{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:36ecd7ca-ce46-52e1-aa83-7580c6db6c23",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/router",
      "purl": "pkg:npm/%40angular/router@14.3.0-tuxcare.13",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/router@14.3.0-tuxcare.13",
      "version": "14.3.0-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/router",
            "purl": "pkg:npm/%40angular/router@14.3.0",
            "type": "library",
            "version": "14.3.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-101896",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@14.3.0-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:231f1757-22b4-538d-b209-7751ab7feb58",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101896 affects version 14.3.0-tuxcare.13 of @angular/router."
      }
    },
    {
      "id": "CVE-2026-111751",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@14.3.0-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:62e2eb15-aa11-502b-a6d3-59d2310fdf80",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-111751 does not affect version 14.3.0-tuxcare.13 of @angular/router. not_affected \u2014 Angular 14.3.0 is not affected by CVE-2026-111751. The vulnerability was introduced in v21.2.0 when RouterLink was refactored to use computed signals that cached UrlTree instances. Angular 14.3.0 predates this refactoring by several major versions and uses simple getters that create UrlTree instances on-demand without caching them. The Signals framework itself doesn't exist in Angular 14.3.0 (i...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-111752",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@14.3.0-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:7b7fc4e2-dbdd-5c04-af3d-93c53ccffb69",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111752 affects version 14.3.0-tuxcare.13 of @angular/router."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/router@14.3.0-tuxcare.13"
    }
  ]
}