{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4254563e-c843-5272-a292-285b25065678", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/service-worker", "purl": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3", "version": "16.2.11-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:f7584cd1-bb19-5d23-9d65-4073dd348246", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:3d6075fd-0409-512b-bada-cb103874dc4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:441238dc-2800-590b-b81b-302aa1b5bcf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:8bb130cc-afce-598d-9598-87d7dceb705a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:07e36de3-d030-544c-9b6a-c102308a49eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:964140ea-4df1-5c33-82f8-798c050e22f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:b9488938-7e37-5506-b513-b52b318e8935", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:9ff43f74-76b3-5b55-8fb0-477cc55b925c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:4db8b1cc-c6de-5672-892c-85a6e7716ea0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:9db7cbce-ac6a-5cdd-a0d5-b6d46f6bcbd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:aa9272ed-6b38-5839-8910-8f7def78536b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:d837088b-94c0-57aa-9e81-8a141308c0bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:e6b045e7-d33d-550c-8622-8a72cf5b4fce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:394987ca-d9d7-5401-b356-6aa0ee1c3e9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:0019daae-66de-5423-9642-914fd119950e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:ff4c1a81-6cf4-5de7-8d32-28acca6bc91e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:77bb8983-a123-538f-8746-934ad4bcb77d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:712d9bb5-d255-5210-9e99-920500311c0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:a1cc4b9f-9259-5c2a-bb6b-875b4ff66189", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:f412b096-96d2-58c8-b7e8-a1d2a4d7cd20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:83786081-f0b6-581b-8a47-ad7a795667ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:6f9b07fa-e2ee-57db-b4d4-f9923c2f2e13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:3e56cb3e-508f-586d-b892-9a66c64a7461", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:8e232e01-fa8b-5d88-9a60-b7a0b32b2936", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:e13bcc90-55f3-50b3-b656-e5c43d37be33", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.3 of @angular/service-worker. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:b1a15b5a-20b3-5914-9195-6401a490051b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:7ce75b6d-ae9f-589f-b806-1d4d173a9b94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.11-tuxcare.3 of @angular/service-worker." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:0b43f960-060b-5d60-a874-4da005dfd12a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.11-tuxcare.3 of @angular/service-worker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.3" } ] }