{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c75b4d2c-aa21-5ce0-8e01-c728bac4de8a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "astro", "purl": "pkg:npm/astro@0.26.1-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/astro@0.26.1-tuxcare.4", "version": "0.26.1-tuxcare.4", "pedigree": { "ancestors": [ { "name": "astro", "purl": "pkg:npm/astro@0.26.1", "type": "library", "version": "0.26.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-47885", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:049a3867-1260-5b04-bf4e-d0f184270925", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-47885 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 Astro v0.26.1 is not affected by CVE-2024-47885. The ViewTransitions feature and the vulnerable client-side router code (packages/astro/src/transitions/router.ts) do not exist in this version. The vulnerability requires the ViewTransitions component's router.ts module, which uses the DOM-clobberable document.scripts property. This feature was introduced in Astro 2.9+ (August 2023), over 16 mont...", "justification": "code_not_present" } }, { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:62c3d342-fadc-5a41-86ab-f340ec824788", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 0.26.1-tuxcare.4 of astro." } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:fc22bd42-b598-514c-a4a3-dea7ab777bb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 0.26.1-tuxcare.4 of astro." } }, { "id": "CVE-2025-54793", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:2357fcaf-f402-595c-b206-87e4f4ec79da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-54793 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 Target version 0.26.1 is NOT affected by CVE-2025-54793. The vulnerability requires automatic trailing slash redirection logic that generates Location headers with protocol-relative URLs (starting with //). This feature was introduced in Astro 5.2.0 (released 2025-01-30) via commit 536175528d, almost 3 years AFTER version 0.26.1 was released (2022-04-04). Version 0.26.1 has no automatic trailin...", "justification": "code_not_reachable" } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:623a6d21-6ade-5987-b1b0-7dbf38bd96b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55303 is fixed in version 0.26.1-tuxcare.4 of astro." } }, { "id": "CVE-2025-59837", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:df9fa7d9-955b-54f8-bcb4-c851c8b11ba2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59837 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 Astro version 0.26.1 is not affected by CVE-2025-59837. This CVE describes a backslash bypass in the `_image` endpoint's URL validation (bypassing the CVE-2025-58179 fix). However, the `_image` endpoint was introduced in Astro 3.x, years after version 0.26.1 (released early 2022). The vulnerable code path, including the endpoint itself, isRemotePath function, imageConfig, and the entire package...", "justification": "code_not_present" } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:50c375d1-245e-50ea-8823-fd0670139b84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 0.26.1-tuxcare.4 of astro." } }, { "id": "CVE-2025-64525", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:37d1864b-48cf-56fb-8538-16d64abcf8af", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-64525 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 Version 0.26.1 is not affected by CVE-2025-64525. The vulnerable code path described in the CVE\u2014insecure processing of x-forwarded-proto, x-forwarded-host, and x-forwarded-port headers\u2014does not exist in this version. The URL construction in version 0.26.1 (packages/astro/src/core/app/node.ts:9) uses only req.headers.host directly without processing any x-forwarded-* headers. This feature was in...", "justification": "code_not_present" } }, { "id": "CVE-2025-64745", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:ef01701e-2370-5ea9-87c5-5f17b1e95b80", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-64745 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 Target version 0.26.1-tuxcare.4 predates the vulnerable feature entirely. The `trailingSlashMismatchTemplate` function that contains the XSS vulnerability was introduced in commit 536175528d (PR #12994) and does not exist in this version. The 4xx.ts error template file is only 87 lines long (patch operates at line 134+). Existing error templates in this version properly escape user-controlled p...", "justification": "code_not_present" } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:4914e5a3-46a8-56a4-bfc2-669c88120c68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 0.26.1-tuxcare.4 of astro." } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:0a1cbc08-8b30-5874-9ccf-a1e5df8ff9ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 0.26.1-tuxcare.4 of astro." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:534b7674-7d19-5877-a7c3-2bfaa375c1ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 0.26.1-tuxcare.4 of astro." } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:9ce5e7b9-8bec-5416-9236-7127e53eab3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 0.26.1-tuxcare.4 of astro." } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:99ba4b57-500b-5b4b-8fb3-2dd52501602c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 0.26.1-tuxcare.4 of astro." } }, { "id": "CVE-2026-114127", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:639d0b9a-79f9-5707-931d-0e86a1cdb5cd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114127 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 Target version 0.26.1 is not affected by CVE-2026-114127. The vulnerability exists in Astro's View Transitions feature, which serializes animation property values into CSS without escaping delimiters (;, {, }). However, View Transitions were not introduced until version 2.9.0 (July 2023), over a year after version 0.26.1 was released (April 2022). The vulnerable code path (packages/astro/src/ru...", "justification": "code_not_present" } }, { "id": "CVE-2026-114128", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:baf5feda-5404-5459-bbb2-980ee759639d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114128 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 Version 0.26.1-tuxcare.3 is not affected by CVE-2026-114128. The vulnerability exists in Astro's built-in JSX renderer (packages/astro/src/runtime/server/jsx.ts), which was introduced in version 1.0.0-beta.56 (June 2022), well after version 0.26.1. The vulnerable code path that treats dynamic script/style children as raw HTML does not exist in this version. Additionally, MDX support\u2014another att...", "justification": "code_not_present" } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:991ee241-a35a-5a96-b6e6-d0c237d4fa07", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33769 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 Astro 0.26.1 is not affected by CVE-2026-33769. The vulnerable code (packages/internal-helpers/src/remote.ts matchPathname function) and the entire image optimization endpoint feature (/_image with remotePatterns) do not exist in this version. The built-in image optimization endpoint was introduced in Astro 3.x, years after version 0.26.1 (early 2022, pre-1.0 beta). Comprehensive searches found...", "justification": "code_not_present" } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:7a9c40c7-d875-5e18-b296-835e86ae1e2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 0.26.1-tuxcare.4 of astro." