{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3b60105d-a0bb-5820-8d9c-b464ba1b8f86", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-webworker-dynamic", "purl": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8", "version": "8.0.3-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:09793fff-779a-53ba-840b-3b96cc66696f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:cb27a7a4-db56-58ac-b677-8b450e437c7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:2454b043-7c27-5e55-a412-4a9a781dbdf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:654fd78a-5baa-5b74-8a99-6b7193481b53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:6dbbd156-a7f8-5de3-9226-1e643ec72f87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:3b12341f-65b8-5b67-acc7-74ce2a729fec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:fef11e42-d171-5f46-9d97-9e14686b86df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic. not_affected \u2014 The target Angular version 8.0.3 is not affected by CVE-2026-41423. The vulnerability requires WHATWG URL API (introduced in Angular 8.2.x+) to manifest the hostname override behavior. Version 8.0.3 uses Node.js legacy url.parse() which does not interpret protocol-relative URLs as having attacker-controlled hostnames.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:054a1aed-b146-5295-b43e-b8d3170d4937", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:1b5274b0-1eb2-5710-bcdb-70bb1e0d7302", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:1d30effb-40b6-539e-8a2c-8c76d7e13168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:92c258df-cf24-5777-b7a8-62dbdcb93a59", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic. not_affected \u2014 The target Angular v8.0.3 is NOT affected by CVE-2026-50170. The vulnerability requires the HTTP transfer cache feature (packages/common/http/src/transfer_cache.ts) and client hydration mechanisms, which were introduced in Angular v16+. This version lacks the entire affected component.", "justification": "code_not_present" } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:b60c52b6-33d8-53db-bf3c-8f57aa134476", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:49bc1b70-17d5-5078-8058-5619865d39a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:b6109389-a8a0-54da-8c59-2e4a90e0052c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:3201297a-45f6-5835-b21c-d673a9ebca8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:c7ea0178-5485-50b5-b209-d5e8e7699c37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:59c8c0e8-64b4-5019-b36f-9c65bd66c593", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:392d7ca2-eabf-5781-b59a-b36f7304be6d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic. not_affected \u2014 The target Angular service-worker version 8.0.3-tuxcare.4 is NOT AFFECTED by CVE-2026-54264. The vulnerability requires the service worker to copy and forward request headers during cross-origin redirects. This version never copies headers: the AssetGroup path creates fresh requests from URLs only (no header preservation), and the DataGroup path delegates to the browser's spec-compliant fetch A...", "justification": "code_not_present" } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:1e90fc7c-9592-52ef-b3ec-cce6f4de9ac0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:110523ac-d51f-59be-ae19-8cc0a9392416", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic. not_affected \u2014 Angular 8.0.3-tuxcare.4 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with its weak DJB2 hash-based cache key generation does not exist in this version. HttpTransferCache was introduced in Angular v16+, while this target is v8.0.3.", "justification": "code_not_present" } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:283317ff-a2a9-5418-b64e-4fbbedc9aa38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:f3362d88-af7c-52f0-b6b7-4a3aefb227de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:3a23c370-cbe0-5278-8863-8aed449d7a3c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic. not_affected \u2014 Angular 8.0.3-tuxcare.5 is NOT AFFECTED by CVE-2026-68945. The vulnerability concerns HttpTransferCache, a feature that caches HTTP requests during Server-Side Rendering (SSR) and generates cache keys that incorrectly treat scalar-comma parameters (role=user,admin) as identical to repeated parameters (role=user&role=admin). This feature does not exist in Angular 8.0.3 \u2014 it was introduced in Ang...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:81ebbf9d-331f-522d-adb8-ef85c18597b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:c211f9ac-e57e-5ecf-8c32-193d01f962ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:b26ed58f-0cf6-52d7-9bb5-24e1cffb7b9e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic. not_affected \u2014 Angular 8.0.3 is not affected by CVE-2026-88056. The vulnerability exists only in later Angular versions (v19+, v20+, v21+, v22+) where packages/platform-server/src/url.ts contains a parseUrl function that calls String.prototype.trim() on URL strings. This trim() call strips Unicode whitespace (U+00A0, U+FEFF), converting same-origin URLs into cross-origin protocol-relative URLs, causing SSRF. ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:e36e39b2-63c4-5691-81a7-1dc254acc1d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:a405fc53-aec7-5ccb-8463-f38b5669f63e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:4addd63c-c26c-5f1f-937a-e2ffa10ab21c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic. not_affected \u2014 Angular v8.0.3 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and modern SSR hydration features that were introduced in Angular v16+. Version 8.0.3 predates these features by multiple major releases. The legacy TransferState in v8 is a manual key-value store with no integration with HttpClient, making the described attack chain impo...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:60afba73-04a8-54f2-a181-77afe1757128", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 8.0.3-tuxcare.8 of @angular/platform-webworker-dynamic." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.0.3-tuxcare.8" } ] }