{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d5daf2d3-32e0-54d0-9344-ae22bbd5896e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "astro", "purl": "pkg:npm/astro@2.10.15-tuxcare.12", "type": "library", "bom-ref": "pkg:npm/astro@2.10.15-tuxcare.12", "version": "2.10.15-tuxcare.12", "pedigree": { "ancestors": [ { "name": "astro", "purl": "pkg:npm/astro@2.10.15", "type": "library", "version": "2.10.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-47885", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:2797b69e-1ffa-5329-a44a-ab1dd9fa4fd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47885 affects version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:b9fa96a0-976d-5ffb-91e9-a78f6d6212b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:b74b4daf-c083-5db7-988a-d95f5c910f9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2025-54793", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:737b2b2c-6f1c-5833-86e0-c6fe239a7407", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-54793 does not affect version 2.10.15-tuxcare.12 of astro. not_affected \u2014 Astro version 2.10.15 does not contain the vulnerable automatic SSR trailing slash redirection feature described in CVE-2025-54793. The CVE affects versions >=5.2.0, while this target is version 2.10.15\u2014substantially older. The vulnerable code pattern (INTERNAL_PREFIXES constant and isInternalPath function that the patch modifies) does not exist in this version. The automatic trailing slash red...", "justification": "code_not_present" } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:905a98d0-4505-5a25-b4b4-49756b2d2f46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55303 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2025-59837", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:d2d53916-599f-5ed9-bc5e-3a88fae3eaf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59837 affects version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:41597ba5-73fc-5128-bea9-9b62df25f4b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2025-64525", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:398f22bf-dde4-52bb-b45e-ca408cde5590", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-64525 affects version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2025-64745", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:85703630-3dde-50d9-af1e-263e9b4f8fe1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-64745 does not affect version 2.10.15-tuxcare.12 of astro. not_affected \u2014 Version 2.10.15 is not affected by CVE-2025-64745. The vulnerable function `trailingSlashMismatchTemplate` that renders unescaped pathname-derived values into HTML does not exist in this version. It was introduced in a later version (commit 536175528d, around v5.x). All error templates in 2.10.15 properly escape pathnames using `escape(pathname)` before HTML insertion, preventing the HTML injec...", "justification": "code_not_present" } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:1c4c4ba7-909f-509c-ac85-a03809fc19bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:a9c4627f-886f-502f-959f-d42bd0281212", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:4c92d33d-6137-5315-8c9c-516b475a557b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:ffd9602a-ee0f-5c56-bac3-ba08b6f3f55e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:a2db6a74-fafe-520a-8e7c-6ec64a5d9209", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2026-114127", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:b8d16082-05a2-5b48-9df8-bacabc5e099b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114127 affects version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2026-114128", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:5531a195-3102-52dc-962a-574d6c902e99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-114128 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:e760d316-1e50-5033-9c44-e30f3944023e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33769 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:448fbc56-6592-5a35-a835-2e50f5f4b261", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:83147b15-7792-571c-b4fb-89da6242c9a3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45028 does not affect version 2.10.15-tuxcare.12 of astro. not_affected \u2014 Astro version 2.10.14 is not affected by CVE-2026-45028. The server islands feature with encrypted parameter handling does not exist in this version. The vulnerability requires server islands (introduced in later versions) to be present, specifically the encryption/decryption of props and slots parameters via AES-GCM. Version 2.10.14 predates this feature entirely. While the repository contains...", "justification": "code_not_present" } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:c749b142-9d86-5b52-a48f-fed97d329566", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50146 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:cc956feb-f343-53ed-a2c9-7cf0c5c25261", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:783e7a39-f2fe-5fc8-8cb4-a994fac42702", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54299 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2026-59727", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:2805657e-c6e8-5835-a7a7-c4a6a3a2fee7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59727 affects version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:82a55835-e049-5b34-9ebe-19c264ff64d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2026-59731", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:5f43d340-862b-52d8-a62b-d28db618d743", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59731 affects version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:aadd266b-f3b2-51d7-b7d4-066cec17a1d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-73422 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "CVE-2026-73423", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:1b8ae2e6-73f0-5934-9c5a-a024a1c88b59", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-73423 does not affect version 2.10.15-tuxcare.12 of astro. not_affected \u2014 Version 2.10.15 is not affected by CVE-2026-73423. The vulnerability is specific to the composable `astro/hono` pipeline feature introduced in Astro 7.0.0, which allows users to manually assemble primitives (`middleware()`, `actions()`, `pages()`) in custom order. When these primitives are mounted out-of-order, the `security.checkOrigin` protection can be bypassed. Version 2.10.15 does not have...", "justification": "code_not_present" } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:8365d5f0-a35d-577f-833a-501699c27491", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84376 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:116e4f58-5f64-5ecd-9b97-591bf1140761", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 is fixed in version 2.10.15-tuxcare.12 of astro." } }, { "id": "GHSA-4g3v-8h47-v7g6", "affects": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ], "bom-ref": "urn:uuid:7c6cd322-14e2-5dbd-b7b7-cedfb41cf4e0", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 is fixed in version 2.10.15-tuxcare.12 of astro." } } ], "dependencies": [ { "ref": "pkg:npm/astro@2.10.15-tuxcare.12" } ] }