{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3be215ab-155a-51bd-a834-b4c15861b32b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-webworker-dynamic", "purl": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13", "version": "8.2.14-tuxcare.13", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:0f1ac9bb-2f6a-5342-a83c-ee8783ea0797", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:a6a940b0-c8f3-5a73-a46e-b667d44b84f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:7777380d-2a0b-59d6-85df-5841a3f60c04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:a29bcc41-f4c9-5d03-8808-d233dd8d105d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic. not_affected \u2014 CVE-2026-101895 describes a DoS vulnerability in domino's HTML parser where incomplete DOCTYPE declarations with trailing whitespace cause infinite loops. The vulnerable code (domino's after_doctype_name_state EOF handling in HTMLParser.js) is NOT present in this Angular repository. Domino version 2.1.2 is declared as a dependency in @angular/platform-server's package.json but is not vendored i...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:08ef8633-1eb1-59f0-a9d2-493a04e78d8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:1f6518dd-a525-5e22-a04d-84144ebe8c99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:d4c56a78-8296-51f8-acde-45e9e4f364b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:62ccdcd0-7893-5eeb-abcb-b73250e769ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:4b69ff9f-4969-5a62-956b-1ecb1818825d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:845e1f23-7902-5fc1-a473-24d3b6dfc60b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:b13f5fe2-cd61-51fd-8bac-099f4b3f4c56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:a81bab17-f522-5c7d-bba0-1296da47a7a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:d8cae653-2fc0-5611-b679-e1eec1208ead", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:d2ce9f0d-b735-541b-b4cd-a353b6b99c20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:a0ce1096-668e-52eb-be76-0d9a8a1557bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:84443284-1808-5511-a74d-e55c9f18ee0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:4c9a0ca9-fca4-59a6-a3aa-7909d0e8271b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:4edf97e5-4990-5391-ab99-728674ce64bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:0f6e06d9-b2a7-5d53-a132-e8fbb0534b03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:6b7d5083-dc1d-5e35-9188-579cd9909c7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:2fd190fb-3aab-570d-8ec8-4692d523a20d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:caa7efcd-5272-59c3-baec-883684e7312d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:034a8ee3-b673-5bd3-a094-db2c9d8505f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:727b553c-80b2-5472-b538-1ee2af29ce6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:455a1fe6-16eb-5fe1-a3a1-b9b88af5cd85", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:6446ce4d-aa75-52ac-b32e-b7bb2ca2d19c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:cb936182-1cc0-5b49-a354-a9aaa1c1408f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:18e66acc-fa2f-520a-933e-40cd73b0c689", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:9f2453e1-52eb-557f-b2b9-b51f49123c08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 8.2.14-tuxcare.13 of @angular/platform-webworker-dynamic." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.13" } ] }