{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:150edf71-b27b-5588-9e1e-21b6221d91b4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "devalue", "purl": "pkg:npm/devalue@5.8.1-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/devalue@5.8.1-tuxcare.1", "version": "5.8.1-tuxcare.1", "pedigree": { "ancestors": [ { "name": "devalue", "purl": "pkg:npm/devalue@5.8.1", "type": "library", "version": "5.8.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-123561", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:694ecacd-c6e5-5e01-9c3a-524169f3b9aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123561 affects version 5.8.1-tuxcare.1 of devalue." } }, { "id": "CVE-2026-123562", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:55e0e8c8-5365-5473-adae-7e0513d8dbd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123562 affects version 5.8.1-tuxcare.1 of devalue." } }, { "id": "CVE-2026-123563", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:cc4cea2a-e11e-5e0a-826a-811aabbb8461", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123563 affects version 5.8.1-tuxcare.1 of devalue." } }, { "id": "CVE-2026-123564", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:0e970297-a90c-595d-ac80-c2c04f5d2939", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123564 affects version 5.8.1-tuxcare.1 of devalue." } }, { "id": "CVE-2026-123565", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:5cfc7845-2383-50fe-b509-49bcf5b52f4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123565 affects version 5.8.1-tuxcare.1 of devalue." } }, { "id": "CVE-2026-123566", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:e4ba72a4-2bba-5e07-bf3d-7d486bdf3e57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123566 affects version 5.8.1-tuxcare.1 of devalue." } }, { "id": "CVE-2026-123567", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:54819f19-aa3a-594b-a84c-c7092029106b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123567 does not affect version 5.8.1-tuxcare.1 of devalue. not_affected \u2014 Target is devalue 5.8.1-tuxcare.2, which is newer than the 5.6.4 fix. The upstream fix (commit 87c1f3c) is already in the shipped upstream release. Every parse/unflatten path that builds an object from payload keys rejects `__proto__`, and the 'Object' wrapper path only accepts primitives. No path produces an own `__proto__` property.", "justification": "code_not_present" } }, { "id": "CVE-2026-123568", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:9d02356b-bc9d-5739-abdd-178067b39891", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123568 does not affect version 5.8.1-tuxcare.1 of devalue. not_affected \u2014 devalue 5.8.1-tuxcare.2 is past the 5.6.3 fix for CVE-2026-123568. The upstream fix for __proto__ handling (0f04d4d) is an ancestor of HEAD and was already in the upstream release TuxCare onboarded. uneval's walk step throws on any own '__proto__' key, so the prototype-pollution input never reaches code generation.", "justification": "code_not_present" } }, { "id": "CVE-2026-123569", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:b47bba94-a067-554a-a8a1-5dc0edf876c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123569 does not affect version 5.8.1-tuxcare.1 of devalue. not_affected \u2014 devalue 5.8.1-tuxcare.2 is not affected. The CVE fix (upstream devalue 5.6.3, commit 819f1ac, \"better encoding for sparse arrays\") is already in the upstream release TuxCare onboarded. stringify and uneval both use a sparse-aware encoding that avoids per-hole iteration. TuxCare backport 78a1669 (GHSA-wf3x-273g-mvxv) additionally hardens uneval.", "justification": "code_not_present" } }, { "id": "CVE-2026-81176", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:dfa0fcbc-fd2d-5113-9624-b0584bb29fc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-81176 is fixed in version 5.8.1-tuxcare.1 of devalue." } }, { "id": "CVE-2026-92708", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:33b0e300-1505-555e-a66a-701328790243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-92708 is fixed in version 5.8.1-tuxcare.1 of devalue." } }, { "id": "GHSA-4q55-j62x-fr9h", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:443e71d8-c236-597d-bd6c-9d56b4a14eb5", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4q55-j62x-fr9h is fixed in version 5.8.1-tuxcare.1 of devalue." } }, { "id": "GHSA-hx4r-w6wj-j8fg", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:2c21a6f7-3f4b-5007-b860-4de7c4981307", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-hx4r-w6wj-j8fg affects version 5.8.1-tuxcare.1 of devalue, and is fixed in 5.8.1-tuxcare.2." } }, { "id": "GHSA-mcm9-63f2-9j32", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:5ec68d8c-06cd-54c8-b5f6-30a7ebe0f81d", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mcm9-63f2-9j32 affects version 5.8.1-tuxcare.1 of devalue, and is fixed in 5.8.1-tuxcare.2." } }, { "id": "GHSA-r9w8-h9r3-54w4", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:81f0de2a-e510-5d8f-9f23-2d0fd4421ec7", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-r9w8-h9r3-54w4 is fixed in version 5.8.1-tuxcare.1 of devalue." } }, { "id": "GHSA-wf3x-273g-mvxv", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:d055acd3-49ab-5f38-919f-9acb95905d7d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-wf3x-273g-mvxv is fixed in version 5.8.1-tuxcare.1 of devalue." } }, { "id": "GHSA-x5rw-q4pp-hg5g", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ], "bom-ref": "urn:uuid:3588b7f8-5a68-5263-8548-b030858c657d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x5rw-q4pp-hg5g is fixed in version 5.8.1-tuxcare.1 of devalue." } } ], "dependencies": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.1" } ] }