{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c8ee9f60-25b8-5179-b1dd-bf3ad32565ab", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxt@3.12.3-tuxcare.2", "type": "library", "name": "nuxt", "version": "3.12.3-tuxcare.2", "purl": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:147771e5-67f3-5dea-9758-6349d625f47e", "id": "CVE-2022-25852", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25852 is a false positive for nuxt 3.12.3-tuxcare.2. CVE-2022-25852 is a false positive for this Nuxt.js repository. The CVE affects PostgreSQL database client bindings (pg-native and libpq npm packages), which are unrelated to Nuxt. Exhaustive searches confirmed no presence of pg-native or libpq as the project itself, as vendored/bundled code, or as declared dependencies. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cd3ced5a-317f-5704-ae88-23e1ec8b2ef8", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:64e9c9a5-7f94-5f2f-8028-c7996fc00002", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:613bc723-544a-5bfc-9e17-349bf6cdd28f", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c0ae4f90-f1a5-51a9-b6f3-8365ebeae739", "id": "CVE-2025-24361", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24361 affects version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:da6b3ab8-d86e-55cc-8e56-c40b45134b6b", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:01b82ce0-b4ae-5aa8-9fb9-e46d9fbce07d", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5739a446-fe4c-5d04-adef-27af65520f84", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0e352ef3-4b84-5b2c-9b1c-22ec21dc8d41", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 3.12.3-tuxcare.2. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8d66f806-62a9-524a-8273-c2fb25e9f8e3", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:573d9e2b-4f7d-57b0-83a4-f8b35ea08499", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:059bbc21-d4f4-57ee-b957-807b11b191fb", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1409790a-e5de-54c9-b985-d0c19df9d93d", "id": "CVE-2026-53721", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:77408a18-7aa8-5fc0-b027-35bb49147f85", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:79f56a1c-48de-5ae6-906c-28e4e66b9004", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fc878dca-bc1c-52d4-b2c7-37b7e7c8f083", "id": "CVE-2026-71314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71314 affects version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:076a229e-f07b-5f80-b281-767ee6e46186", "id": "CVE-2026-71316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-71316 does not affect version 3.12.3-tuxcare.2 of nuxt. Nuxt.js 3.12.3 is not affected by CVE-2026-71316. The vulnerability affects versions 4.4.0-4.5.1 and involves runtime cache access that bypasses route middleware. In version 3.12.3, the payload cache mechanism is strictly limited to the prerendering phase - at runtime, payloadCache is null and the import.meta.prerender guard prevents any cache access. The attack path from HTTP requests to /_payload.json endpoints to disclosure of SSR data cannot complete because the intermediate runtime caching step is structurally absent in this version." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9e758443-82f8-5195-b478-4bac40a2101e", "id": "CVE-2026-71318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71318 affects version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5cd3b1e4-d7cc-5101-95e6-50e0af0c6916", "id": "CVE-2026-71320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71320 affects version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e1f0715d-eecb-526d-8c26-77d3292e66a7", "id": "CVE-2026-71321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-71321 affects version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fec484ec-e158-54a0-9955-40133d795cd0", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 affects version 3.12.3-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:48d288eb-6853-527e-89b7-96f2a5afcf13", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.2 of nuxt. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.2" } ] }