{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:76d4395c-3d9a-52b2-b1ad-ff0b3a2a8178", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3", "type": "library", "name": "@angular/service-worker", "version": "15.2.9-tuxcare.3", "purl": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:add448b1-aa5b-596b-8c47-d93b87e8c68c", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:378793c3-7ccb-5ba7-ad66-9e1199693e65", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:561b1583-a965-5348-81d4-8ebc104c52a3", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5f0b9bbe-2f3f-5223-a174-6e8408109153", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c145b07e-609d-523b-88b4-b0f811bf2a18", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.3 of @angular/service-worker. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:df37dc36-0a6d-5653-9f78-f216edbf5aa1", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e7945663-e5a8-5790-96f7-a7ac4e981e65", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fdc4f59d-b7c2-557d-b0f0-c99bdf21021a", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:21fa7e7c-16b2-5b92-bc8b-a0eaa0c18306", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9-tuxcare.3 of @angular/service-worker. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3f35387c-b30a-52b0-ab8f-b995aeb15dff", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:05245358-3607-5867-ab8c-d0de5b56d4a1", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:673e6efb-4d4f-5cce-b689-3279d11a0230", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bb8a07c3-72ec-529c-b453-e8839ce982a3", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0ee987a3-536b-5eb5-a43c-226bf48b314e", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9d3898b5-5d82-5e8f-b98c-2fc9592c010d", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:78b54ab7-1857-5ee6-a6b4-8287e1a92957", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:97ea53a0-cfdb-56bb-8094-2ca7e3c2f6c8", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9-tuxcare.3 of @angular/service-worker. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0aea49f3-693d-50df-8eee-9b56631c74dc", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9-tuxcare.3 of @angular/service-worker. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b8160868-0f7e-5aac-9c53-c8fda4423a0d", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f5c195d0-5601-508c-8983-4318585a3fe1", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:51a1498f-11fe-5462-8ea5-b22b46f595db", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.9-tuxcare.3 of @angular/service-worker. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-68945. The vulnerability exists in the HttpTransferCache feature used during Server-Side Rendering (SSR), which generates cache keys from HTTP request parameters. However, this feature was not introduced until Angular 16.0.0. Angular 15.2.9 lacks the entire HttpTransferCache implementation: no transfer_cache.ts file exists, no HttpTransferCache class, ..." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:493f2c24-48b2-5065-8b1a-107db9e7b913", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c8a73fb4-a30d-5729-ae93-47e1caf108e4", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 15.2.9-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@15.2.9-tuxcare.3" } ] }