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:ae84fa75-82b6-55db-b7a9-9c58c6334f28", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45028 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 Astro version 0.26.1 does not contain the server islands feature at all. Server islands were introduced to Astro in July 2024 (commit d495df5361), while version 0.26.1 is from 2022. CVE-2026-45028 requires server islands with AES-GCM encryption for props/slots parameters to exist, but this version predates that entire feature. The vulnerable code path (encryption.ts, server-islands/endpoint.ts,...", "justification": "code_not_present" } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:b4700427-5d66-59fd-8c82-df005f40e130", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50146 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 Version 0.26.1 uses a fundamentally different slot hydration architecture that predates the vulnerable pattern. The target creates a single template element with a marker attribute `data-astro-template` (no value), while the modern version interpolates slot names into the attribute value. The dangerous operation (slot name interpolation into HTML attributes) does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:f7d223cf-fd76-5e00-9ae8-cccf515cbf37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 0.26.1-tuxcare.4 of astro." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:2be2f001-a4b7-5b2d-9884-cedcee0429e2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54299 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 Target version 0.26.1 does not have the prerendered error page feature that is vulnerable in modern Astro. The RouteData interface lacks the 'prerender' field, and the error handling infrastructure that fetches error pages over HTTP (default-handler.ts) does not exist. When errors occur, this version returns simple inline Response objects without making any HTTP requests.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-59727", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:afcb9e09-248f-5c36-90d3-6952ad1f68a9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59727 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 The target version (0.26.1-tuxcare.4) does not contain the vulnerable feature. CVE-2026-59727 affects the transition directives feature (transition:persist, transition:scope, transition:persist-props) on astro-island elements, which was introduced in Astro 3.10.0. Version 0.26.1 uses a completely different hydration architecture with <script type=\"module\"> tags rather than <astro-islan...", "justification": "code_not_present" } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:9d06cd9e-3691-5550-8d08-cc23f7a9c714", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 0.26.1-tuxcare.4 of astro." } }, { "id": "CVE-2026-59731", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:f3129262-691e-5a0b-898a-7ffb9c87f4eb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59731 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 Astro 0.26.1 is not affected by CVE-2026-59731. The vulnerability requires iterative URL decoding with a 10-iteration limit (introduced in PR #16967, June 2026) and middleware functionality (introduced March 2024). Version 0.26.1 (April 2022) predates both features by 2-4 years. The target uses a single decodeURI() call with no middleware, eliminating the canonicalization mismatch between autho...", "justification": "code_not_present" } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:c08f092c-c999-536a-b656-ed8097f04514", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-73422 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 Astro version 0.26.1 is not affected by CVE-2026-73422. The View Transitions feature, which is the attack surface for this vulnerability, does not exist in this version. View Transitions were introduced in Astro versions from 2023 onward (v2.x+), while this target is from April 2022. The vulnerable code path (packages/astro/src/runtime/server/transition.ts) and all related APIs (transition:anim...", "justification": "code_not_present" } }, { "id": "CVE-2026-73423", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:b2428de4-0fda-5d59-ac32-795a37e2d694", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-73423 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 CVE-2026-73423 affects Astro >= 7.0.0 with the composable astro/hono pipeline. Target version 0.26.1 predates this architecture by years. The vulnerable components (ActionHandler, PagesHandler, actions()/pages()/middleware() primitives, and security.checkOrigin configuration) do not exist in this codebase. The vulnerability pattern - bypassing checkOrigin protection via incorrect primitive orde...", "justification": "code_not_present" } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:e584ad24-7e56-5bc8-ab85-26d51bc708e1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-84376 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 Version 0.26.1 is not affected by CVE-2026-84376. The vulnerability requires middleware support to manifest (applications that protect routes in middleware using context.url.pathname), but middleware was not introduced until Astro 2.x (mid-2023). Version 0.26.1 (early 2022) predates this feature entirely. Additionally, the SSR runtime in 0.26.1 does not perform base path stripping - the App cla...", "justification": "code_not_present" } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:b4f4ae78-7376-5989-b181-cf829aa6c474", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 Astro 0.26.1 is NOT affected by GHSA-26w7-cxv4-gfx2. The vulnerability concerns libheif used by Sharp in Astro's image optimization service, but version 0.26.1 does not have any image optimization features. The @astrojs/image integration (which provides Sharp-based image processing) was introduced AFTER version 0.26.1. Git history analysis confirms the image integration commit (e8593e7ead) is n...", "justification": "code_not_present" } }, { "id": "GHSA-4g3v-8h47-v7g6", "affects": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ], "bom-ref": "urn:uuid:f252f5b0-dff2-571a-899e-29a18bf46fa8", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 does not affect version 0.26.1-tuxcare.4 of astro. not_affected \u2014 The target repository (Astro v0.26.1-tuxcare.1) is not affected by GHSA-4g3v-8h47-v7g6. The View Transitions feature, which is the source of the vulnerability, does not exist in this version. View Transitions were introduced much later in Astro v2.9+ (commit 6a12fcecb0, circa June 2023), while this target is from the early beta period (2021). The vulnerable code path (packages/astro/src/runtime...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:npm/astro@0.26.1-tuxcare.4" } ] }