{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:039d40c6-04d9-5a98-81c9-33aa37a80d79", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "devalue", "purl": "pkg:npm/devalue@4.3.2-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/devalue@4.3.2-tuxcare.5", "version": "4.3.2-tuxcare.5", "pedigree": { "ancestors": [ { "name": "devalue", "purl": "pkg:npm/devalue@4.3.2", "type": "library", "version": "4.3.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-57820", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:581431e6-3702-51d6-b3d1-74f6f03b56c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57820 is fixed in version 4.3.2-tuxcare.5 of devalue." } }, { "id": "CVE-2026-123561", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:516fda07-ddaf-53f2-b69d-39e0c98e4563", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123561 affects version 4.3.2-tuxcare.5 of devalue." } }, { "id": "CVE-2026-123562", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:cd8880d4-2e8d-5138-ad0f-dde3cea55f2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123562 does not affect version 4.3.2-tuxcare.5 of devalue. not_affected \u2014 devalue 4.3.2 (tuxcare.5) has no asynchronous serialization at all. It exports only uneval, parse, unflatten and stringify, all synchronous. stringifyAsync and Promise handling were added in the 5.8.x line. The unhandled-rejection flaw cannot occur here.", "justification": "code_not_present" } }, { "id": "CVE-2026-123563", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:5f72e544-8ab8-5bb6-82b6-aaf31a4cb80e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123563 does not affect version 4.3.2-tuxcare.5 of devalue. not_affected \u2014 Not affected. This is devalue 4.3.2-tuxcare.5, which has no built-in ArrayBuffer or typed-array support in parse/unflatten. The code that CVE-2026-123563 concerns (the typed-array allocation checks and ArrayBuffer revival added in the 5.x line) is absent. Any buffer allocation would happen in user-supplied revivers, which is application code and not a library flaw.", "justification": "code_not_present" } }, { "id": "CVE-2026-123564", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:7598d51f-3579-53ff-9867-e311cdf90290", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123564 affects version 4.3.2-tuxcare.5 of devalue." } }, { "id": "CVE-2026-123565", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:499977cc-ee69-508f-8a1b-ab3419743463", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123565 affects version 4.3.2-tuxcare.5 of devalue." } }, { "id": "CVE-2026-123566", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:c990cb26-0116-5375-a94c-adb81a322289", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123566 affects version 4.3.2-tuxcare.5 of devalue." } }, { "id": "CVE-2026-123567", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:0cc0fe06-5d68-5285-9fd6-fafd51926677", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123567 affects version 4.3.2-tuxcare.5 of devalue." } }, { "id": "CVE-2026-123568", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:9526591d-1ec6-5908-bf13-934799720a48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123568 affects version 4.3.2-tuxcare.5 of devalue." } }, { "id": "CVE-2026-123569", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:eba47d15-57f1-53eb-a6db-b6c54a18b5a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123569 affects version 4.3.2-tuxcare.5 of devalue." } }, { "id": "CVE-2026-22774", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:fae1df2d-14a3-5db5-95e9-1752918e66bb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22774 does not affect version 4.3.2-tuxcare.5 of devalue. Version 4.3.2 is not affected by CVE-2026-22774 because it lacks typed array parsing functionality entirely. The vulnerability exists in typed array hydration code that was introduced in version 5.1.0, well after this version. When typed array data is provided to v4.3.2, it throws \"Unknown type\" error before any DoS can occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-30226", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:4d52f5a6-eb22-5924-9d1d-074fbcc3871f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-30226 is fixed in version 4.3.2-tuxcare.5 of devalue." } }, { "id": "CVE-2026-42570", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:3f6b1606-4fc4-55d8-9314-aba599e3cf59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42570 is fixed in version 4.3.2-tuxcare.5 of devalue." } }, { "id": "CVE-2026-81176", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:5ae16208-bde8-58bb-b4ed-aedcb7cf8c3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-81176 is fixed in version 4.3.2-tuxcare.5 of devalue." } }, { "id": "GHSA-33hq-fvwr-56pm", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:73f7f6d2-3fbf-5d7a-954f-7f9056dc90bc", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-33hq-fvwr-56pm is fixed in version 4.3.2-tuxcare.5 of devalue." } }, { "id": "GHSA-4q55-j62x-fr9h", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:bfb0971a-4bb5-5c15-b06d-280afe3373fb", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4q55-j62x-fr9h is fixed in version 4.3.2-tuxcare.5 of devalue." } }, { "id": "GHSA-8qm3-746x-r74r", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:b819f8c4-9724-5089-a1d6-0ded7d7033d3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-8qm3-746x-r74r is fixed in version 4.3.2-tuxcare.5 of devalue." } }, { "id": "GHSA-8qm3-746x-r74r-map-keys", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:fa79ae63-3300-5903-b65a-2f2687f74e07", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-8qm3-746x-r74r-map-keys is fixed in version 4.3.2-tuxcare.5 of devalue." } }, { "id": "GHSA-hx4r-w6wj-j8fg", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:31987557-49cb-5f19-91e3-150dcd2f885b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-hx4r-w6wj-j8fg is fixed in version 4.3.2-tuxcare.5 of devalue." } }, { "id": "GHSA-mcm9-63f2-9j32", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:b44cc3ad-2d28-5a02-883a-6a25edb5bb49", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mcm9-63f2-9j32 is fixed in version 4.3.2-tuxcare.5 of devalue." } }, { "id": "GHSA-mwv9-gp5h-frr4", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:548e5036-92b3-5d02-83d8-9a1a1a712e6c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mwv9-gp5h-frr4 is fixed in version 4.3.2-tuxcare.5 of devalue." } }, { "id": "GHSA-r9w8-h9r3-54w4", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:176a7297-83de-56c4-88d5-e1296e50614c", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-r9w8-h9r3-54w4 does not affect version 4.3.2-tuxcare.5 of devalue. not_affected \u2014 Version 4.3.2 is NOT affected by GHSA-r9w8-h9r3-54w4. The vulnerability requires built-in ArrayBuffer deserialization code, which does not exist in this version. ArrayBuffer support was introduced in v5.1.0 (commit bbf86c2, September 2023), significantly later than v4.3.2. Exhaustive code search and git history analysis confirm complete absence of ArrayBuffer, TypedArray, DataView, and base64 e...", "justification": "code_not_present" } }, { "id": "GHSA-wf3x-273g-mvxv", "affects": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ], "bom-ref": "urn:uuid:f8f02d01-d048-5fae-ad78-a9551348a330", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-wf3x-273g-mvxv is fixed in version 4.3.2-tuxcare.5 of devalue." } } ], "dependencies": [ { "ref": "pkg:npm/devalue@4.3.2-tuxcare.5" } ] }