tuxcare.1",
      "purl": "pkg:npm/fast-xml-parser@3.19.0-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:c8ac016f-f729-59a8-880b-d6413737fa6f",
      "id": "CVE-2023-26920",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-26920 is fixed in version 3.19.0-tuxcare.1 of fast-xml-parser."
      },
      "affects": [
        {
          "ref": "pkg:npm/fast-xml-parser@3.19.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:731d2b19-de46-52d9-b5a5-01081e99efc6",
      "id": "CVE-2026-25128",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-25128 does not affect version 3.19.0-tuxcare.1 of fast-xml-parser. Version 3.19.0 is not affected by CVE-2026-25128. The vulnerability exists in versions 5.0.9 through 5.3.3 where the OrderedObjParser class processes numeric HTML entities using String.fromCodePoint() without validating that code points are within the valid Unicode range (0 to 0x10FFFF). Version 3.19.0 uses a fundamentally different architecture that does not process entities - they remain as literal strings in the parser output. Testing confirms that out-of-range entities like � and � do not cause crashes and are preserved unchanged in the output."
      },
      "affects": [
        {
          "ref": "pkg:npm/fast-xml-parser@3.19.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:05bed379-8de4-5a39-96ef-97b09490e9c9",
      "id": "CVE-2026-41650",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41650 is fixed in version 3.19.0-tuxcare.1 of fast-xml-parser."
      },
      "affects": [
        {
          "ref": "pkg:npm/fast-xml-parser@3.19.0-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/fast-xml-parser@3.19.0-tuxcare.1"
    }
  ]
}