{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ac13219f-4362-5bba-8223-f2586b962785",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@hono/node-server",
      "purl": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.3",
      "type": "library",
      "bom-ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.3",
      "version": "1.19.9-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "@hono/node-server",
            "purl": "pkg:npm/%40hono/node-server@1.19.9",
            "type": "library",
            "version": "1.19.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-23340",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d5d31143-7e73-54ab-8933-f1c833322a8c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23340 does not affect version 1.19.9-tuxcare.3 of @hono/node-server. not_affected \u2014 Target @hono/node-server v1.19.9-tuxcare.3 is NOT AFFECTED by CVE-2024-23340. The vulnerability (Request URL property not normalizing \"..\" path segments) was fixed in upstream v1.4.1 (commit dd9b9a9, Jan 2024) by author yusuke@kamawada.com, 136 commits before the first TuxCare backport. The current implementation uses JavaScript's URL constructor which automatically normalizes all path segments...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-32652",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:96bcbcd6-600f-585c-9672-30e52f953417",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-32652 does not affect version 1.19.9-tuxcare.3 of @hono/node-server. not_affected \u2014 CVE-2024-32652 describes a DoS vulnerability where malformed Host headers (empty strings, slashes, invalid characters) cause unhandled TypeError exceptions when passed to the URL constructor, crashing the application. The target version 1.19.9-tuxcare.3 is not affected because the fix was already present in the upstream release. The upstream fix (commit d847e60, April 19, 2024, authored by Taku...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-118663",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:8dd8433c-5cca-5eed-91a5-1ee4b838ebc0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-118663 affects version 1.19.9-tuxcare.3 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-29087",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:6563120c-7fa1-5a20-8a4f-7e57ebb3729b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29087 is fixed in version 1.19.9-tuxcare.3 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-39406",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:37abe965-5234-52fc-8a57-cfdd444ae8ae",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-39406 is fixed in version 1.19.9-tuxcare.3 of @hono/node-server."
      }
    },
    {
      "id": "CVE-2026-73565",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:3ecbbaee-b562-5b69-8a0f-5dae325aa7d8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-73565 does not affect version 1.19.9-tuxcare.3 of @hono/node-server. not_affected \u2014 Version 1.19.9 of @hono/node-server is not affected by CVE-2026-73565. The vulnerability exists in the WebSocket handling code (src/websocket.ts and the upgradeWebSocket function), which was only introduced in version 2.0.0. Version 1.19.9 is on the v1.x maintenance line that never included WebSocket support. Since the vulnerable feature does not exist in this version, the memory leak cannot oc...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-9mqv-5hh9-4cgg",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:229c83ae-5bea-56d4-9668-45603f45d622",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-9mqv-5hh9-4cgg does not affect version 1.19.9-tuxcare.3 of @hono/node-server. not_affected \u2014 The target @hono/node-server version 1.19.9 does not contain the vulnerable WebSocket functionality. The WebSocket feature, including the vulnerable upgradeWebSocket route handler and the internal waiterMap that causes the memory leak, was first introduced in version 2.0.0 (commit 35c1dfc). The target version predates this feature entirely. Since the target cannot receive or process WebSocket u...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-frvp-7c67-39w9",
      "affects": [
        {
          "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:3baf23cc-f82d-5349-b338-2f0f0126e660",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-frvp-7c67-39w9 is fixed in version 1.19.9-tuxcare.3 of @hono/node-server."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40hono/node-server@1.19.9-tuxcare.3"
    }
  ]
}