{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:66be4349-35bc-5cbf-b40c-9571a3977878",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/router",
      "purl": "pkg:npm/%40angular/router@5.2.11-tuxcare.21",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.21",
      "version": "5.2.11-tuxcare.21",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/router",
            "purl": "pkg:npm/%40angular/router@5.2.11",
            "type": "library",
            "version": "5.2.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-101896",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.21"
        }
      ],
      "bom-ref": "urn:uuid:8ed70a34-6337-51e2-9c5a-e09d7948ea04",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101896 affects version 5.2.11-tuxcare.21 of @angular/router."
      }
    },
    {
      "id": "CVE-2026-111751",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.21"
        }
      ],
      "bom-ref": "urn:uuid:494c90c7-0a9d-5a2e-8451-c240b9e1568c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-111751 does not affect version 5.2.11-tuxcare.21 of @angular/router. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-111751. The vulnerability was introduced in Angular 21.2.0 when RouterLink was refactored to use computed signals that permanently cache UrlTree instances. Angular 5.2.11 predates Angular's signals feature entirely (signals were introduced in Angular 16+) and uses simple getters that create UrlTree instances on-demand without caching. The target alread...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-111752",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.21"
        }
      ],
      "bom-ref": "urn:uuid:e4b03d7e-acbc-5aee-97b1-9784111d11d1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111752 affects version 5.2.11-tuxcare.21 of @angular/router."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/router@5.2.11-tuxcare.21"
    }
  ]
}