{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7cc8e275-76a8-5a36-b7c4-92c69e3d581e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "astro", "purl": "pkg:npm/astro@3.6.5-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/astro@3.6.5-tuxcare.7", "version": "3.6.5-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-47885", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:4e2e2501-9e34-5e38-a5d2-ca88e1273c77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47885 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:34cb95a9-6e59-5a62-9b58-cd48d454a3d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:ecf9867e-c0fa-5d10-8a2e-e1a1638beaa7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:050a41f8-8ed0-54c4-b10d-b77d04a8fbce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55303 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:456372b5-c055-5cfb-ab8f-9e7c19178bd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2025-64525", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:6f8b7b19-c018-5da9-a555-235d47050c09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64525 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:44470b7e-0bf1-57a1-af10-1b0110403199", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:0e7d0184-6063-56e3-9f2c-24e5988842ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:316dc739-181d-5214-bf3f-0086ed6b6f12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:de6e41c7-3034-563e-b48d-c7b5e7571dc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:cacb17b6-72f0-5e4a-835e-40e580be36ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:d9985f1c-19db-5e72-abc5-f75f58349e2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33769 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:f010a034-9dff-5141-897e-959465290016", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:335dc3fc-e6fc-5737-9e2c-23a8cf07cf8d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45028 does not affect version 3.6.5-tuxcare.7 of astro. not_affected \u2014 Astro version 3.6.5 is NOT AFFECTED by CVE-2026-45028. The vulnerability concerns server islands encryption (AES-GCM ciphertext replay between props and slots), but server islands functionality does not exist in version 3.6.5. The feature was introduced in later versions (~May 2025, v5.x/6.x), and the vulnerability was fixed in v6.1.10 (April 2026). Exhaustive search across 327 source files con...", "justification": "code_not_present" } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:d51b3964-7e45-5620-aeb1-970e4c65eb43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50146 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:1f90a093-c339-53af-a439-23a80eedaa0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:45378457-0983-505d-b15a-1a8f28276223", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54299 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2026-59728", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:a1c184be-f921-5321-b27c-d8fa35d9026b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59728 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:6819f511-0cbc-5cee-81ab-826d2dc58799", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 3.6.5-tuxcare.7 of astro." } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:4a5e9f3f-de10-52d8-89a7-271b9cdbf22a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-73422 affects version 3.6.5-tuxcare.7 of astro, and is fixed in 3.6.5-tuxcare.8." } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:e75e203c-148e-5284-addd-e7e134d98c8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84376 affects version 3.6.5-tuxcare.7 of astro." } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:d1f5020f-8f25-50fb-bdb2-ce46103da70e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 affects version 3.6.5-tuxcare.7 of astro." } }, { "id": "GHSA-4g3v-8h47-v7g6", "affects": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ], "bom-ref": "urn:uuid:3f133160-c9d4-574d-a422-84103d8fbaae", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 affects version 3.6.5-tuxcare.7 of astro, and is fixed in 3.6.5-tuxcare.8." } } ], "dependencies": [ { "ref": "pkg:npm/astro@3.6.5-tuxcare.7" } ] }