{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b8a55f03-2080-5968-a931-d9a7ab35e691", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/service-worker", "purl": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4", "version": "7.2.0-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:65efda50-0f25-5b03-a4b5-3d8e3c185010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:4738886d-cfd8-56a2-b519-22d1d5961d15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:e045801f-019d-5037-ba44-e2f8e18f684d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:c121863e-c255-5030-a318-7705e9afcc9b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 7.2.0-tuxcare.4 of @angular/service-worker. not_affected \u2014 CVE-2026-101895 affects domino's HTML parser (lib/HTMLParser.js), which is declared as a dependency in Angular's package.json (domino@2.1.0) but is NOT vendored or present in this repository's source tree. While Angular SSR applications using this version ARE exploitable (user input via [innerHTML] bindings reaches domino's vulnerable parser without DOCTYPE validation), the TARGET REPOSITORY do...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:871c0434-2d3e-5f0c-af21-717d4fd98c15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:00fdb296-cfa9-5e30-a454-7f247c5f6324", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:c79b3a01-6e0d-5f6e-8447-fe9a37251c90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:da70c146-502e-5748-8d3d-56152f6d65d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:e548baf0-2210-59e1-9849-244ff14ffb87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:5f33c675-7497-55dc-b707-90be41a25b87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:72006abe-ccd7-597c-898e-eb40b99b9afa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:c070cf0d-6894-5c9b-a8ab-4ae50271e2d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:7f9d0076-0b10-54f0-b3a6-49a7d1372aad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:c035e23f-1a3b-5118-93fe-666cd1d49d34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:a4e41d6c-9a42-5e70-963b-de35510a0905", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:7926ec8d-f128-5129-9d61-714a5ce23ccb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:3ba7563f-48dd-53f5-9cf8-c72e78b2346d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:d716f59d-fe60-59af-aa0e-ca72aeb45e3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:5478375b-b554-590a-9cd6-88475bd56aa7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:4f39b161-a55c-5d21-a7ff-1af207154dbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:82bca2c4-68ab-5ac6-a85d-2a3282c63b2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:6e1346c8-1ed3-5fbc-8182-6c7380574225", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:7b36375d-ba63-5141-850c-bef087508855", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.0-tuxcare.4 of @angular/service-worker. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-68945. The vulnerable component (HttpTransferCache) does not exist in this version. According to patch documentation in the repository (CVE-2026-50170.patch, CVE-2026-54266.patch), the HTTP transfer-cache and client hydration features were introduced in Angular v16. Angular v7.2.0 predates this feature by many major versions. Exhaustive searches confir...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:d9fe1e81-6399-551e-a097-888ae82780b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:e8505f72-72be-5dee-af59-4c13d82b24c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:db62c39f-b31e-576f-8722-16f96e4b5cb5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.0-tuxcare.4 of @angular/service-worker. not_affected \u2014 Angular version 7.2.0 is not affected by CVE-2026-88056. The vulnerability requires the presence of a `parseUrl` function in `packages/platform-server/src/url.ts` that uses `String.prototype.trim()` to normalize URLs, which strips Unicode whitespace and can convert validated same-origin relative URLs into cross-origin protocol-relative URLs. Version 7.2.0 does not contain the `url.ts` file; it ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:248affe8-f150-55e4-9b32-5052bf44beed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:b16e7f2e-9b00-5f7f-931a-3bd620f6fb92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:f698b348-108b-5b4c-85a8-5a61296e08e1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.0-tuxcare.4 of @angular/service-worker. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache, hierarchical HttpClient delegation (withRequestsMadeViaParent()), and automatic HTTP response caching features that were introduced in Angular v16+. Version 7.2.0 uses NgModule-based configuration (HttpClientModule) with manual TransferState only\u2014no automatic HTTP-to-TransferState caching exists. The...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:0514cba1-4fc4-591a-a045-4372a891e274", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 7.2.0-tuxcare.4 of @angular/service-worker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.0-tuxcare.4" } ] }