{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c3e08946-ac6d-5024-b7ea-70db76920601", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/router", "purl": "pkg:npm/%40angular/router@16.2.11-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3", "version": "16.2.11-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:19b41aa9-5871-5408-ac7a-7fa04acac5ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:89ec1845-7ff8-5606-b8e5-b22d26e8c34f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:870bc717-db79-510b-9e5b-385af1c69e7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:3d9ffc27-2f96-542b-a3fa-324542a40b20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:6d39bd76-0da2-5f0b-aedc-09df74c663d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:a91064db-09dd-52f2-8d15-9fb97da7d7d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:5e3198ad-3d4a-5e7d-9480-ca2e25e6bee2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:41199343-ad11-5a24-9864-7292a6105f16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:dceb58ca-f9c6-590f-9f71-cf8a55e196da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:93348a85-54d9-56ef-89a8-8ef8f1d15ac0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:685d375b-42ce-55d2-8c3a-56d3cc34be7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:7c553a31-2d34-5fe5-817b-6c089aa6d4bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:6251f100-e586-53b0-ba5b-b29e2a5049a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:37c42c1f-2087-5145-a4af-4dfcf42d3815", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:afe12214-459c-572d-b667-44b8336bf865", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:76f56ad7-cd8b-5597-aec2-b90a9dee177b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:432b88fd-08b7-5f11-8653-5018973b9e95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:f4bb5dd6-ed0c-53e6-bd12-5f2a3d20cbc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:981f136d-708a-5bbd-bc74-5d4c80b6f6b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:aea8bfb9-1c6d-57a0-9d8d-24b8441d09ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:ca96eb62-ecbb-54e5-9ff7-59c5d547c3f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:2cee64b8-d412-549c-851d-a0a7c0f4ca78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:cdbb51db-8c27-5beb-b63c-0657d3b62b14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:93d489a1-9e7c-59bb-a285-ab83b58f985b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:48ce1831-fdc0-552f-ab40-b124b6746e5c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.3 of @angular/router. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:4c39b030-f7c9-5ffe-87f7-75678d935185", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:6044d539-5cc0-5fe9-baa4-542c0ad07828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.11-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:fe1106eb-a899-5d9e-a3e0-ba3c4ac64457", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.11-tuxcare.3 of @angular/router." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/router@16.2.11-tuxcare.3" } ] }