{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:376e9aeb-c4d6-5498-8189-00a75e61fb66", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/router", "purl": "pkg:npm/%40angular/router@5.2.11-tuxcare.20", "type": "library", "bom-ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20", "version": "5.2.11-tuxcare.20", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:28327f7c-0595-5ef4-bce5-e3b40521a69b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:3f89ba47-7360-5db2-bed6-e83c249c7541", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:50c6bd1e-814d-5bfc-9d97-4acf42999d72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:66fc7f34-b153-5475-b3be-2f3bc1f378c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:3733dc51-17d2-5b69-b05d-49da45da3aee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:d39e6231-1f38-5c0d-a745-6c458e16fa8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:008a9f39-b91a-50e8-ae45-bd28090986db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:93547b91-85be-53b4-acbe-aa8314e60f7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:9de37f47-ee05-5fb6-96d5-fb4efe1d6c82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:64e6024a-47a3-5ad1-baaa-d580f0fff4de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:3bfe4ee7-030b-53d3-b920-f6ebdbdb573a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:d69734b7-b21a-5191-8300-277e39a825f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:54b98557-a7ca-531f-bdba-510d27a768b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:ebb2626a-9a72-5e41-8f77-9d5cb7679c02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:19101e2e-c237-5f29-bccc-c022a84eb2d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:1dc54b5a-7e26-575c-bae7-c9cc888d8df9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:20350c3b-6e7d-5f95-a826-6d1e4dcfde62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:0b0ea8cd-b610-5eaf-b27f-382863dc7819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:7abdb68d-727e-5551-b189-1c62f657e17d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:a847b4b9-c24b-509b-99a2-10a81b40a677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:988b9d60-fec1-5aff-9212-62fe2a09b59d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:cf665ad1-0a7e-5894-b64c-175624d5a0da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.20 of @angular/router. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:42730d36-36e4-5b83-b30d-a88696fafd02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:9fe7c717-c40e-50f5-bdd4-3fd1ce9b24db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:508d54f4-bf7d-5a5c-bf33-269803d61b80", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.20 of @angular/router. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:f0242ff0-11bf-55bd-98bc-c8be932c22f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:1bc68fa3-3d66-5d36-b0bb-eef18088adc3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 5.2.11-tuxcare.20 of @angular/router. not_affected \u2014 CVE-2026-88058 affects the domino library's HTML serialization (XSS via ancestor fallback raw-content tag injection in comments/processing instructions during SSR). The target Angular 5.2.11-tuxcare.19 repository declares domino 2.1.2 as a dependency but does NOT vendor its source code. The vulnerable code (NodeUtils.js serializeOne() function) lives in the domino npm package, not in Angular's ...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:7c53a540-1ae3-515b-98f2-7a57641b7a31", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.20 of @angular/router. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:7e75431d-a58e-571d-9098-09d6db15a625", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 5.2.11-tuxcare.20 of @angular/router." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.20" } ] }