{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d4467d40-386e-5d2b-96ba-d3881416a28e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "devalue",
      "purl": "pkg:npm/devalue@5.9.1-tuxcare.3",
      "type": "library",
      "bom-ref": "pkg:npm/devalue@5.9.1-tuxcare.3",
      "version": "5.9.1-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "devalue",
            "purl": "pkg:npm/devalue@5.9.1",
            "type": "library",
            "version": "5.9.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-123561",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:35392fbf-67c5-53f2-9d83-b7436385cf63",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-123561 affects version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "CVE-2026-123562",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:64c12c02-1352-5ee6-83e8-6362dcc3b352",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-123562 affects version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "CVE-2026-123563",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:1f414e2f-6c83-5499-b323-96871401b62c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-123563 affects version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "CVE-2026-123564",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:41968416-e984-5d6a-a721-d58349ce48e4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-123564 affects version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "CVE-2026-123565",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:609ef87b-0e52-5757-bfc2-f9f2730b08cf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-123565 affects version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "CVE-2026-123566",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:eba57be4-51cb-5d08-b630-ef837ea6797a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-123566 affects version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "CVE-2026-123567",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:6b6356a0-8d55-557c-ac07-d5fd6d32b937",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-123567 does not affect version 5.9.1-tuxcare.3 of devalue. not_affected \u2014 devalue 5.9.1 (tuxcare.3) is not affected. src/parse.js rejects '__proto__' keys in both the plain-object branch and the null-prototype branch, so parse/unflatten cannot return objects with an own '__proto__' property. The check was added by upstream commit 0623a47 (Rich Harris), which is in the upstream 5.9.1 release before the first TuxCare commit.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-123568",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:ad9fdb69-4bc8-5121-81c6-61baeda7388a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-123568 does not affect version 5.9.1-tuxcare.3 of devalue. not_affected \u2014 devalue 5.9.1-tuxcare.3 is not affected by the uneval prototype pollution. uneval rejects any own \"__proto__\" key before generating code, so evaluated output cannot get a different prototype or shape. The guard shipped in the upstream release (commit 0f04d4d, author hello@ell.iott.dev), which predates the first TuxCare commit.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-123569",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5e458c45-a8b1-53da-ae5c-ec002e87320a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-123569 affects version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "CVE-2026-81176",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:fb8cfa6b-a873-5234-b41b-fdd519eaa997",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-81176 is fixed in version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "CVE-2026-92708",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a3492a5e-e970-530a-9ad9-8c15a82db0ba",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-92708 is fixed in version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "GHSA-4q55-j62x-fr9h",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:858e5807-32db-5d6f-8863-8294d7ad711f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-4q55-j62x-fr9h is fixed in version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "GHSA-hx4r-w6wj-j8fg",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7511a756-bfec-5a32-829d-d87bb9254ec9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-hx4r-w6wj-j8fg is fixed in version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "GHSA-mcm9-63f2-9j32",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5da0a4bd-acf8-5d5d-9183-f8e85d3ef352",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-mcm9-63f2-9j32 does not affect version 5.9.1-tuxcare.3 of devalue. not_affected \u2014 The target version 5.9.1 is NOT affected by GHSA-mcm9-63f2-9j32. The vulnerability (sparse array amplification DoS) was fixed by upstream commit 819f1ac, which is present in version 5.9.1. The fix prevents the scenario where parsing a small serialized sparse array and passing it to uneval() could generate a massive output string by iterating millions of indices. Both stringify.js and uneval.js ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-r9w8-h9r3-54w4",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a6c0dcfa-a806-5ecf-afb4-a0b24a266019",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-r9w8-h9r3-54w4 is fixed in version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "GHSA-wf3x-273g-mvxv",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:3bb36f3b-c2b0-53e7-a609-4b80aaf9bed6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-wf3x-273g-mvxv is fixed in version 5.9.1-tuxcare.3 of devalue."
      }
    },
    {
      "id": "GHSA-x5rw-q4pp-hg5g",
      "affects": [
        {
          "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:326ea4c8-bc3e-5ef2-8f29-2dd32ae45fa0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-x5rw-q4pp-hg5g is fixed in version 5.9.1-tuxcare.3 of devalue."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/devalue@5.9.1-tuxcare.3"
    }
  ]
}