{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:74a57c74-c44e-5c6c-9c7f-1f786a1a1826", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "devalue", "purl": "pkg:npm/devalue@4.3.0-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/devalue@4.3.0-tuxcare.5", "version": "4.3.0-tuxcare.5", "pedigree": { "ancestors": [ { "name": "devalue", "purl": "pkg:npm/devalue@4.3.0", "type": "library", "version": "4.3.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-57820", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:5c8ba822-3f3d-5cbf-bace-80c6cda75171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57820 is fixed in version 4.3.0-tuxcare.5 of devalue." } }, { "id": "CVE-2026-123561", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:a6436176-80f0-5f0d-a555-c80de46a6b26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123561 affects version 4.3.0-tuxcare.5 of devalue." } }, { "id": "CVE-2026-123562", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:63c6c8ed-58a5-56df-a9ae-e72a5ff734a7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123562 does not affect version 4.3.0-tuxcare.5 of devalue. not_affected \u2014 devalue 4.3.0-tuxcare.5 is the same product as the advisory (devalue) but a much older line. It has no stringifyAsync and no promise or async serialization, so the unhandled-rejection flaw cannot occur. The advisory covers only 5.8.0 up to 5.9.3.", "justification": "code_not_present" } }, { "id": "CVE-2026-123563", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:32eabe51-e783-551e-b5e4-ecac1358e165", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123563 does not affect version 4.3.0-tuxcare.5 of devalue. not_affected \u2014 devalue 4.3.0-tuxcare.5 has no ArrayBuffer or typed-array support in parse, stringify or uneval. The typed-array allocation checks that CVE-2026-123563 says can be bypassed do not exist here. The only revivers are user-supplied callbacks, and the library never allocates buffers on their behalf. This is a LIB target with no code path from the payload to a library-side buffer allocation. Not affe...", "justification": "code_not_present" } }, { "id": "CVE-2026-123564", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ed26871d-ca58-5d1a-9b85-c044c085646d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123564 affects version 4.3.0-tuxcare.5 of devalue." } }, { "id": "CVE-2026-123565", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6ba7634c-97d2-5a91-9827-c21db11fedcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123565 affects version 4.3.0-tuxcare.5 of devalue." } }, { "id": "CVE-2026-123566", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:bd4de7ad-a94e-54a3-ba02-664a35c23eb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123566 affects version 4.3.0-tuxcare.5 of devalue." } }, { "id": "CVE-2026-123567", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ee3f652b-a867-53ab-96e0-f5256dd459e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123567 affects version 4.3.0-tuxcare.5 of devalue." } }, { "id": "CVE-2026-123568", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:79ba467e-b139-556e-9dd9-123e195ccd7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123568 affects version 4.3.0-tuxcare.5 of devalue." } }, { "id": "CVE-2026-123569", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:2feb8c9e-ec81-5a20-9f81-d36a7b261819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123569 affects version 4.3.0-tuxcare.5 of devalue." } }, { "id": "CVE-2026-22774", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:2c7a8a01-c9f5-575e-8112-05d2f7c59b20", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22774 does not affect version 4.3.0-tuxcare.5 of devalue. Target version 4.3.0 is not affected by CVE-2026-22774. The vulnerability exists in TypedArray hydration code that validates ArrayBuffer inputs, but TypedArray support was not introduced until version 5.1.0. Version 4.3.0 predates this feature entirely. When typed array serialized data is provided to this version, the parser throws \"Unknown type Int8Array\" error rather than attempting hydration, preventing the DoS condition described in the CVE.", "justification": "code_not_present" } }, { "id": "CVE-2026-30226", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c12cc68f-31a9-5881-8ab8-d1dd57e69514", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-30226 is fixed in version 4.3.0-tuxcare.5 of devalue." } }, { "id": "CVE-2026-42570", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:7a1dc18d-314e-5614-8914-eb48cd885d48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42570 is fixed in version 4.3.0-tuxcare.5 of devalue." } }, { "id": "CVE-2026-81176", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:0c5cc731-2a3e-529a-9d2d-e99b2465bb4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-81176 is fixed in version 4.3.0-tuxcare.5 of devalue." } }, { "id": "GHSA-33hq-fvwr-56pm", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:1d83cf05-faad-5df0-bcdf-613b7e556d32", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-33hq-fvwr-56pm is fixed in version 4.3.0-tuxcare.5 of devalue." } }, { "id": "GHSA-4q55-j62x-fr9h", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:0b20295a-c69b-5f4f-ad76-23b647e9a68e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4q55-j62x-fr9h is fixed in version 4.3.0-tuxcare.5 of devalue." } }, { "id": "GHSA-8qm3-746x-r74r", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:f19d60b3-d380-5ec3-9e40-773c0166204c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-8qm3-746x-r74r is fixed in version 4.3.0-tuxcare.5 of devalue." } }, { "id": "GHSA-hx4r-w6wj-j8fg", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:7d050e76-936a-5679-8801-cb9dcfb6445b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-hx4r-w6wj-j8fg is fixed in version 4.3.0-tuxcare.5 of devalue." } }, { "id": "GHSA-mcm9-63f2-9j32", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:84a63c94-a4a2-508d-b2a4-3736cf5b6856", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mcm9-63f2-9j32 is fixed in version 4.3.0-tuxcare.5 of devalue." } }, { "id": "GHSA-mwv9-gp5h-frr4", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:32f52683-c2b9-5321-abc9-8ec91e4f0b51", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mwv9-gp5h-frr4 is fixed in version 4.3.0-tuxcare.5 of devalue." } }, { "id": "GHSA-r9w8-h9r3-54w4", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:eef391f4-549f-5ba3-acf1-968ff2ad508e", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-r9w8-h9r3-54w4 does not affect version 4.3.0-tuxcare.5 of devalue. not_affected \u2014 Version 4.3.0 is not affected by GHSA-r9w8-h9r3-54w4. The vulnerability requires built-in ArrayBuffer handling code that does not exist in this version. Built-in ArrayBuffer support was only added in v4.3.3+ (commit bbf86c2df54). While users can provide custom ArrayBuffer revivers, those are application-level code outside the library's scope. The library itself never creates ArrayBuffer objects...", "justification": "code_not_present" } }, { "id": "GHSA-wf3x-273g-mvxv", "affects": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:efd422a4-9760-5ffb-bc92-0dd3d60dc7a4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-wf3x-273g-mvxv is fixed in version 4.3.0-tuxcare.5 of devalue." } } ], "dependencies": [ { "ref": "pkg:npm/devalue@4.3.0-tuxcare.5" } ] }