{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fe4ecfe2-3e76-57fe-af02-e0c0c69eb183", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "devalue", "purl": "pkg:npm/devalue@5.9.0-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/devalue@5.9.0-tuxcare.2", "version": "5.9.0-tuxcare.2", "pedigree": { "ancestors": [ { "name": "devalue", "purl": "pkg:npm/devalue@5.9.0", "type": "library", "version": "5.9.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-123561", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:5c66620a-2d1a-5246-b05a-85b828851f98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123561 affects version 5.9.0-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123562", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:06b28833-5a0b-5706-87cb-2433312f4195", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123562 affects version 5.9.0-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123563", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:ea4da601-c184-5244-b20d-90e79d6174b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123563 affects version 5.9.0-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123564", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:49ccc284-2464-59ed-995e-c229abe02cb4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123564 affects version 5.9.0-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123565", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:e8e510ae-1ff6-5d44-979b-cdb38f74a51d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123565 affects version 5.9.0-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123566", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:6eca4b8c-3331-58a2-8d3e-0be99dea678a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123566 affects version 5.9.0-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123567", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:131e453c-5941-5846-955d-2edf3799dc77", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123567 does not affect version 5.9.0-tuxcare.2 of devalue. not_affected \u2014 devalue 5.9.0-tuxcare.5 is not affected. Both parse paths that build objects (plain object and null-prototype object) throw on a `__proto__` key. The upstream commit 87c1f3c, released in 5.6.4, added these checks and is part of the 5.9.0 release that TuxCare onboarded. The commit author is outside the TuxCare allowlist.", "justification": "code_not_present" } }, { "id": "CVE-2026-123568", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:e628107a-5da2-55b8-8880-6f4e2b8e1baa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123568 does not affect version 5.9.0-tuxcare.2 of devalue. not_affected \u2014 The target is devalue 5.9.0-tuxcare.5, which is newer than the 5.6.3 fix. uneval rejects objects with own __proto__ keys during its pre-walk, so the pollution chain is blocked. The upstream fix (0f04d4d, 'Properly handle __proto__') is in the upstream release that TuxCare onboarded.", "justification": "code_not_present" } }, { "id": "CVE-2026-123569", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:1e5de12a-1b45-5a70-a612-657776881ba5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123569 does not affect version 5.9.0-tuxcare.2 of devalue. not_affected \u2014 devalue 5.9.0-tuxcare.5 already contains the upstream 5.6.3 fix for CVE-2026-123569 (\"better encoding for sparse arrays\", upstream commit 819f1ac). stringify and uneval no longer iterate or allocate per hole for very sparse arrays. The fix shipped in the upstream release, before the first TuxCare commit.", "justification": "code_not_present" } }, { "id": "CVE-2026-81176", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:c3305a9f-6cf8-5312-bab5-0c66616714df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-81176 affects version 5.9.0-tuxcare.2 of devalue, and is fixed in 5.9.0-tuxcare.5." } }, { "id": "CVE-2026-92708", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:09426b17-6c6d-5612-a157-3fcd657035f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-92708 affects version 5.9.0-tuxcare.2 of devalue, and is fixed in 5.9.0-tuxcare.3." } }, { "id": "GHSA-4q55-j62x-fr9h", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:38189dfc-dd8b-5552-9951-ff1dbddda17a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4q55-j62x-fr9h is fixed in version 5.9.0-tuxcare.2 of devalue." } }, { "id": "GHSA-hx4r-w6wj-j8fg", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:f8fa7cbe-bd70-5176-a3c7-dd460ae8e3c6", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-hx4r-w6wj-j8fg does not affect version 5.9.0-tuxcare.2 of devalue. not_affected \u2014 The target repository (devalue v5.9.0) is not affected by GHSA-hx4r-w6wj-j8fg (sparse array DoS in uneval). The vulnerability was fixed in upstream commit 819f1ac7 (2026-02-18) by Elliott Johnson, which added Object.assign optimization to avoid O(n) iteration through sparse array indices. This fix is already present in the shipped v5.9.0 release. The vulnerable pattern (for loop iterating from ...", "justification": "code_not_present" } }, { "id": "GHSA-mcm9-63f2-9j32", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:dcf7d1e6-2d4b-570d-8987-eaedd8fe658f", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mcm9-63f2-9j32 is fixed in version 5.9.0-tuxcare.2 of devalue." } }, { "id": "GHSA-r9w8-h9r3-54w4", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:687d04a7-ef79-5eda-93f6-827b5e4eceaa", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-r9w8-h9r3-54w4 affects version 5.9.0-tuxcare.2 of devalue, and is fixed in 5.9.0-tuxcare.3." } }, { "id": "GHSA-wf3x-273g-mvxv", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:532ae02f-7837-5a41-bf3b-4c999b0a1cea", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-wf3x-273g-mvxv affects version 5.9.0-tuxcare.2 of devalue, and is fixed in 5.9.0-tuxcare.4." } }, { "id": "GHSA-x5rw-q4pp-hg5g", "affects": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ], "bom-ref": "urn:uuid:6d6b72d7-078c-58ca-8fad-42a1f8145a85", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-x5rw-q4pp-hg5g affects version 5.9.0-tuxcare.2 of devalue, and is fixed in 5.9.0-tuxcare.3." } } ], "dependencies": [ { "ref": "pkg:npm/devalue@5.9.0-tuxcare.2" } ] }