{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b4979cd3-21e4-5c58-b845-364ad92ad976", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/service-worker", "purl": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15", "type": "library", "bom-ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15", "version": "6.1.10-tuxcare.15", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:9d1fcdc1-416f-58c8-a7fa-f1907feff3d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:80e08614-0bb7-53f7-8a50-40cc40c6025b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:bf8c8c3f-d296-5348-af89-16dcb676d5a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:3d8b3942-f7ed-5e52-9ccf-f545237deaca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:3f8606c6-46ce-565b-b6f1-4b0dac1406a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:2d81744a-a1b4-5b77-8f2e-1a40d194d974", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:9bdd9653-ed38-58d3-a474-dca135623089", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:f05c7f02-a968-5a12-8d05-7feb060c1b3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:753cffe5-fc4a-5e6a-a89b-b022d6bc907b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:7ca09fe4-78d2-58e0-80c9-edfe4be1863c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:57763ca5-fb33-5377-a879-d683becda5ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:425006b6-0d0e-594d-985d-5229df354cf0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:e8f16f22-eca8-5ea9-b29a-7d31b027a124", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:ab04b936-f5a6-54b3-b164-70fc350c3043", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:ecc8a834-9941-5b94-bb17-74f443cdb155", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:719ec2d7-b2b5-551a-b7c3-f76e59b0b935", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:42f5f4b7-001a-5612-bffa-725b26ae33aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:eb6bf5f0-e3e3-54ae-a09e-3b92e024d3d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:e1b23cfe-9012-5d48-9ce9-28b7ee1fe8fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:076f0776-403f-54a3-a6cb-802105038400", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:2f3de06f-0e9c-572e-8497-aef75b47c21e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:f1a499e1-f581-5ea4-8356-8b7faf265a32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:d9bb8a99-f361-514c-8c59-2cf631f83a52", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 6.1.10-tuxcare.15 of @angular/service-worker. not_affected \u2014 Angular 6.1.10 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version \u2014 it was introduced in Angular 16.0.0 (April 2023), more than 5 years after Angular 6.1.10 (2018). The vulnerable file `packages/common/http/src/transfer_cache.ts` and all related APIs (`provideClientHydration`, `withNoHttpTransferCache`, `sortAndConcatParams`) are completel...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:cf4a1f8f-1415-5789-bf99-a13cff9074b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:db77f6cd-9c69-53e7-9d78-7b3dd98aa839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:76e7ffdb-3835-501a-a2c4-2983832f9995", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 6.1.10-tuxcare.15 of @angular/service-worker. not_affected \u2014 Angular version 6.1.10 is not affected by CVE-2026-88056. The vulnerable code pattern (url.ts with parseUrl using String.prototype.trim() and relativeUrlsTransformerInterceptorFn interceptor) does not exist in this version. These components were introduced in later Angular versions (post-6.1.10) and subsequently fixed in August 2026. Version 6.1.10 predates the vulnerable SSR URL resolution arc...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:e738937a-5859-5dea-8565-9ddc1ae4df76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:730dd4ec-05ce-5ae3-b2bc-a71df0c367ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:c7e4a009-35bb-5e2d-a7b1-8f9855d4d7dc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 6.1.10-tuxcare.15 of @angular/service-worker. not_affected \u2014 Angular 6.1.10 is not affected by CVE-2026-88059. The vulnerable HttpTransferCache feature, withRequestsMadeViaParent() delegation API, and modern hydration system (provideClientHydration()) do not exist in this version. These components were introduced in Angular 16+ (circa 2023), while the target version is from Angular 6 (2018). The vulnerability requires automatic HTTP response caching duri...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:81243443-5151-580b-89c5-bd91549f3fc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 6.1.10-tuxcare.15 of @angular/service-worker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@6.1.10-tuxcare.15" } ] }