{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:607fd890-735a-5f74-9447-74450d7f2d7c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/service-worker", "purl": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7", "version": "8.2.14-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:71cdf8e2-1848-558e-9fd2-9a5de86ff282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.7 of @angular/service-worker." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:0d4acce5-5f89-5264-89a8-1937b731ae8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:28ec029d-9917-5b57-8e90-b312222b9c33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.7 of @angular/service-worker." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:b868a646-a477-545d-b3e4-1ff54876b918", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.7 of @angular/service-worker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:00e8c799-c2fa-57ba-9850-34704d7dfc57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.7 of @angular/service-worker." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:cb3468de-930f-50f0-a6f5-0fb9be1ba800", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:175df468-cfe7-59a3-9a90-3b999d8484a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:7ba37e46-92af-5351-8f77-004da4261f24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:83c36bdf-78ea-540e-a182-52226afe0f5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:e17a5bff-0dd5-5f89-8d3d-7d26fee0d45d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:aca7fe6f-dcaa-5d3f-a1ab-d083a0aff063", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:98f45a2f-df7a-56a4-a626-0c51b2b6089d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:162f11f5-2d43-5411-bb86-47d183befe63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:5e9fa6e0-f3e7-5a6e-9da3-2c7b92c43349", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:20b6e1bd-a0e6-58a6-b09d-1eac1e5e1575", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:757b6099-930b-506b-8211-2a8fac6a9a35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:68bb3a23-42d0-5a83-a252-705e56c0351d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:853f953a-c91e-5124-ba0d-2c57032d1602", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:6bca56ae-6040-5943-ab67-dbfd1d7d1dcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:ff466c93-5a6c-582d-8fcb-e2ee6029bbf7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:e0e4860f-0132-5f79-b9fa-2888c24ea3a5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.7 of @angular/service-worker. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:6ead1547-fb01-5e80-8f3f-f80fa7659e22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:df41c3eb-2e6f-5612-a9e9-1ea8ca98fcd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 8.2.14-tuxcare.7 of @angular/service-worker, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:018ef95d-7f0b-53b0-8a2b-79ef09b64c2d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.7 of @angular/service-worker. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:f5c03bee-c377-5f0f-941f-315deacfe3bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 8.2.14-tuxcare.7 of @angular/service-worker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:cd2e07b5-44cd-5c43-9b58-d654b24ae391", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.7 of @angular/service-worker. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:9529e787-b060-5a0b-8df3-0d132a04dc5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 8.2.14-tuxcare.7 of @angular/service-worker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@8.2.14-tuxcare.7" } ] }