{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c693ba12-ca64-5f69-b4d9-65dd91d535bf", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-webworker", "purl": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9", "version": "8.2.14-tuxcare.9", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:dafeb0d7-5817-590e-a40d-c06f40112129", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:4a3d63c6-7039-55c5-ba8f-bf4426e02280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 8.2.14-tuxcare.9 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:52e40af7-96bd-590b-870a-92a41ee774de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:e89f3248-af88-50ca-9e09-c57d005e894d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:31dc4d4c-a52a-52bf-8777-5fb8be29066e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:1b67217e-ad30-5d6b-a8c1-55b5b3f2792c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:3e849879-b7fd-5dd9-992c-124b559f4c1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:c0042595-2cf1-59fc-a809-1afc29d3e6ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:0fcd52c0-4be4-5a7d-8b66-22c79927e619", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:5c4b1d09-a696-5417-88e2-2854530ac397", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:292a34ec-bdb3-5e8b-bcbf-cd65ac6f8d91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:d27389ff-f8ce-55c9-897a-1ff235980a67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:ad2e1ee9-5558-5be1-ba3f-9d0411278432", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:22c1d0a8-561d-57f4-a4a4-3b938b0ee436", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:5824a34a-60d8-5835-9903-67f3e9940d06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:24aa5adb-a6c7-5872-8714-e1f0cd25aa7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:e2ec691c-248b-5502-a436-358aabd6b62a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:62304178-724a-5f91-8ce6-63da705cfd6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:bb1b0ccf-c10d-5916-be15-45176b4e91ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:f482c60a-4c79-5919-8c8d-c6d62ebe8f34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:659cd88b-bb07-571e-9815-de0b629ee235", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.9 of @angular/platform-webworker. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:e2461707-dbc3-532f-a70a-1fac1eab17e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 8.2.14-tuxcare.9 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:199e2c64-9058-5e31-a44f-959e2f32f848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 8.2.14-tuxcare.9 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:168c233a-d9e0-5868-bf38-29af509cf589", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.9 of @angular/platform-webworker. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:88a055d5-8174-5a47-a992-91db8d00b80b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 8.2.14-tuxcare.9 of @angular/platform-webworker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:64c8d605-4e08-5669-8b98-0cfabb5c2afb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.9 of @angular/platform-webworker. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:7bf291e2-5f41-5bdc-9f29-21f6138abec7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 8.2.14-tuxcare.9 of @angular/platform-webworker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.9" } ] }