{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:73a8d51e-d82d-5bf6-8597-ac01ddd8302a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/router", "purl": "pkg:npm/%40angular/router@16.2.11-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1", "version": "16.2.11-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:2767ec1f-8fd4-54e0-85b8-db4c0c7cfdf8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:e904d09b-f554-507d-9bba-b2ffa6d41fcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:ebef5241-0bec-5b2e-9607-a3c36dcad76e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:ac6eb608-e659-59da-8d3d-eec617ecc28f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:5118b6d8-4d19-5c31-bdb7-c321c8c822c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:a5d79841-4019-5f68-af7a-4b7ed0c39441", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:bf45cd45-8a48-5559-8c69-6976e79dcc76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:f140aff6-3cbc-57a8-b962-17a59cbdf7cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:55112a02-26d3-55b8-8648-1a872fdb3623", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:def5c680-14aa-5011-b6c2-63cb5ae986ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:24b80e5e-36ec-5854-bdec-289acb75c726", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:66beceef-a2d0-5fa1-a951-ef710301d6a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:f8bb4fbd-de5d-5cfc-9937-efe821cbf4d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:390b4c92-e223-5f90-bff5-389d8cad8a92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:d442a78f-759b-532d-8ed3-b39b39af127e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:1274f447-e52f-5248-8168-42ecdaeb13c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:8198c501-f0c4-5791-8988-1c32260cff2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:ef5561c8-db9f-580a-baf7-c27c3a3bf242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:b184b46f-805e-570a-8144-5f5d55b659ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:ee811598-bd76-58f7-a17e-ab0d6733c856", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:5783c3b6-ac21-55a8-bc23-79eff0501032", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:d4d7c77a-b701-5eea-b129-2bbb225f2557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.11-tuxcare.1 of @angular/router, and is fixed in 16.2.11-tuxcare.2." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:7c050b2b-7cb4-515f-8b25-b7cc01c5a97e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.11-tuxcare.1 of @angular/router, and is fixed in 16.2.11-tuxcare.2." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:793ee377-e607-5db2-8a23-c8382c7511e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.11-tuxcare.1 of @angular/router, and is fixed in 16.2.11-tuxcare.2." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:0a11976f-9f6f-537a-9161-4baa8b458776", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.1 of @angular/router. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:9f9a7081-42e6-57e8-accd-6fc6df100584", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:c355c309-8c29-5329-b43c-392ceb71849c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.11-tuxcare.1 of @angular/router." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:6fa5b0c2-6a42-558e-a3d3-79459afea180", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.11-tuxcare.1 of @angular/router." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.1" } ] }