{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:64c765e3-9fae-5a07-9617-e76b96b5dc7e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/service-worker", "purl": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16", "version": "16.2.12-tuxcare.16", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:be78d5a2-7343-5d6f-9451-37412fcafde7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:2c8eda95-463a-59c7-a72f-12513e14051d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:52489b3a-df07-5509-bec1-42ce29a7e6f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:821183f2-94b1-52fe-a400-01365136770f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f93e0d64-32f4-5fdf-84de-6119fc3591d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:4b2cc7fd-3bff-5dc9-8ebe-4cd0d980e9e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:fbbdb6e5-997f-5354-aeae-c65b260eebcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:2f5ce602-d823-5995-94b6-4b76e49b2207", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f3e5351f-b66a-5b24-afb2-d9097f4bc86a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:005f118c-afce-5052-822f-398df6b33cf4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:7fbd8517-47dd-5da7-9c0f-13a33a766544", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:80300835-d657-5bdf-8564-c7dc1baed757", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:2e644363-5f95-509f-aea9-ef77c57d47b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:bcdd0eab-2d56-5431-b17f-27280c852904", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:df5928df-a3e5-5dbb-8171-e387e992ea1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b26b4de4-4e6e-561d-920a-191c886885df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:41a00f7a-e48f-54c2-9132-14b5470a0f8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:7aafa506-020b-5b15-803f-177799f0f6b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:4bf331f5-b912-5a14-9693-e2eefb6819cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:6f2c78d5-16f7-5f07-8371-8b8a0df89313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:abbf4b14-0f6c-5d3b-b494-ea7d63d35127", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:6e952149-e9b1-526b-929e-53b5f2c4ecc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:abc43b70-ff40-5abd-8cd6-7887d2f739cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:5ce2081e-65cd-52a6-aed0-fc8ce0e1448c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:e6cd2d6b-e88e-5a72-a930-d08727970f5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:c66efccb-de69-5959-abd7-904bcef40aac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.16 of @angular/service-worker. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:d54a5953-7159-5575-9d14-93126ed905e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:3f50bdb7-7681-5078-9025-4a0f69bec992", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:d06523ae-7b70-5806-b759-556446b49cc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b015115d-1884-5fcb-ba42-f5288e41e282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.12-tuxcare.16 of @angular/service-worker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.16" } ] }