{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4f00843f-157d-572e-93e7-c77189918094", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/router", "purl": "pkg:npm/%40angular/router@17.1.0-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7", "version": "17.1.0-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:64d0a881-2ad7-5391-8a8d-2d54481c2172", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:636bbc5a-dadd-5f56-85e2-2a92c5948a06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:623c8730-a3d8-5438-9b38-365f6c3fe4c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:bf475649-d528-5505-9b83-c9920643a8aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 17.1.0-tuxcare.7 of @angular/router, and is fixed in 17.1.0-tuxcare.8." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:c00f5f48-6284-5ab0-a27d-091ac70659af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:8c3b18f9-2927-5185-a5ee-593da4818a1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:df83c3a4-8821-59c1-a96b-ba287242f9fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:e19e0ae7-bab2-5a27-a4dc-72698e2f088d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:1fd8f068-8dba-591d-b513-8551b407fd66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:5c1e6491-a79d-5b39-a967-860deae38866", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:a81a82b6-98a8-5136-be95-92a87c9e2a6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:1288858b-483c-543b-afb3-fa7a76fac4c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:a974a7ad-790c-5df6-a293-a1fb7ab6cf0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:2dcae886-7874-517b-a887-f05a65261041", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:96f9953c-02fa-5c8a-8e53-e49b6a11215d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:e400255f-d8b7-5fad-ac52-37ae15845e2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:29d15e76-372a-5c3c-9483-c50e5445493b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:2403db79-e742-5e67-8605-20dc112e8d2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:042d838b-de6d-5aaa-899a-78f26667223b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:a512f347-83e5-5ea4-9c66-633b9e4570fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:d106927f-f535-5c2d-9ce9-f4b2aad2abff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.7 of @angular/router. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:5c2bcda9-0644-5ed9-bb87-39a0659e56dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:d72a65fd-fb7b-5c5b-b88c-fcd39feda48c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:ba37edfb-e7d3-5dcd-8681-cea927e86425", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:ffe8253f-1329-56e3-9c1c-e516172fc7f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:66c6a468-e380-5b6d-92e6-0f71c6f8023c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:d6693ddd-1eb9-5539-ab73-ca8f484f2cb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:9fc3832f-fb99-5694-8cb9-75cb8b2fa98e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.7 of @angular/router. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:bde41328-6f9d-52f7-b19d-b54158caaf53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:c392c860-cf7b-5a56-8693-08610bfa65b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 17.1.0-tuxcare.7 of @angular/router. not_affected \u2014 The Angular repository (version 17.1.0-tuxcare.5 at SHA 1b802ce320) is not affected by CVE-2026-88058 because it does not contain the vulnerable source code. The vulnerability exists in the domino library's HTML serialization code (lib/NodeUtils.js), which Angular references as a dependency in package.json but does not vendor. The upstream patch (89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef) is a D...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:df96ffc8-d7c4-5820-89dd-5d5ce24d9709", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:8569cf2a-272a-593c-954a-a4859439de4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.1.0-tuxcare.7 of @angular/router." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.7" } ] }