{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f0b0e667-f792-50fe-b284-fa3bdc3c07dd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/service-worker", "purl": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12", "type": "library", "bom-ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12", "version": "7.2.16-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:8829c43d-d1ee-5ed3-9e3f-71c642c3a7dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:a50610c0-dcea-5c39-8ef4-7d40aa29ef7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:918c3f56-4e4e-5ffa-8db2-8bc7e959ea66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:39007a79-c50a-53ac-b1c1-ec7b01c583f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:e050e2d9-cea2-5bfa-aa63-00cba2bd8372", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:5df6ae0f-0d6c-544c-b65c-d0dddcf89d14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:b9003726-e81a-5857-a30c-6167463e15b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:7456579c-15ec-5ed1-983f-98c283c8bf06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:20dce117-7d7e-5033-99ac-cbff3fd65ae6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:77dbc421-ee21-551f-abe3-a96e70bd0c67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:82cc3188-6d8e-5f73-b1a4-8b83f458ccf1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:4f475ca9-abdc-526c-8d5b-be5e4c974f16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:004f9f84-b17e-599b-8306-b5379e462f68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:e4d13e1d-7db1-5a04-af23-2f43153f3192", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:5ad6fc98-3ec9-542b-a257-ace9705fb7f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:7810d948-5a7c-5d37-9b65-4a3a4e2aeaa2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:2f7f64fc-2865-5c67-bf0e-763f34b9879c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:d6a7ea5b-0f45-58ee-9c10-a761871d2baa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:f6e6faae-e93d-5248-9dcb-557940ead40b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:58f2de55-0757-55bf-bb51-d7bd7e3fd7f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:9f162b04-8641-5c29-97ce-cfd9bc2196ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:69e1e420-d03e-55e4-a379-5e53777fa2e8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.16-tuxcare.12 of @angular/service-worker. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-68945. The vulnerability concerns HttpTransferCache's cache key generation logic that treats repeated HTTP parameters (`?role=user&role=admin`) and comma-separated values (`?role=user,admin`) as identical, causing cache key collisions. However, the HttpTransferCache feature does not exist in version 7.2.16\u2014it was introduced in Angular v16. While v7.2.1...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:8bbd1421-e3f3-5368-89f9-ab66cabdd191", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:9f5fbe33-fc8f-52d5-a1bd-6a41f48192ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:4e61263b-12f1-5973-9869-26bf6adce5e6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.16-tuxcare.12 of @angular/service-worker. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88056. The vulnerability requires a String.prototype.trim() call on URLs during server-side rendering that strips Unicode whitespace characters, converting same-origin relative URLs into cross-origin protocol-relative URLs. This vulnerable code pattern does not exist in Angular 7.2.16. The CVE describes a vulnerability introduced in later Angular versi...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:30ee338f-ddfa-520b-9e41-d4ff7d047f4d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88057 does not affect version 7.2.16-tuxcare.12 of @angular/service-worker. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88057. The vulnerability exists in the Ivy compiler's template pipeline (introduced in Angular 9+), which does not exist in this version. Angular 7.2.16 uses View Engine, where the SecurityContext determination for directive host bindings correctly uses the concrete host element name (`element.name`) rather than the directive's selector. The exploitati...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:9567aa00-6dfe-5a7b-9df3-4880e1d5d47c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:ca0cd536-af95-5d04-9ef3-1524afb8d376", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.16-tuxcare.12 of @angular/service-worker. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and client hydration features that were introduced in Angular v16+. Angular 7.2.16 predates these features by approximately 7 major versions. The codebase contains only legacy TransferState (manual key-value store) and NgModule-based HttpClient (no hierarchical delegation...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ], "bom-ref": "urn:uuid:fb0efbec-33f0-552e-94fb-6d0fec0bd133", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 7.2.16-tuxcare.12 of @angular/service-worker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@7.2.16-tuxcare.12" } ] }