{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:775a80a2-aca5-56d6-bd2a-816f65ccade2",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "fastify",
      "purl": "pkg:npm/fastify@4.28.1-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/fastify@4.28.1-tuxcare.1",
      "version": "4.28.1-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "fastify",
            "purl": "pkg:npm/fastify@4.28.1",
            "type": "library",
            "version": "4.28.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-3711",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ab8b79d8-7bb4-5d08-8d6e-90cc4bec8dbd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-3711 affects version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2020-8192",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:593efa04-7be7-57a5-9854-94059c255af6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-8192 affects version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2022-39288",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8db80871-bc77-52d2-80e8-04f27f2bb05a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-39288 affects version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2022-41919",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b37b95cc-9663-53cb-b7d5-c6e2dd28d6b4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-41919 affects version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2025-32442",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b1a305d1-1141-5fb1-90b9-b34d762e6f56",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-32442 affects version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-107832",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cda04eb5-3c24-5f9d-857e-b67b68f72b35",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-107832 affects version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-120216",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bd63b5ff-884a-5eed-8117-2253dd5e36f4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-120216 affects version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-16732",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:573f84d5-3b90-522c-bbca-b1bf2ade4584",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-16732 affects version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-18504",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ba1bc18b-2a10-50a0-924b-bf2d15930a73",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-18504 is fixed in version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-25223",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:45a2005e-25e6-5e0f-8bb4-f3660b70432b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-25223 affects version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-25224",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1f9408fa-c06f-567d-99f0-f1fad7aeac14",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-25224 does not affect version 4.28.1-tuxcare.1 of fastify. not_affected \u2014 Fastify 4.28.1 bridges Web Streams (ReadableStream or a Response body) to Node streams with Readable.fromWeb() and pipes the result into the response. That path honours backpressure, so a slow or non-reading client cannot cause unbounded buffering. The unbounded-buffering code that CVE-2026-25224 fixes in 5.7.3 is not present in this tree.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-33806",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2a57d0ef-0b34-525e-b948-0be8358bcced",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33806 affects version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-3419",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1ace961e-95d9-5d44-9443-2554c703bf27",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-3419 affects version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-3635",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d0b925e3-793a-52c0-a5be-304ead04c431",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-3635 affects version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-76169",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4930b850-d2d8-5c63-958f-6c86f2190c6f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-76169 is fixed in version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-84428",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a7b019d5-8685-5231-890d-961dd464eeb6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-84428 is fixed in version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-84469",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1e77f449-e21c-5229-9c7c-0d50beb32fa7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-84469 is fixed in version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-84504",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4c10b6cc-7827-507f-be49-e30a4aa7784a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-84504 is fixed in version 4.28.1-tuxcare.1 of fastify."
      }
    },
    {
      "id": "CVE-2026-92081",
      "affects": [
        {
          "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4b8a1f0d-aa1d-5787-8291-3ea21b0f4a55",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-92081 is fixed in version 4.28.1-tuxcare.1 of fastify."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/fastify@4.28.1-tuxcare.1"
    }
  ]
}