{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:452666cb-94e0-54d9-8067-972d3442dea4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/service-worker", "purl": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6", "version": "5.2.11-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:79310103-71f3-5a25-b91a-459e59f73baf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:459f0dd4-8f9b-5722-a2ed-1b715da8732e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.9." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b8333fd3-0983-5721-950d-642a2ae4a302", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:be79716f-8cc0-57b6-bc75-1f2080142436", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:73073f27-2334-5710-825b-5c89b2e97cc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:eff66fab-9df1-5725-8b23-afe965f7cae6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b66f67c4-b0a7-523a-a6c0-4603c308524c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9a75f8f5-b940-5570-9386-4230cc5adbaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9cf5419d-e568-5414-a04f-b9a3a4a9a570", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b4522946-b67b-54fb-a4ae-f71797401061", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9efad81c-a6e4-50b2-9e4a-9e067c7fc613", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e578bdbc-c23e-5b07-98ed-9621c3575913", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4f84bb70-7d7b-5acd-b01d-ff656e8b5455", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:fa8dc089-2d59-5de2-91bc-171475b46dff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2474de84-f1ea-5575-9406-da0d0809c035", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1898a5a5-6ca1-5184-ad01-61360124351a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c4e409dd-4762-56d0-93e6-a92124d12343", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:81bb4e29-ad42-5b4b-9e3d-4613c7613a5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:436ab8d1-9454-5683-a9e4-cedee2c154d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6bb13fd4-1515-5504-bade-dd5c12def0c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e5210b55-095e-56f5-8b4a-536b87536f6d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.6 of @angular/service-worker. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:14bb8adc-58ae-5c34-aac1-a912260c0652", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:61288536-9262-5f97-b5a4-cea4e5acee0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 5.2.11-tuxcare.6 of @angular/service-worker, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6e6af0d0-a92d-59cd-b7fe-971a0dd55599", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.6 of @angular/service-worker. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ebcc989e-76ab-515c-98c3-396e069be4ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.6 of @angular/service-worker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:7296c2e4-ad44-56bd-ae84-ada59e7489af", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.6 of @angular/service-worker. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e8241d86-2190-5955-a5d6-e453cc8db2ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.6 of @angular/service-worker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@5.2.11-tuxcare.6" } ] }