{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8f8529b8-cad2-550a-94d3-e8e148a9d242", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/service-worker", "purl": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6", "version": "16.2.11-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ed8af12c-d097-57e4-bc3b-3746d08cebbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:edef462e-d06b-5ebc-9406-2f9f94aa4947", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:3c88bc6d-7c1d-543b-a4bc-3b6581b101e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:517df2ea-28b7-5283-8f89-3ddd3a436a5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9ac9a448-359d-5657-ac18-f3ca9c980b03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:cf5e7b18-c1dd-54dc-9343-c7b8d4295d46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:598c4efb-9309-50f7-ad43-a342bf64f4a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b0000d72-f56e-5346-bb6d-548e90948841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:46389e12-b007-5d42-a6f9-2799c60405c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8cd58f86-7f5d-5be5-a938-e857c52ea3bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d2176c9c-601f-5117-a79a-93fb779a1822", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c58f223d-3699-51de-82c3-a2bd4c7aa141", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:76e5e2e0-bed9-541f-b7ea-5daa25c89964", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:46faf6a0-9da7-51a6-a808-82dc25189a05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:3fa6d305-3544-59ae-811b-850b567e44a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b1113b9f-15fc-5d4f-917d-0f1e84278bb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:45f7b765-31e3-5972-a42c-3befe2f8212d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a50bbb69-fa1b-551f-aa7f-2129a098a711", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5926ef8c-c4cc-5e20-afa0-5c7acaf68c09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:456dfb6c-0724-5950-9750-8142081ee418", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:21848775-04d5-59b6-8563-9dbced16eff3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b9a988a2-ef80-5799-9f92-084dd499243d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c6e31b51-6326-52cf-8a69-db3318bfb716", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4d4fcaf2-6115-564c-aeb0-9aff23f657f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:54899cb6-b91b-549d-a295-c4cb5179a45c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:7b23f805-96ae-5a7f-ae88-d1bc2c304119", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5d4a51a0-97cb-5aee-9202-229762955a39", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.6 of @angular/service-worker. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b7ddce0a-9af2-52ae-8ff0-8f164fbf2397", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bfd04ccb-1b54-5c2c-b1f2-5cb7cfbe32b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ed903b9e-04b6-5d79-8f3f-1ddd8c53bfa8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:dbbf3f70-06e9-5654-b992-439ac7e37f61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.6 of @angular/service-worker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.6" } ] }