{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:460dc97a-b1e7-5a04-b7c4-9b96bc1bc86b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/service-worker", "purl": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6", "version": "16.2.12-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8967cd22-5773-5514-9f35-a4a8b0ad90a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:38fb44b8-323c-5c02-a41d-f232ad6150fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c2eea248-67c9-59ec-a1bc-c56e36660129", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:eb9bc2d0-3c40-5722-8ff6-a2bd009685e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7ecd96fe-e8dc-5249-a08a-54a5a5c08c86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.8." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ae9d97c7-d82c-539b-996a-da2af20ebce0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.10." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a0cfff67-1ceb-5119-a0da-9edc1b8a574d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:be560cf7-4a87-5ca6-9183-649dcfa430a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8517726a-a7cd-5fc5-9072-ab699dbfa666", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:60832ec8-a5cf-5fd3-b540-11e122655f7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a977223a-fcdf-56a5-aa7c-3d9cbb713bc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cb2a351f-5a1f-5760-94b9-b38b0b3f1697", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d3d70671-4b84-5fdd-9051-7e9916e56cc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:09a2c4e3-ce7b-5a14-afa4-5fc82293395d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:bdf5abb2-cb05-5323-be01-ddb6a96b954f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9425d5e9-e98b-5e0f-be21-92aa19055da8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a1fa6139-82c5-56aa-bb3b-01a56bd8cc83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4ef6213a-2c17-5d05-a64d-4416cd18e81a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f5c75a5f-22da-5674-aa26-28e2f6ffe746", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7743a994-56f3-53e4-913a-ebecb222e60a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:80d92a12-94c5-5543-9342-a9c07252a0ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9b921209-c049-5a22-a711-aaacfc627e7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4ef2a889-a637-5624-894f-c890b0beec8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.6 of @angular/service-worker, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7ba1b86f-dba2-593a-89ba-674f2b6224b4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.6 of @angular/service-worker. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:69c9d087-1b87-5a58-b00a-2ad8a5a5500f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:317d6521-39d9-541c-9581-8d6f1b522719", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8be169b4-aced-54a8-95ea-a5a0c69b8b27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.6 of @angular/service-worker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@16.2.12-tuxcare.6" } ] }