{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:be2b526e-6aa4-56fb-bf51-52384c03a216",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/service-worker",
      "purl": "pkg:npm/%40angular/service-worker@5.2.7-tuxcare.7",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/service-worker@5.2.7-tuxcare.7",
      "version": "5.2.7-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/service-worker",
            "purl": "pkg:npm/%40angular/service-worker@5.2.7",
            "type": "library",
            "version": "5.2.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@5.2.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:5bbcdf6d-0ad9-5ed1-91e1-b6bd8a3af887",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.7-tuxcare.7 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@5.2.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:28824fce-7623-599d-864b-c2b79e34e9ca",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.7-tuxcare.7 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@5.2.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9e55d75f-4d99-5280-8b49-71453e6cc1b9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54264 does not affect version 5.2.7-tuxcare.7 of @angular/service-worker. not_affected \u2014 Angular v5.2.7 is NOT affected by CVE-2026-54264. The service worker's asset-group request reconstruction uses URL-only rebuilding via adapter.newRequest(req.url), which creates fresh Request objects with no headers from the original request. Since headers are never forwarded in the first place, there is no opportunity for sensitive headers to leak on cross-origin redirects. The vulnerable code...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/service-worker@5.2.7-tuxcare.7"
    }
  ]
}