{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f1c39094-824c-5ba0-b851-eac33cbd3ba4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/service-worker", "purl": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5", "version": "18.1.2-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:05a2ed17-ab05-584f-97f5-f69a5170f779", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:4c15bf76-3c62-5024-b5e3-398e3c658983", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:a812c0d6-ae02-5928-a677-0224e11359d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:7a59bb4d-3ce6-5368-8f78-a67dd307ee10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:318531d4-77c6-597b-ae11-d4b35e597679", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:6c905975-94b1-5e28-9c58-d006e95396d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:d3bc794c-a4db-5a6a-bdf1-d6cc92d58aae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:e7c75d38-869a-5653-b2a0-10ce6ae12a38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:dc1e90b7-a5ce-5ba0-b80d-12764beb681b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:6caac057-e2f6-5405-a80f-250623d9a3e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:059f146b-9257-519a-964c-2be417731536", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:3274b40a-73e7-550f-900f-0e7b5f440804", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:3b06d46f-486b-5a4c-9515-234e1d1aff0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:14780cc6-f5ee-5d98-b373-9cbd15936482", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.5 of @angular/service-worker. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:46622e7a-587d-557d-b3e5-8dfc4ee2fd2a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.5 of @angular/service-worker. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:a0bf5266-979e-5ca1-9673-0e781ee1acd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:3dc16252-3ecd-598c-a787-eff6a8ca9437", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:b481250c-85ca-52f7-b4d5-495304f9b6c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:079c1df8-708f-5c07-9471-4cd88bc7f3ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:c7032014-1979-530d-9c30-d5d4c2d2cf5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:870ca299-fccd-5473-b695-1d4ce7ed45e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:10913a65-178f-5b1a-9347-7d5417dfd474", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:8a0aec9a-176c-5122-a5ca-c0598fcacedb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:0fa8e457-9962-5f83-82e1-4d47beee576d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:a064315a-aaa4-519b-8d90-3d37ec013d31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:4f848304-789e-5a58-a3ac-c3facb61a75d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.5 of @angular/service-worker. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:c67f0cf4-08b1-561a-b89e-7be6764f4e09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:43bda4b1-a0b3-5b54-b4ef-db9697f139ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 18.1.2-tuxcare.5 of @angular/service-worker." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:3b2d4c74-d652-5cbe-a2a9-1d891a033883", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 18.1.2-tuxcare.5 of @angular/service-worker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@18.1.2-tuxcare.5" } ] }