The CRA
SBOM,
European.
Generate a CycloneDX 1.5 SBOM from your lockfile (npm, pnpm or yarn), or import the one your build chain already produces. Get an alert when a new CVE hits one of your components. Hosted in the European Union.
Free account, thirty seconds. Part of the console is still in French.
Transitive dependency, via mqttcritical
minimist 1.2.5
CVE-2021-44906 · Prototype pollution
Hover over the timeline: the constellation replays each revision · sampleRev. 18 · 21.10.2026
New: CVE-2021-44906 · minimist · critical · alert sent
- Formats read
- 6
- Recheck
- Every day
- Account
- Free
- Lockfile stored
- No
I want an SBOM
Upload a lockfile
npm, pnpm, yarn, or an existing CycloneDX or SPDX SBOM. The result in thirty seconds with a free account, and the file is not kept.
Generate an SBOM (in French)
I have to build a technical file
CRA, RED, Machinery, Art. 14
One file per product and per version, continuously updated, where appropriate, at least during the support period (Art. 31), and one EU declaration that covers every act.
See each part
I am new to this
What an SBOM is, and why
The ingredients label analogy, what log4j changed, and the most common date mix-ups, starting with 11 September 2026.
Understanding the SBOM
The SBOM becomes a requirement in December 2027.
Source: Regulation (EU) 2024/2847, Annex I, Part II, point 1.
Every deadline, read in the textCRA key dates
- Reporting of actively exploited vulnerabilities (Art. 14)
- Essential requirements, including the SBOM
What euvex does
CycloneDX 1.5
A commonly used and machine-readable format, which is what Annex I, Part II, point 1 asks for. An OWASP project. Deterministic JSON export: the same inventory always produces the same file.
Six input formats
npm, pnpm and yarn read directly. And an existing CycloneDX or SPDX (2.2, 2.3 or 3.0) SBOM imports as it is, whatever build chain produced it.
CVE alerts
Matched against OSV, then against the NVD for what OSV does not resolve. An email goes out when a new vulnerability hits a component of your monitored SBOM, from the severity you choose.
Each part in detail, and what euvex does not doRED, applicable from 1 August 2025Technical documentation and the EU declaration
How it works
- Step 1
Upload the software
The lockfile (npm, pnpm, yarn) or the CycloneDX or SPDX SBOM your build chain produces. euvex derives the bill of materials and looks up known vulnerabilities; the file is read, then discarded.
- Step 2
Declare the product line and the version
The product as you place it on the market, and its version. Once attached to it, the scan enters the EU declaration and the cross-check against the catalogue of actively exploited vulnerabilities (Art. 14).
- Step 3
Fill in RED or Machinery
The cyber questionnaires, requirement by requirement, with the evidence you cite. Or declare that the act does not apply to this product: it leaves the declaration.
- Step 4
Print, then sign
Each part gives its printable report, and euvex assembles the single EU declaration, flagging what blocks it. It is issued under the sole responsibility of the manufacturer: you sign it.
- The list of your product lines, and the version of each.
- For each piece of software, its lockfile or its SBOM, CycloneDX (JSON, 1.2 to 1.6) or SPDX (2.2, 2.3, 3.0).
- For each RED or Machinery requirement that applies, the reference of its evidence: document, procedure, test result.
- The manufacturer's company name and VAT number, carried into the declaration.
From the SBOM to the product's technical documentation
Product regulation does not ask for a file: it asks for documentation per product, per version, continuously updated, where appropriate, at least during the support period (Art. 31). That is what the console assembles.
Your products, their versions
Attach a scan to a product: the CVE verdict follows the version, not the file. The cyber questionnaire of the RED (Delegated Regulation 2022/30, applicable from 01.08.2025) and the cyber part of the Machinery Regulation 2023/1230 (applicable from 20.01.2027) are filled in at the same place, and each part produces its printable report.
Art. 14 · reporting, on the clock
Applicable from 11 September 2026: notify any actively exploited vulnerability. euvex matches your components against the CISA KEV catalogue, opens a case, counts down the deadlines (24 h, 72 h, final report) and prepares the content. Sending it to the CSIRT remains your step: euvex files nothing on your behalf, and says so.
One EU declaration, every act
The law does not ask for five files: the declaration of conformity lists all the applicable Union harmonisation legislation (Machinery Regulation, Annex V). euvex assembles it from your parts (CRA, RED, Machinery) and you sign it: it is issued under the sole responsibility of the manufacturer, and that, too, is the law.
The account is free: it is used to upload a file and to keep the product file. An uploaded scan stays readable without an account, through its link.
An SBOM is a photo. Compliance is a film.
The file you download is true on the day you generate it. The CVE that concerns you will land on another day. So euvex rechecks every monitored product every day, automatically and keeps a record of each check. If monitoring stops, the file names the gap instead of hiding it: “nothing changed” and “nobody was looking” are never confused.
All revisions export as one self-contained file, each in standard CycloneDX, dated at capture. Your evidence does not depend on euvex surviving.
Beta
Free during the beta
SBOM generation, vulnerability scanning, history and audit file: everything is open, with no announced time limit. The price is set; it will be shown at launch, not before.
Generate an SBOM (in French)The details, and our commitmentsBefore you open an account
All the questionsIs my product in scope?
euvex does not say: classifying a product is a legal question, and the answer remains yours. What it gives you to judge: the scope of the RED and its cyber requirements, with the text to back it, and every deadline with its source in the Official Journal, on the key dates.
In the console, an act that does not concern a product is declared “does not apply” for that product: it leaves its EU declaration of conformity.
My SBOM comes from a firmware build chain, Yocto for example. Is it read?
Yes, if it is in CycloneDX JSON (versions 1.2 to 1.6) or in SPDX (2.2 and 2.3 in JSON or tag-value, 3.0 in JSON-LD): it imports as it is. The SPDX of Yocto 5.1 and later can be uploaded directly; the .spdx.tar.zst archive of Yocto 5.0 cannot. Components in pkg:generic, which these chains often produce, are looked up in the NVD by CPE; those that offer neither a CPE nor an exact version stay “not analysed”, never counted as clean.
I already use Syft or Trivy. What is euvex for?
Keep them. A generator takes a photo of a piece of software on the day it runs; exported as CycloneDX JSON, versions 1.2 to 1.6, its SBOM imports into euvex as it is.
What euvex adds is what happens afterwards: the daily recheck and the email on a new vulnerability, the dated history of revisions, the cross-check against the catalogue of actively exploited vulnerabilities for Art. 14, the CRA, RED and Machinery questionnaires, and the EU declaration that brings it all together. The details, part by part.
What happens at the end of the beta?
Nothing without you. During the beta no card is asked for, so nothing can be charged, and a beta account will not turn into a paid account on its own: the paid offer will be announced, and subscribed to explicitly.
The price was set on 4 September 2026. It is shown on the pricing page at launch, and in any case to the account that subscribes, before any payment. The billing unit will be the product line, not the version: a new version of a product already covered costs nothing more.
Accounts opened during the beta are entitled to founding member status if they subscribe within the twelve months after the price is shown: half the public price, with no time limit, as long as the subscription is not interrupted. The commitments are written in Article 8 of the terms of use (in French).