{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3a8096cd-bea4-56b4-92da-4ebfd7ef8423",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@hono/node-server",
      "purl": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1",
      "version": "1.19.11-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "@hono/node-server",
            "purl": "pkg:npm/%40hono/node-server@1.19.11",
            "type": "library",
            "version": "1.19.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-23340",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d6a0d1a0-8722-50cc-b767-f32a6d1fc86c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23340 does not affect version 1.19.11-tuxcare.1 of @hono/node-server. not_affected \u2014 CVE-2024-23340 describes a path traversal vulnerability in @hono/node-server where the custom Request object failed to resolve \"..\" (double dots) in URLs, allowing directory traversal via serveStatic. The vulnerability was fixed in upstream commit dd9b9a9 (Jan 21, 2024) by project author Yusuke Wada, which was included in v1.4.1. The target version 1.19.11-tuxcare.1 contains this fix - the curr...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-32652",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f2878074-75b7-5224-a282-9e43b0e09249",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-32652 does not affect version 1.19.11-tuxcare.1 of @hono/node-server. not_affected \u2014 CVE-2024-32652 describes a denial-of-service vulnerability in @hono/node-server caused by malformed Host headers that crash the application with an uncaught TypeError. The target repository (@hono/node-server v1.19.11-tuxcare.1) is NOT AFFECTED because the upstream fix was already present in the release version before TuxCare maintenance began. Two upstream commits (d847e60 and 306d98f, both by...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-118663",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0ec0fcc9-b7e7-58ee-b98c-d4d804a98e1d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-118663 affects version 1.19.11-tuxcare.1 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-29087",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ae18319d-3809-5d85-9d85-0782e0eadb61",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-29087 affects version 1.19.11-tuxcare.1 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-39406",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:54169727-ed1c-5f5c-ab04-cf1835479d7b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-39406 is fixed in version 1.19.11-tuxcare.1 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-73565",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6a4bf538-5f3f-54cc-aa31-9dd6870abd1e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-73565 does not affect version 1.19.11-tuxcare.1 of @hono/node-server. not_affected \u2014 The target version 1.19.11 does not contain the WebSocket functionality that is affected by CVE-2026-73565. The WebSocket feature (including the vulnerable waiter-map cleanup logic) was introduced upstream in version 2.0.0 via commit 35c1dfc. The target predates this feature entirely. The file src/websocket.ts does not exist, no WebSocket dependencies are present, and no code processes WebSocke...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-9mqv-5hh9-4cgg",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:94ce3c4a-97b6-5115-8059-3b0b1eba6851",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-9mqv-5hh9-4cgg does not affect version 1.19.11-tuxcare.1 of @hono/node-server. not_affected \u2014 Target version 1.19.11 is not affected by GHSA-9mqv-5hh9-4cgg. The vulnerability exists in the WebSocket upgrade handling code (src/websocket.ts), but this file and all WebSocket functionality were first introduced in version 2.0.0-rc.2 (commit 35c1dfc). Version 1.19.11 predates WebSocket support entirely and contains no code to receive or process WebSocket upgrade requests. Rule 5 Type A1 sati...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-frvp-7c67-39w9",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c46c0526-ef99-5f96-96bf-eb656bdbee24",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-frvp-7c67-39w9 is fixed in version 1.19.11-tuxcare.1 of @hono/node-server."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40hono/node-server@1.19.11-tuxcare.1"
    }
  ]
}