{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3fe56ee3-5495-5882-9eeb-077450c86a75", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-webworker-dynamic", "purl": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8", "version": "8.2.14-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:6c7387fa-e9cc-5270-953f-42c4d35ba0d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:3697edd8-6d62-5058-ae70-aa2b8daab8e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:8938b9e2-0685-5f26-88c3-f8e510d340b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:ad837313-49e5-57ad-b77e-c5b8cea17ae5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:935bf935-9c0c-5fe5-a4c8-ba4da7d9e7fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:d766d206-5402-590f-a2e3-587bbe97e88a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:ae3ffbbe-e8c0-57e7-b6d0-9bf8345b1a77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:f14c07d9-0ce0-5f0c-b45c-cc8dbee2c425", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:629796b1-eb62-5385-821e-7c284d9cb2a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:0ee2545f-6b9d-5579-ae73-78bc6d756f79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:cc1a8090-3819-5f7e-b832-2221e2394788", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:c89e2046-33ce-5742-afcd-fb5cbd1fd859", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:1ba9cd11-729f-566d-9fca-b040107636d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:37098aa4-9780-5a7f-8b7e-1599c809e4e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:4cb6b27a-93aa-5542-a3bd-47e2e9d5afb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:a4399c0f-6714-5a56-a93b-227582a3faa8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:c2cf8c7b-9650-54e4-a460-e92fc17d55f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:9b1c8b6f-18da-5424-8f2c-030f1930abfb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:e0a000f0-1a72-5d31-a6ae-3b25c2bfde53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:739ef832-6ec8-55e7-b27d-17d0f676d54e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:20b52ce1-7ea2-58bd-a684-256a4963cd36", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:a9ce213a-38d1-5f7a-8e7f-0400b50aa0d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:31945cac-e2a4-52ab-bdd7-7fdeae86940a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:ac2dca68-8712-5446-8e89-183d7023e93f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:d5e80c09-9d8f-5c04-8a0d-02b90cb34611", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:fb1fccab-869d-5d6b-9389-c32e45cf463a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ], "bom-ref": "urn:uuid:45dd0ae3-e7ab-59d0-a9d8-36142d63c90f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 8.2.14-tuxcare.8 of @angular/platform-webworker-dynamic." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@8.2.14-tuxcare.8" } ] }