{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4b66c300-0dff-5a42-acf9-6c6ea0eb3895", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/service-worker", "purl": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4", "version": "16.2.11-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:ab0a8388-ba73-5e8c-8e4c-976a6d0d39ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c457c7d9-c099-58e0-ad77-e444d52f5162", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:819cf5c5-14ac-5f94-9141-692d66d64883", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f624ab3d-5904-569e-8a04-937562bda4f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d559d098-9076-5546-806c-215121e15a68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d2963d31-8c04-5542-9988-a9052ba3cb49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:99b2bded-903d-5e5b-bda1-3a103e7c6207", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e39ccfcb-9cbb-538c-8f2d-5d2bccee3b0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f8abf177-0945-5875-af85-96872285e221", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e25b1139-d6ac-5f06-b22d-bed81d39a2e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d0343a89-fca9-5321-a933-514972dc4d35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:634ff2ed-4d41-5e84-91c0-67a4c28e7fdd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:bf213cc2-d6f0-5bb0-93b8-2f5d4298225d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:16fb2b01-b046-510c-a781-aa91264da142", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:61e6316f-eba8-5daa-b434-6b6e8b4859a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:6023d25d-5c5a-5642-a5f4-76335e97cb6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a8883590-c6ca-5467-aff8-57a5781b0d25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c5d7c2bf-2a45-52df-ad7c-32870285f5e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f3270bcb-d455-519f-9bb7-c6a1e39187ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a74715c0-57c2-5946-a171-501a0a11e3ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:267f0e59-4fec-5edd-9928-d8e11fd89553", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:dd6db44f-6928-5df0-8f1c-fc5e2a02cfb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:64b9cb12-0b5a-5aec-9c8f-c2d4676e5c75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a87aef3e-e4e4-5009-9114-8c13c5c886ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:bcebd977-cdc5-53c2-b0d2-0db9de83ee0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:9ab2cfd5-adc7-5300-88a8-d266398f4d0b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.4 of @angular/service-worker. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:12c8a348-04f5-5465-96a6-cc126690c300", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:ca40ec40-5fa7-500e-844a-76088ba39145", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:6a3ddb27-92c0-5ea2-9fec-81ab389051fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:188f27fe-f5d7-5b48-b97f-3faf5cec074f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.4 of @angular/service-worker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.11-tuxcare.4" } ] }