{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:925b1107-1aa3-578b-9411-45692c229648", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "devalue", "purl": "pkg:npm/devalue@4.3.1-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/devalue@4.3.1-tuxcare.4", "version": "4.3.1-tuxcare.4", "pedigree": { "ancestors": [ { "name": "devalue", "purl": "pkg:npm/devalue@4.3.1", "type": "library", "version": "4.3.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-57820", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:879ec945-1f34-5dbc-b49a-12148b59c6e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57820 is fixed in version 4.3.1-tuxcare.4 of devalue." } }, { "id": "CVE-2026-123561", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:74943839-f64b-5297-981f-6afeebce4805", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123561 affects version 4.3.1-tuxcare.4 of devalue." } }, { "id": "CVE-2026-123562", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:954b1e62-492c-5630-af0a-3fe12d30f485", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123562 does not affect version 4.3.1-tuxcare.4 of devalue. not_affected \u2014 Target is devalue 4.3.1-tuxcare.4, which has no stringifyAsync and no Promise or async handling. The unhandled-rejection flaw, which exists only in devalue 5.8.0 to 5.9.2, cannot occur here.", "justification": "code_not_present" } }, { "id": "CVE-2026-123563", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:7a90fbe1-255b-582c-94d5-3c0ae1f6bfed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123563 does not affect version 4.3.1-tuxcare.4 of devalue. not_affected \u2014 devalue 4.3.1-tuxcare.4 has no ArrayBuffer/typed-array support in parse/unflatten. The only path touching binary buffers is a user-supplied reviver, which is caller code. The library has no typed-array allocation code, so there is no allocation check to bypass. The library's own length-driven allocation (sparse arrays) is already guarded.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-123564", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:87a597f9-0d52-51ef-9452-b7833b18b9a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123564 affects version 4.3.1-tuxcare.4 of devalue." } }, { "id": "CVE-2026-123565", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:a88aa32f-3413-57ab-94e5-aadbf747b043", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123565 affects version 4.3.1-tuxcare.4 of devalue." } }, { "id": "CVE-2026-123566", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:1a874cdb-4de5-5e02-8604-0c98841b46f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123566 affects version 4.3.1-tuxcare.4 of devalue." } }, { "id": "CVE-2026-123567", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:8e77e790-c7e8-5cda-bf00-1373bb7bf1e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123567 affects version 4.3.1-tuxcare.4 of devalue." } }, { "id": "CVE-2026-123568", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:6bd6e041-4611-553f-986e-c6a562e5ceee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123568 affects version 4.3.1-tuxcare.4 of devalue." } }, { "id": "CVE-2026-123569", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:fc35420f-2592-533a-a24f-7b4d13b0c9ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123569 affects version 4.3.1-tuxcare.4 of devalue." } }, { "id": "CVE-2026-22774", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:ed02de05-2cd1-5363-a3b6-7f3752ef8135", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22774 does not affect version 4.3.1-tuxcare.4 of devalue. Version 4.3.1 is not affected by CVE-2026-22774. The vulnerability concerns typed array deserialization in devalue.parse, where malformed input can cause excessive memory allocation when TypedArray constructors receive non-ArrayBuffer values. However, version 4.3.1 does not have TypedArray or ArrayBuffer deserialization support at all\u2014this feature was added in version 4.3.2+ (commit bbf86c2). When TypedArray-formatted data is sent to v4.3.1, it's rejected with \"Unknown type\" error at src/parse.js:105. The vulnerable code path does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-30226", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:ada5fe92-5905-58c0-ac2d-fe1c0f9e78fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-30226 is fixed in version 4.3.1-tuxcare.4 of devalue." } }, { "id": "CVE-2026-42570", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:ae95535b-8995-522c-90f6-2e3fa5ba2180", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42570 is fixed in version 4.3.1-tuxcare.4 of devalue." } }, { "id": "CVE-2026-81176", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:400a0d54-8bcb-500a-b569-a004ef2b7874", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-81176 is fixed in version 4.3.1-tuxcare.4 of devalue." } }, { "id": "GHSA-33hq-fvwr-56pm", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:9abd0909-61f9-5a0d-bbda-cb08d4bcd6eb", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-33hq-fvwr-56pm is fixed in version 4.3.1-tuxcare.4 of devalue." } }, { "id": "GHSA-4q55-j62x-fr9h", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:fa069323-f86a-57ee-b411-238629927f70", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4q55-j62x-fr9h is fixed in version 4.3.1-tuxcare.4 of devalue." } }, { "id": "GHSA-8qm3-746x-r74r", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:e38d38c0-fffd-503e-adbb-762ea6143eb6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-8qm3-746x-r74r is fixed in version 4.3.1-tuxcare.4 of devalue." } }, { "id": "GHSA-hx4r-w6wj-j8fg", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:34fea3ac-6edc-5988-8d3c-819b1ebe73b2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-hx4r-w6wj-j8fg is fixed in version 4.3.1-tuxcare.4 of devalue." } }, { "id": "GHSA-mcm9-63f2-9j32", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:3ad31ca8-a719-5c9e-8e7f-b62596ea61e5", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mcm9-63f2-9j32 is fixed in version 4.3.1-tuxcare.4 of devalue." } }, { "id": "GHSA-mwv9-gp5h-frr4", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:375e994b-8167-5514-9279-4025cea8d5fa", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mwv9-gp5h-frr4 is fixed in version 4.3.1-tuxcare.4 of devalue." } }, { "id": "GHSA-r9w8-h9r3-54w4", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:d7cc513b-a037-5612-9003-e8409efebe0c", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-r9w8-h9r3-54w4 does not affect version 4.3.1-tuxcare.4 of devalue. not_affected \u2014 Target version 4.3.1-tuxcare.2 does not contain ArrayBuffer handling code required for GHSA-r9w8-h9r3-54w4. ArrayBuffer support was introduced in commit bbf86c2 (Sep 2023), first released in upstream v5.1.0. The target version predates this feature and lacks the vulnerable code path entirely. The parse.js switch statement only handles Date, Set, Map, RegExp, Object, BigInt, and null types - no ...", "justification": "code_not_present" } }, { "id": "GHSA-wf3x-273g-mvxv", "affects": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ], "bom-ref": "urn:uuid:27f4f173-079f-5a78-9cbc-7343cf9b27ad", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-wf3x-273g-mvxv is fixed in version 4.3.1-tuxcare.4 of devalue." } } ], "dependencies": [ { "ref": "pkg:npm/devalue@4.3.1-tuxcare.4" } ] }