{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:57625abc-b65c-58d6-abe8-19406c773c92", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/router", "purl": "pkg:npm/%40angular/router@17.3.12-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16", "version": "17.3.12-tuxcare.16", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:54309db1-0310-5884-b087-903426b36de2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:422b27ee-3c78-59e7-b5f7-972cc64b6264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:02b15cb0-1100-581b-a0ca-1f270f1007fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:5f147a49-0a22-5bbf-9f36-193a9aaf2d83", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 17.3.12-tuxcare.16 of @angular/router. not_affected \u2014 The vulnerable code (domino's lib/HTMLParser.js with the after_doctype_name_state infinite loop bug) is NOT present in this Angular source repository. Domino exists only as a declared npm dependency in package.json (line 110: \"domino\": \"https://github.com/angular/domino.git#8f228f8862540c6ccd14f76b5a1d9bb5458618af\"). The BUILD.bazel shows domino is bundled at build time from @npm//:node_modules...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:cd69c75b-cdcd-5a67-934f-46becc615388", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:3531809f-21c7-54d3-954a-daf1c1120cb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:fabc2003-7245-5c19-bdb4-d18aa56022d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:1d4ded92-3d69-53e3-b31f-3b3ba4864b37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:5db8f348-7964-5393-8281-65fdde717322", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:2552f659-951f-54fe-9d9b-1fdf17871649", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:2f029107-8798-51f1-85a3-28b07f9e7680", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:84f1d878-3bca-5888-8cd3-ef4f3272b5d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:e959191d-faef-589d-af02-b8b9d01e9701", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:8bd5e571-041c-57e3-a316-40d8e9d28741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:ee6039a5-c5be-5b37-a009-5e329874344b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:25e2f44b-7c07-54b7-bfde-6bf191b52f1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:63c6e51b-75f0-5ccb-aea6-346a751deda4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:202700a7-86c2-5576-82f6-f66f2d09ff4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:0fd41190-c5b6-55ae-8c7d-fe5d6def4d9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:e6aa5fea-3e18-5a60-a94f-637b85a6f91f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:1f7f1d9d-29e8-5bd9-b3f6-8df7624ab224", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:1e0cff4e-1c31-56a3-b06c-752a2f382abb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f5802c07-0f24-50f9-b094-66c7da23e782", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:6609063d-8a2d-5219-a35b-775fbfed8e9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:1de598e0-bf97-5e93-8f77-e587fd4b50fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:418217e0-4aec-5086-899e-2c2ef1e91d37", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.16 of @angular/router. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f85167b3-4ba4-5e42-8bdf-c276bd06845c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:7f9971c5-9b15-55fd-84ad-a309475bb3c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:6bf24c3e-007e-5b0f-a08c-d2d2d7f94b24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:d0542a9b-8967-5480-8d38-11f4a0a6aeea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.3.12-tuxcare.16 of @angular/router." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.16" } ] }