{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d2be60ec-5cd7-5e85-a7b0-bec9198a444b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/router", "purl": "pkg:npm/%40angular/router@8.2.14-tuxcare.13", "type": "library", "bom-ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13", "version": "8.2.14-tuxcare.13", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:e3a8fbd2-86b7-5b75-9c0b-2fe8b8ae468b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:0f761b01-a4ef-5e7a-9bc8-7fbe570932a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:0842b2ce-ffce-5ea1-85d2-0c084ecb5278", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:5459aa0e-303a-55e8-be04-72011db5c665", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 8.2.14-tuxcare.13 of @angular/router. not_affected \u2014 CVE-2026-101895 describes a DoS vulnerability in domino's HTML parser where incomplete DOCTYPE declarations with trailing whitespace cause infinite loops. The vulnerable code (domino's after_doctype_name_state EOF handling in HTMLParser.js) is NOT present in this Angular repository. Domino version 2.1.2 is declared as a dependency in @angular/platform-server's package.json but is not vendored i...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:dc1893b7-a6e5-5c92-9848-ae8b32be31ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:b0c8f170-fee9-5fd6-8278-0e0710d534ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:7b4b1053-8fca-5a35-8f6c-d5f65d66a734", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:f768ddcd-1fae-5162-bc57-d7d8eefccabe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:2a82173e-6002-51d8-b74e-c50469a4cc0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:836c7fa3-8c9e-5083-a9b9-b85afeba121d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:0dff3e58-7555-54cd-95c3-fa10b1a47256", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:92efb3b6-47c8-5a67-b708-f85b05fd74f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:48a82a36-f278-5638-8476-345d89222ee3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:a6fe8089-3d28-5d82-9fdd-09e0c10bdbf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:04bb0d05-4b27-5b7b-86ca-ad0a89c53608", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:7d0c819c-10a8-55c2-9506-cf06b5ed5142", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:187a2aaf-72a4-5630-bdb2-b3a7bae7d976", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:51f4a440-e586-5183-acf1-5a7f9b441854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:daed729d-2b97-5f07-bae7-e73d7293d13e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:03f641ad-a785-535d-a7c8-849899b4e716", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:2ab2308a-e63c-5412-9a34-99843eda6cad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:ab384c64-c5f9-5dfc-a826-c6d3585358b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.13 of @angular/router. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:b49dd1bc-ccc4-5223-8203-7165452d2894", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:344acdaa-0c32-57df-a624-0fd63a390885", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:974e218e-5b4f-56cd-8f2c-ad33f2d50458", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.13 of @angular/router. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:33055c4c-4e5e-544e-bea3-7f5435d861ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:c6c265da-1c00-5d47-aa52-07ffeb3089ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:74f6a13d-5ede-56b0-8ab6-886185b29eba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.13 of @angular/router. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:ff48d933-b93e-5b89-bb62-8ebc37f13a04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 8.2.14-tuxcare.13 of @angular/router." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13" } ] }