{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b1bcd591-68e0-5916-8915-de7211706974", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "astro", "purl": "pkg:npm/astro@5.18.2-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/astro@5.18.2-tuxcare.2", "version": "5.18.2-tuxcare.2", "pedigree": { "ancestors": [ { "name": "astro", "purl": "pkg:npm/astro@5.18.2", "type": "library", "version": "5.18.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-47885", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:19828a3b-70ad-55c6-89cd-dae33ae6797a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-47885 does not affect version 5.18.2-tuxcare.2 of astro. not_affected \u2014 CVE-2024-47885 is NOT present in the target. The vulnerability involved DOM clobbering via `document.scripts`, which attackers could shadow with HTML elements having `name=\"scripts\"` attributes, leading to XSS during page transitions. The upstream fix (commit a4ffbfaa5cb460c12bd486fd75e36147f51d3e5e by Matthew Phillips, Oct 11 2024) replaced `document.scripts` with `document.getElementsByTagNam...", "justification": "code_not_present" } }, { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:9b7c3706-f071-5fe2-b07c-2a3fd57a9760", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-56140 does not affect version 5.18.2-tuxcare.2 of astro. not_affected \u2014 The target repository (Astro 5.18.2-tuxcare.2) is NOT AFFECTED by CVE-2024-56140. The CSRF bypass vulnerability was fixed by upstream Astro maintainer Emanuele Stoppa in commit e7d14c374b (released in astro@4.16.17, December 2024). This fix was already present in the upstream release astro@5.18.2 that TuxCare onboarded, predating the first TuxCare commit (8d1177b958). The current code at HEAD c...", "justification": "code_not_present" } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:160a92e9-0539-57f6-9412-fce36271e47e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56159 affects version 5.18.2-tuxcare.2 of astro." } }, { "id": "CVE-2025-54793", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:b6b70241-90ad-50bb-9d89-e11a8b735969", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-54793 does not affect version 5.18.2-tuxcare.2 of astro. not_affected \u2014 The target is not affected by CVE-2025-54793 (open redirect via double-slash paths). The fix commit 0567fb7b50c0c452be387dd7c7264b96bedab48f is present in HEAD, adding '//' to INTERNAL_PREFIXES in packages/internal-helpers/src/path.ts (line 78). Both dev server middleware (trailing-slash.ts) and SSR app (app/index.ts) use isInternalPath() to skip trailing slash handling for paths starting with ...", "justification": "code_not_present" } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:35514fba-9dfa-5bd7-9334-1b1252361c47", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55303 does not affect version 5.18.2-tuxcare.2 of astro. not_affected \u2014 CVE-2025-55303 is NOT present in astro@5.18.2-tuxcare.2. The vulnerability (protocol-relative URL bypass of image domain allowlist) was fixed in upstream commit 4d16de7f95 (part of astro@5.13.2, August 2025) and was already present in the astro@5.18.0 release that TuxCare onboarded. The fix enhances the isRemotePath() function in @astrojs/internal-helpers/path to correctly identify protocol-rel...", "justification": "code_not_present" } }, { "id": "CVE-2025-59837", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:1953a275-9306-54e4-b7a2-78ad918396ce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59837 does not affect version 5.18.2-tuxcare.2 of astro. not_affected \u2014 CVE-2025-59837 describes a backslash bypass of CVE-2025-58179's SSRF fix in Astro's image endpoint. The original fix blocked http://, https://, and //, but the CVE claims backslashes (\\\\) can bypass this. However, the target repository at SHA 510268b0e40549abde7e183a62c23a23eabcdfcb already contains upstream commit 1e2499e8ea that added backslash detection to isRemotePath(). This defense treats...", "justification": "code_not_present" } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:6317b293-517a-5a67-806b-cc03e8cc5245", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-61925 does not affect version 5.18.2-tuxcare.2 of astro. not_affected \u2014 CVE-2025-61925 does NOT affect Astro v5.18.2-tuxcare.2. The vulnerability concerns untrusted X-Forwarded-Host header reflection in application-generated URLs. The upstream Astro project fixed this vulnerability in commit dafbb1ba29 (authored by matthew@skypack.dev) by implementing comprehensive X-Forwarded-Host validation against an allowedDomains allowlist. This fix was already present in the ...", "justification": "code_not_present" } }, { "id": "CVE-2025-64525", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:bb67fb46-fc31-53d5-88f5-c861e2dcbc24", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-64525 does not affect version 5.18.2-tuxcare.2 of astro. not_affected \u2014 CVE-2025-64525 is NOT present in target astro@5.18.2-tuxcare.2. The upstream fix (commit dafbb1ba29) that sanitizes X-Forwarded-Proto, X-Forwarded-Host, and X-Forwarded-Port headers was already shipped in the upstream Astro release before any TuxCare work began. The fix blocks all CVE attack vectors: protocol injection (only http/https allowed), path injection in hostnames (/ and \\ rejected), a...", "justification": "code_not_present" } }, { "id": "CVE-2025-64745", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:0259a14a-77a4-5cdd-9610-65c1f92b7c4e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-64745 does not affect version 5.18.2-tuxcare.2 of astro. not_affected \u2014 The target repository does not contain CVE-2025-64745 (Reflected XSS in Astro dev server error pages). The vulnerability pattern is absent because the upstream fix was already present in the release version that TuxCare onboarded. At packages/astro/src/template/4xx.ts:137-141, the 'corrected' variable is properly wrapped with escape() from the html-escaper library, preventing JavaScript injecti...", "justification": "code_not_present" } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:a571ccea-8ea9-55f2-ad3f-3782627a2c00", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-64757 does not affect version 5.18.2-tuxcare.2 of astro. not_affected \u2014 The target (Astro 5.18.2-tuxcare.2) is NOT affected by CVE-2025-64757. The vulnerability (arbitrary local file read via dev server image endpoint) was fixed by upstream Astro before version 5.18.2 was released. The vendor's security patch (commit b8ca69b971, authored by Matt Kane m@mk.gg) introduced `isParentDirectory` path validation and split dev/production endpoints, removing the vulnerable ...", "justification": "code_not_present" } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:59f5649c-4dfa-5b40-af7d-a472381ba3aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-64764 affects version 5.18.2-tuxcare.2 of astro." