{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2bbaf9d9-764a-5e7d-a235-3573dddc8f82", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "devalue", "purl": "pkg:npm/devalue@5.8.1-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/devalue@5.8.1-tuxcare.2", "version": "5.8.1-tuxcare.2", "pedigree": { "ancestors": [ { "name": "devalue", "purl": "pkg:npm/devalue@5.8.1", "type": "library", "version": "5.8.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-123561", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:2d61969e-7844-5d65-898a-7b30315f1db4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123561 affects version 5.8.1-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123562", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:fd18fb57-a8d1-5029-ae8c-18a1784d25e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123562 affects version 5.8.1-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123563", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:c3567cee-8226-5ea2-845d-d74425696d46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123563 affects version 5.8.1-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123564", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:d7965126-cbfa-5cc4-ad82-c0a7064d6c22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123564 affects version 5.8.1-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123565", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:bc693ded-1359-5e1e-a62f-770921c58a7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123565 affects version 5.8.1-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123566", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:c0840b44-054e-5de8-bf7f-2eb83d9a4d98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123566 affects version 5.8.1-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123567", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:6317b3a2-be89-549d-a692-c4be0447fd32", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123567 does not affect version 5.8.1-tuxcare.2 of devalue. not_affected \u2014 Target is devalue 5.8.1-tuxcare.2, which is newer than the 5.6.4 fix. The upstream fix (commit 87c1f3c) is already in the shipped upstream release. Every parse/unflatten path that builds an object from payload keys rejects `__proto__`, and the 'Object' wrapper path only accepts primitives. No path produces an own `__proto__` property.", "justification": "code_not_present" } }, { "id": "CVE-2026-123568", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:fa8ec464-1352-5fe0-a05d-1fed361a3ad3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123568 does not affect version 5.8.1-tuxcare.2 of devalue. not_affected \u2014 devalue 5.8.1-tuxcare.2 is past the 5.6.3 fix for CVE-2026-123568. The upstream fix for __proto__ handling (0f04d4d) is an ancestor of HEAD and was already in the upstream release TuxCare onboarded. uneval's walk step throws on any own '__proto__' key, so the prototype-pollution input never reaches code generation.", "justification": "code_not_present" } }, { "id": "CVE-2026-123569", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:b9a19386-31d9-57c2-9a12-71b7b782d247", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123569 does not affect version 5.8.1-tuxcare.2 of devalue. not_affected \u2014 devalue 5.8.1-tuxcare.2 is not affected. The CVE fix (upstream devalue 5.6.3, commit 819f1ac, \"better encoding for sparse arrays\") is already in the upstream release TuxCare onboarded. stringify and uneval both use a sparse-aware encoding that avoids per-hole iteration. TuxCare backport 78a1669 (GHSA-wf3x-273g-mvxv) additionally hardens uneval.", "justification": "code_not_present" } }, { "id": "CVE-2026-81176", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:1740ffda-1f7c-59ac-ab5a-533fb4ec0221", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-81176 is fixed in version 5.8.1-tuxcare.2 of devalue." } }, { "id": "CVE-2026-92708", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:d361d731-5d09-52a6-b3ea-3dba0ad01474", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-92708 is fixed in version 5.8.1-tuxcare.2 of devalue." } }, { "id": "GHSA-4q55-j62x-fr9h", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:35233eff-cfab-5993-af48-af3b236d3133", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4q55-j62x-fr9h is fixed in version 5.8.1-tuxcare.2 of devalue." } }, { "id": "GHSA-hx4r-w6wj-j8fg", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:a06dcbe3-6c68-5274-bbe9-64c2ec341940", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-hx4r-w6wj-j8fg is fixed in version 5.8.1-tuxcare.2 of devalue." } }, { "id": "GHSA-mcm9-63f2-9j32", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:f929b594-9ef2-5b02-913d-24290392ec32", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mcm9-63f2-9j32 is fixed in version 5.8.1-tuxcare.2 of devalue." } }, { "id": "GHSA-r9w8-h9r3-54w4", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:0157031d-316e-5976-a27a-11573d0657e2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-r9w8-h9r3-54w4 is fixed in version 5.8.1-tuxcare.2 of devalue." } }, { "id": "GHSA-wf3x-273g-mvxv", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:ae45d3b4-939c-59b4-93ca-3536670f7b32", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-wf3x-273g-mvxv is fixed in version 5.8.1-tuxcare.2 of devalue." } }, { "id": "GHSA-x5rw-q4pp-hg5g", "affects": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ], "bom-ref": "urn:uuid:3c6f88df-6383-570e-8ff7-fa83f83684a3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x5rw-q4pp-hg5g is fixed in version 5.8.1-tuxcare.2 of devalue." } } ], "dependencies": [ { "ref": "pkg:npm/devalue@5.8.1-tuxcare.2" } ] }