{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2241eb69-2df1-519a-b3d9-e29e5fa5b0d2", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxt@0.10.7-tuxcare.2", "type": "library", "name": "nuxt", "version": "0.10.7-tuxcare.2", "purl": "pkg:npm/nuxt@0.10.7-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e71f6846-0e7c-528f-9ade-4c291135e29a", "id": "CVE-2024-27088", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-27088 is fixed in version 0.10.7-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b57c7198-5940-5d31-bd72-8af5cca26b50", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 0.10.7-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b656216e-1147-5742-b558-e1f44adcea2a", "id": "CVE-2026-45669", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45669 does not affect version 0.10.7-tuxcare.2 of nuxt. not_affected \u2014 Nuxt 0.10.7 is not affected by CVE-2026-45669. The vulnerability requires server-generated HTML redirect bodies with meta-refresh tags that insufficiently encode HTML-significant characters. Version 0.10.7 uses a fundamentally different redirect architecture: pure HTTP 302 redirects with Location headers (properly encoded via encodeURI()), with no HTML body generation. The vulnerable code patte..." }, "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5dd69cd4-7ff2-56e9-a8fd-c6f50efd35ab", "id": "CVE-2026-46342", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-46342 does not affect version 0.10.7-tuxcare.2 of nuxt. not_affected \u2014 Nuxt version 0.10.7-tuxcare.2 does not contain the vulnerable island components feature. CVE-2026-46342 affects the `/__nuxt_island/*` endpoint and island components introduced in Nuxt 3.x/4.x as an experimental feature (`experimental.componentIslands`). Version 0.10.7 from 2017 predates this feature entirely. The target has no island endpoints, no island component code, no experimental configu..." }, "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5eeaa413-53a2-55bd-a09a-5671cc0f4b73", "id": "CVE-2026-47200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 0.10.7-tuxcare.2 of nuxt. not_affected \u2014 The target repository (Nuxt 0.10.7, circa 2017) does not contain the vulnerable feature. CVE-2026-47200 affects the component islands feature (experimental.componentIslands) introduced in Nuxt 3+ (2022+), which allows .server.vue pages to be rendered via the /__nuxt_island/ endpoint without executing route middleware. This feature and endpoint do not exist in Nuxt 0.10.7." }, "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5317baf6-7bb8-5426-bba7-a83105354fe2", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 0.10.7-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d34a5d9f-77f4-50c8-a1be-a4d71a842b76", "id": "CVE-2026-56326", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 0.10.7-tuxcare.2 of nuxt. not_affected \u2014 Nuxt 0.10.7 is not affected by CVE-2026-56326. The vulnerability requires URL constructor path normalization (turning /..//evil.com into //evil.com) which is specific to Nuxt 3.x/4.x architecture. Nuxt 0.10.7 uses a different redirect mechanism (ctx.redirect with urlJoin) that collapses multiple slashes before setting the Location header, preventing protocol-relative URL formation through any c..." }, "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f41f6def-8178-5d01-ac38-7aed7c641898", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 0.10.7-tuxcare.2 of nuxt. Nuxt 0.10.7 is not affected by CVE-2026-71316. The vulnerability concerns a feature specific to Nuxt 4.4.0-4.5.1 where /_payload.json endpoints can serve cached SSR data before route middleware executes. This endpoint pattern and the associated runtime payload caching mechanism do not exist in Nuxt 0.10.7. The target version uses a fundamentally different SSR architecture where data is serialized directly into HTML as window.__NUXT__ and middleware always executes during the rendering pipeline." }, "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2f60dfb8-83e7-5b6c-ae3e-913d7554429f", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 0.10.7-tuxcare.2 of nuxt. not_affected \u2014 Target repository (Nuxt v0.10.7) uses a different architecture that predates the vulnerable APIs (navigateTo, reloadNuxtApp). The existing redirect mechanism has equivalent protections via the urlJoin() function that prevent the path-normalization bypass. The other two vulnerabilities target APIs that do not exist in this version." }, "affects": [ { "ref": "pkg:npm/nuxt@0.10.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:56b6ed4a-094c-5e44-a1d6-ab2a3306fd45", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 0.10.7-tuxcare.2 of nuxt. not_affected \u2014 Nuxt v0.10.7-tuxcare.1 does not contain the vulnerable