{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2f4e576c-e3a7-593b-9e93-417cb33a0b7a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/router", "purl": "pkg:npm/%40angular/router@19.2.21-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2", "version": "19.2.21-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:9f5dd11c-7a59-513b-a1e7-20cbdfa5aa52", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.2 of @angular/router. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI...", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:5984a00b-04cb-59da-a782-ece19d06124e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:06f16b90-f78c-5197-ab72-8af03a5af3ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:021a0ff8-9cce-5b91-a8e3-9c02e76d6f11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:aafe4bfc-02f4-5bce-972e-1aba567e892e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:b41661dd-1ba8-508d-bc72-ec634b3db6b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:f504acdb-16c0-525b-b27f-476e1c65d911", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:e8b5ccfb-0396-5d42-9994-062c7b4f380d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:16b4b8cd-c0e3-558b-832d-efd024100e19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:0b31db55-7759-5adf-8bc2-e401f7630d00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:35646ccf-b9db-5a4d-828b-e0df90877cf8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:c08584ca-37f5-5e6d-a1e4-800d36475c40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:b177afef-cab6-5217-8468-dd09581e87c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:f3b6b4a4-2bd1-5d77-b20d-bb0dc68f944d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:c13c2bbd-d641-5e97-b8c3-1532c14bf323", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:1e0eb6b4-b014-5541-8334-214c38388dbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:352860e8-d3fb-5c64-a591-7f5c1e64d0c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.5." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:5acbd9d4-26ec-5b75-9a64-164c0af71906", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.5." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:0f586325-0095-5d27-a440-f44509e8ce64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 19.2.21-tuxcare.2 of @angular/router, and is fixed in 19.2.21-tuxcare.5." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:5499a2a0-7240-5ebc-a3b8-85ea8cd1d19b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 19.2.21-tuxcare.2 of @angular/router. not_affected \u2014 CVE-2026-88056 does not affect this Angular v19.2.21-tuxcare.5 target. The CVE describes a vulnerability where `String.prototype.trim()` strips Unicode whitespace (U+00A0, U+FEFF) from URLs during SSR, converting same-origin relative paths into cross-origin protocol-relative URLs that leak credentials. The v19.2.x branch uses a simpler URL resolution implementation created by TuxCare (commit 81...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:109e1343-f464-51c6-96db-296b253ac8ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 19.2.21-tuxcare.2 of @angular/router." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:04fc6ccb-0f57-5c98-9b21-b21686dbfd66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 19.2.21-tuxcare.2 of @angular/router." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:9469b08c-caf8-508f-b25a-19443263d28b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 19.2.21-tuxcare.2 of @angular/router." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.2" } ] }