{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:85026a33-b07a-502f-bc85-977f3187226f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "baseline-browser-mapping",
      "purl": "pkg:npm/baseline-browser-mapping@2.11.23",
      "type": "library",
      "bom-ref": "pkg:npm/baseline-browser-mapping@2.11.23",
      "version": "2.11.23",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-45819",
      "affects": [
        {
          "ref": "pkg:npm/baseline-browser-mapping@2.11.23"
        }
      ],
      "bom-ref": "urn:uuid:c6105b04-cc9b-5cd2-b6f1-a1dc0840eb45",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-45819 does not affect version 2.11.23 of baseline-browser-mapping. not_affected \u2014 Target version 2.11.23 is not affected by CVE-2026-45819. The vulnerability involved calling process.exit() on invalid configuration parameters, causing immediate process termination (DoS). The upstream fix (commit de733e2d by Tony Conway) replaced all process.exit() calls with throw new Error() in getCompatibleVersions() and getAllVersions(), shipping in version 2.11.0. Since the target is v2....",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/baseline-browser-mapping@2.11.23"
    }
  ]
}