{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1078b94d-d14e-51d0-b837-6c72c5c4560e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/router",
      "purl": "pkg:npm/%40angular/router@19.2.14-tuxcare.2",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/router@19.2.14-tuxcare.2",
      "version": "19.2.14-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/router",
            "purl": "pkg:npm/%40angular/router@19.2.14",
            "type": "library",
            "version": "19.2.14"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-101896",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@19.2.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0194c676-247b-5bd5-87f3-a3688acb9b11",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101896 affects version 19.2.14-tuxcare.2 of @angular/router."
      }
    },
    {
      "id": "CVE-2026-111751",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@19.2.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:94310d6e-fb56-5020-9de9-cfe5f5995bcb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-111751 does not affect version 19.2.14-tuxcare.2 of @angular/router. not_affected \u2014 Angular 19.2.14-tuxcare.7 is NOT affected by CVE-2026-111751. This DoS vulnerability was introduced in Angular v21.2.0 when RouterLink was refactored to use signal-based computed properties that cache UrlTree instances. The CVE explicitly states that versions prior to v21.2.0 (including v19.x, v20.x, v21.1.x) do not retain UrlTree instances and are not vulnerable. The target version uses a trad...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-111752",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@19.2.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9acacf9d-9a47-515c-8e79-8de0538f0366",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111752 affects version 19.2.14-tuxcare.2 of @angular/router."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/router@19.2.14-tuxcare.2"
    }
  ]
}