{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:13f4b98f-9a25-5a0f-81d5-c370292303a0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/router", "purl": "pkg:npm/%40angular/router@17.1.0-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6", "version": "17.1.0-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:6fbb77f1-9a42-50e3-9a4d-0ef771c4e588", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:80d2a947-f22a-55aa-9a26-f8b9f3e39a7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:e94e6de6-aa81-5c35-bae2-dbb6d4efd4a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:14bff734-2aaa-5e15-a839-9e395d34ac14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:0294d69f-6d38-5cc9-bd0c-f9a245c68678", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:47ffa729-6980-540e-9bd6-d7fc81f70bfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:db5f4416-adce-5b3e-9e21-c3ab37d147fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:47a5c93d-f240-59ab-8a4f-b14c3ff0e6c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:30740b1b-ad25-5635-babc-5fb27abbd0d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:42cf246a-af70-5dbb-9850-22aa69880822", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:a7841cd3-1610-560b-8240-84b6e5edfda2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:fabbd691-c01d-5292-935d-fe766206a1b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:480a5179-3060-5a7d-8c37-077f614aaa0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:19786ef6-9716-58ad-8552-2ba62560c40c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:8cf03a4c-f696-5d01-9409-c48db49e453d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:faa5d029-c95c-5065-a5f5-49d24cae493a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:7a61c6fd-6d29-5ae9-b0bc-e7475ce1e16f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:e29a66a8-0d1b-58f8-9635-774425f20d97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:1e793303-3d2b-56c8-a835-3ee269c6d4b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:39e29fdb-70f7-5046-b08a-4308fc69e6b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.6 of @angular/router. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:52075856-1646-5fe4-8690-6cf6af6c5160", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:85e2b4d3-044c-5ca4-8bea-39ca62f7f7af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:5af68fc8-aff9-52a2-94ba-0ef0b9b8a90a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:f7ab96a6-595a-5c59-885c-811cf9574a8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:91685751-670c-52d4-9a68-535baec3bc6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:d7bb13e7-4a76-5917-a70c-bb5b916b63b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:57299824-e99a-58c7-b7d6-fd5fd0627d41", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.6 of @angular/router. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:cead99e6-f711-5be1-a569-9427f2489547", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:740c7758-46ad-5f2e-ae8c-17901683e8d3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 17.1.0-tuxcare.6 of @angular/router. not_affected \u2014 The Angular repository (version 17.1.0-tuxcare.5 at SHA 1b802ce320) is not affected by CVE-2026-88058 because it does not contain the vulnerable source code. The vulnerability exists in the domino library's HTML serialization code (lib/NodeUtils.js), which Angular references as a dependency in package.json but does not vendor. The upstream patch (89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef) is a D...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:ae848d5f-76a7-5779-8f32-d20390b998f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:8e6f6abd-1090-5ec9-bfd2-2185928e8beb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.1.0-tuxcare.6 of @angular/router." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.6" } ] }