{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1a40e378-490a-5781-af2f-b53d215d1dcb",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "i18next-http-backend",
      "purl": "pkg:npm/i18next-http-backend@1.4.4-tuxcare.2",
      "type": "library",
      "bom-ref": "pkg:npm/i18next-http-backend@1.4.4-tuxcare.2",
      "version": "1.4.4-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "i18next-http-backend",
            "purl": "pkg:npm/i18next-http-backend@1.4.4",
            "type": "library",
            "version": "1.4.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-105800",
      "affects": [
        {
          "ref": "pkg:npm/i18next-http-backend@1.4.4-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:97a78fa2-784c-52f6-b27f-7c12d7230654",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-105800 is fixed in version 1.4.4-tuxcare.2 of i18next-http-backend."
      }
    },
    {
      "id": "CVE-2026-115730",
      "affects": [
        {
          "ref": "pkg:npm/i18next-http-backend@1.4.4-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:084996fc-a78c-5356-9003-d1a9140192ca",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-115730 does not affect version 1.4.4-tuxcare.2 of i18next-http-backend. Not affected: the isSafeUrlSegment guard added by patches/CVE-2026-41691.patch rejects any '/' in ns/lng, so a namespace starting with '/' never builds a protocol-relative URL. Verified with a PoC against 1.4.4-tuxcare.3 from Nexus (ns '/evil.com' is refused); the guard is present in the cjs, esm and browser bundles. See JSELS-11893.",
        "justification": "protected_by_mitigating_control"
      }
    },
    {
      "id": "CVE-2026-118258",
      "affects": [
        {
          "ref": "pkg:npm/i18next-http-backend@1.4.4-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f053c9c8-9c3f-5a2b-a210-e2d6e363a018",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-118258 affects version 1.4.4-tuxcare.2 of i18next-http-backend, and is fixed in 1.4.4-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-41691",
      "affects": [
        {
          "ref": "pkg:npm/i18next-http-backend@1.4.4-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:434d7b4b-45b9-56f5-8a30-218eaaa7c38c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41691 does not affect version 1.4.4-tuxcare.2 of i18next-http-backend. already_fixed \u2014 CVE-2026-41691 has been fixed in the target. The target repository at SHA 4c259a05342a83d40708a87d91745cb81440f564 contains the complete security fix from commit 5f9123b, which adds input validation to prevent path traversal, URL injection, log injection, prototype pollution, and credential leakage vulnerabilities. All affected code paths are protected.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-w47m-j727-m843",
      "affects": [
        {
          "ref": "pkg:npm/i18next-http-backend@1.4.4-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a741d553-00bd-5faa-82f4-7d373fe5997d",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-w47m-j727-m843 is a false positive for i18next-http-backend 1.4.4-tuxcare.2."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/i18next-http-backend@1.4.4-tuxcare.2"
    }
  ]
}