{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:634a9cba-2f6d-505d-b0da-366fb76d2678", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/router", "purl": "pkg:npm/%40angular/router@17.1.0-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3", "version": "17.1.0-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:e5ee508a-82b6-56e1-bbaf-e463601e026c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:a5f4d429-0610-5d33-891c-43b8912b5eb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:e92e2acb-fbf2-5496-817a-0958bec85bc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:1db7dd49-a011-531f-9d8f-09180057be48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:879e917d-a9cb-5f77-b662-67755aa5954f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:e0f52981-4208-5b4e-ae06-a783bc4725e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:bc93632a-68f7-5f36-8e01-7fb521f3d20c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:73a0784d-51c7-552e-82ff-9b14383db0a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:9b99d356-0e9a-538c-80af-cbe7a6e48c48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:e2ab84fa-f09f-5c4c-96bb-b318fb886640", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:dd7b37cd-7da9-56aa-a01d-4da3bb7c59fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:01a48710-1763-579c-a39d-dc2ed7733683", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:adf8f2fd-7e80-5620-a11e-40f0ea74e7c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:78035ff9-bb9b-5dce-82ed-dc8b66675e0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:7adf6667-8007-56a1-8e3d-6b9ccb79494e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.1.0-tuxcare.3 of @angular/router, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:7a318774-7398-5f90-95db-d46d596e2d98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:a7ba2b7a-287b-524a-8d8d-5999d1995f57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:514804f7-9471-52f4-809d-424fc144fc4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:2ef60afd-7ac0-5342-a6d2-584caec04b79", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.3 of @angular/router. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:ebfa78bb-adee-5e1a-9070-74a05cfcf0f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:2bd3aefd-32cd-5c20-a990-7c67aa1c1d98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:59fff62c-da03-5fb3-b8d5-dc2b92f4415f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:fdcc27f6-45bc-506c-908d-727186155328", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.1.0-tuxcare.3 of @angular/router, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:fc921bc6-64dd-5ca2-a67c-0776a9f0baab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.1.0-tuxcare.3 of @angular/router, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:7f5b0928-2d15-54b7-8d30-939e70e94918", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.1.0-tuxcare.3 of @angular/router, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:8377e203-9fd3-5d76-adc1-d3f352c0cd83", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.3 of @angular/router. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:adb08b6e-7db9-5354-8ad5-c5c4ce0c2f16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:5fe3425c-6a49-5989-9d8f-1a3fd75715db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ], "bom-ref": "urn:uuid:a3e07454-beb1-5b83-abf1-492b26afd010", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.3 of @angular/router." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/router@17.1.0-tuxcare.3" } ] }