{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8a17958c-0ef3-54c3-84e3-d52a873199d2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/router", "purl": "pkg:npm/%40angular/router@16.2.12-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3", "version": "16.2.12-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:c1a9e0f0-60db-5d22-89f9-984ee629f61e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.3 of @angular/router." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:d4626103-21a0-57dc-a3c9-822a267e8514", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.3 of @angular/router." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:ea6982d2-92d4-56c0-8424-a4492370cbbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.5." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:5ffcd1e6-a5b1-57d6-8cd1-b1d6240e474d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.6." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:4f3701b8-3d2b-5d94-b208-35800bf4e5b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.8." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:41157efa-a950-566d-b430-886e67c8f661", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.10." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:591582c8-1209-570e-8341-d5656e907151", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:4904f4d3-2296-56a5-8fc9-811f54367c04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:765cdd2e-50ae-5b9d-b834-99b84fcbd366", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:b9449c33-de0d-5dcb-a77d-b9c647bb571b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:afb8a0bd-28ea-50d8-a909-9c6ad1b11ecb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:68e72da0-8b53-512c-8e37-64c0c02e39c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:cdf97f92-d6a0-56b7-86a2-e29d94a9b258", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:9ac96014-1b30-56cf-ac53-173908dc5d9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:85383ca8-54a2-5f11-9a2e-944ca0d7dcdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:f991d5ac-7433-5bc6-8882-81fa3814d9f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:e0bc3d6a-8676-5585-84e0-f27aa6795d53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:6e415d2b-caf1-5847-a4f0-f02209b5633b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:960c9547-347d-578b-8b64-285ec0085945", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:5edd49d7-e44e-5984-b11d-36562e6bdb46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:0055d9df-48d9-5c82-9740-c90a99cc4776", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:66fa2b65-dbc6-5e90-a13a-bd3bfa5a7752", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:13f59d2e-a28a-56b0-859e-4435b670f789", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.3 of @angular/router, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:258a6b2f-df4e-57ff-b715-20b724c41e70", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.3 of @angular/router. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:b0bafebe-3a97-5898-89ef-6012b018ec47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:911a4960-a377-5964-b58b-500123234a0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:0109c9c5-944c-5db2-aba7-a83943597f04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.3 of @angular/router." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.3" } ] }