{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:644b35d6-c505-5bbe-9dc4-5ef514239e62", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/service-worker", "purl": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11", "type": "library", "bom-ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11", "version": "12.2.17-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:2e19d33d-4640-5b36-b18c-d5e2da97ee85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:303257d6-da84-5f98-9a36-110601eafe3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:72987e57-54d2-5695-b261-5c7f792b7660", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 12.2.17-tuxcare.11 of @angular/service-worker. not_affected \u2014 CVE-2026-101895 affects the domino HTML parser (lib/HTMLParser.js), not Angular's source code. The Angular framework repository declares domino as a dependency (package.json: \"domino\": \"^2.1.2\", yarn.lock: version 2.1.6), but does not vendor or bundle domino's source code. Exhaustive search confirms no HTMLParser.js or after_doctype_name_state code exists in the Angular repository. While Angula...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:3167c3f8-eb59-5d69-a42f-c86c74e8a323", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:69c2b181-4055-537b-bf44-6f4f792d9f89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:f3a5c227-931f-59a1-9285-59cf6bb7d395", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:03980d44-308c-5fb5-820b-9df672ed99bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:262cbeeb-7d7e-5a87-95fa-79af840332e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:3591de1b-8946-5463-b296-8b4d7a969ac0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:34999926-3b6e-5cfd-8de6-eeed0a6233ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:5ef232ce-4be3-5c62-857a-eb9dcbd2ed96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:589aa8ab-bedd-53a2-81bd-aa36929ede59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:f4e0473d-0a55-5b29-8bce-0edcb42c83cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:935fed85-71c1-56f0-b3b5-015dd648911b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:b8e74187-c7bc-51dc-b549-477024aa0711", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:ed271daf-a443-5767-972e-a74e67d2fde3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:7bf5aab6-1da2-517d-8036-159e92c24363", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:cd34fe2a-5665-5f64-a6c5-efa68b315068", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:5a17411f-ff8a-5f8a-9194-0938ae7d8ee4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:aca4e556-ddb7-5ecc-8800-2cfa1ae48c3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:735dc186-2d0c-5e83-8003-564cb45e1759", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.11 of @angular/service-worker. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:746531bb-c117-59f2-9ad7-998cb99eda06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:837f1081-c586-55ed-801f-080bca3a3c9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:29cc8056-4249-5ee7-b6a9-82af011d6709", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88056 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:d30317ca-1126-50df-891d-6faa6cf50f40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:2270730e-ab68-5b9d-9c63-5ca7b0e76d5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:d8c05902-8add-5955-b0e2-06577463856d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.11 of @angular/service-worker. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:574a5953-b443-57b5-a503-388f2e5e2156", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 12.2.17-tuxcare.11 of @angular/service-worker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@12.2.17-tuxcare.11" } ] }