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:78ca50f1-ed4e-5a12-a46b-b35eb9ebecca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-64765 does not affect version 5.18.2-tuxcare.2 of astro. not_affected \u2014 CVE-2025-64765 describes a path normalization mismatch where middleware received raw URL-encoded paths while routing used decoded paths, enabling bypass of path-based auth checks (e.g., /%61dmin bypassing /admin protection). The target is NOT AFFECTED because upstream Astro fixes (commits 6f800813 and e0f277d9) were already present in the release TuxCare onboarded. The current code uses validat...", "justification": "code_not_present" } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:7d20e554-348e-5cc8-91a3-1597496b17e6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-65019 does not affect version 5.18.2-tuxcare.2 of astro. not_affected \u2014 CVE-2025-65019 is NOT present in the target. The vulnerable code pattern (unconditional allowance of data: URLs in isRemoteAllowed()) was fixed by upstream commit 9e9c528191 authored by Erika (GitHub user), which shipped in the upstream release before TuxCare onboarded this version. The target contains the fixed implementation that requires explicit remotePatterns configuration to allow data: U...", "justification": "code_not_present" } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:9f2a54e3-6c53-567e-a2e2-a13714c3290c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-66202 does not affect version 5.18.2-tuxcare.2 of astro. not_affected \u2014 The target repository (Astro 5.18.2, SHA 510268b0e40549abde7e183a62c23a23eabcdfcb) is NOT vulnerable to CVE-2025-66202 (authentication bypass via double URL encoding). The upstream vendor (Astro/Matthew Phillips) shipped the complete fix in commit e0f277d9248d2fefbd0234b53f9dea8c9b750adb, which was included in the upstream release before TuxCare onboarding. The fix introduces validateAndDecodeP...", "justification": "code_not_present" } }, { "id": "CVE-2026-114127", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:67d6b082-e975-5196-af11-391ccc899a49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114127 affects version 5.18.2-tuxcare.2 of astro, and is fixed in 5.18.2-tuxcare.3." } }, { "id": "CVE-2026-114128", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:f1be7a29-885c-5579-8724-b00f7d87564d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114128 affects version 5.18.2-tuxcare.2 of astro, and is fixed in 5.18.2-tuxcare.4." } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:c0c0f6bb-5d8c-5a60-87ff-18c2111bc529", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33769 does not affect version 5.18.2-tuxcare.2 of astro. not_affected \u2014 The target repository (astro@5.18.2-tuxcare.2) is NOT AFFECTED by CVE-2026-33769. The vulnerability pattern (unanchored path prefix matching via .replace()) is not present in the code. The fix was shipped in upstream Astro 5.18.2, which TuxCare onboarded as-is. The matchPathname() function at packages/internal-helpers/src/remote.ts lines 93-102 contains both fix elements: (1) explicit anchor ch...", "justification": "code_not_present" } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:1a5d6d6f-67cb-5921-8483-4d81ea741fcb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 5.18.2-tuxcare.2 of astro." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:ba48cde6-8c59-5024-8e06-63a90a41fff4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45028 is fixed in version 5.18.2-tuxcare.2 of astro." } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:ae0bf5d2-35b7-5724-a043-c28c4da90243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50146 is fixed in version 5.18.2-tuxcare.2 of astro." } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:54facd51-455c-5e99-b96b-7e89906736ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 5.18.2-tuxcare.2 of astro." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:855f5e7b-ecaa-5540-adb0-81cd44eb9671", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54299 is fixed in version 5.18.2-tuxcare.2 of astro." } }, { "id": "CVE-2026-59727", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:f078426b-2ebf-507f-834c-be1a5ef01781", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59727 is fixed in version 5.18.2-tuxcare.2 of astro." } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:7236b0bf-1cec-50db-9aec-85e1fea69ac0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 5.18.2-tuxcare.2 of astro." } }, { "id": "CVE-2026-59731", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:0954949d-7707-597b-84a3-38d46f5aaa91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59731 affects version 5.18.2-tuxcare.2 of astro, and is fixed in 5.18.2-tuxcare.3." } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:f7203427-e315-5009-98af-fa15055011e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-73422 is fixed in version 5.18.2-tuxcare.2 of astro." } }, { "id": "CVE-2026-73423", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:fc71bb34-7782-55a0-868d-335d1b585c80", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-73423 does not affect version 5.18.2-tuxcare.2 of astro. not_affected \u2014 Astro version 5.18.2 does not contain the vulnerable composable `astro/hono` pipeline feature described in CVE-2026-73423. The CVE affects \"Astro >= 7.0.0 when using the composable astro/hono pipeline\", and this feature was introduced after version 5.18.2 was released. The target version uses a traditional pipeline architecture where the origin check is automatically injected into the middlewar...", "justification": "code_not_present" } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:874cb6ff-c8da-5fe1-a82a-800b2ba8bda8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84376 is fixed in version 5.18.2-tuxcare.2 of astro." } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ], "bom-ref": "urn:uuid:1d4de926-4afb-5a39-92ff-8fd21ba02202", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 is fixed in version 5.18.2-tuxcare.2 of astro." } } ], "dependencies": [ { "ref": "pkg:npm/astro@5.18.2-tuxcare.2" } ] }