{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:28a5a0e3-39fc-5895-999c-85e44cb824b8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/service-worker",
      "purl": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6",
      "version": "19.2.21-tuxcare.6",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-27970",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:77239eaa-3209-5836-843f-472fb71fc11b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.6 of @angular/service-worker. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:0fe9be05-c2f9-53b9-b9cd-02159d2d6b63",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:301a23dc-b06d-50b0-8ee9-dfde97ccdc5a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50168 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4cc82313-acea-55d3-a67c-3a2284f2a54e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50169 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:00a1d177-95d7-5d78-8706-4b54522793a3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50170 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:7ea59c95-6aaa-5be8-a802-0ca2181f554a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:12aac65c-deb9-5e99-bb98-d5dbdd7d2f3e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:0021a30d-9b1b-5862-bd88-61f3500d0ad2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:a6ed4496-de64-5607-b0ab-95fc1f2de04d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-50557",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:a203b9d7-fea9-534a-ba09-8001488c9114",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50557 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-52725",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:ba473ea6-5176-5b12-823a-ceb84dc5a7e1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-52725 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:135f8a0a-efc6-5bd8-a00e-67659c7e810d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54264 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-54265",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:48567796-97d6-5c65-a91e-61f6087d1bb0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54265 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:5e219232-e6a1-5f8b-b7ff-4eee209f3cce",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54266 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-54267",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e54f2d5f-7b86-5ee5-a718-8f49ebcfe69f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54267 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:829b46ae-b730-5504-80bd-9bb43f907c42",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:0da7a980-11e8-5efd-8a37-9f20da495844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-68945 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:c9e03b0e-f10c-5a61-9f8c-fce96845fbfd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69149 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-69151",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:1445e289-0dbf-5bfa-812f-d8c1e97c5feb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69151 is fixed in version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:a429a1a5-f519-5db6-863e-4bc9d56bfbeb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 19.2.21-tuxcare.6 of @angular/service-worker. not_affected \u2014 CVE-2026-88056 does not affect this Angular v19.2.21-tuxcare.5 target. The CVE describes a vulnerability where `String.prototype.trim()` strips Unicode whitespace (U+00A0, U+FEFF) from URLs during SSR, converting same-origin relative paths into cross-origin protocol-relative URLs that leak credentials. The v19.2.x branch uses a simpler URL resolution implementation created by TuxCare (commit 81...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-88057",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e0654924-4472-5067-979d-652d25692fb0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88057 affects version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:3c6bd433-36e7-552b-b74a-93f2827bc93d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88059 affects version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f38291a0-0a34-5938-bb0d-1ac965107c94",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88060 affects version 19.2.21-tuxcare.6 of @angular/service-worker."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/service-worker@19.2.21-tuxcare.6"
    }
  ]
}