{
  "@id": "urn:uuid:7879db4e-055c-44fa-9760-6a2b77136e76",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:23:37.766436+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/service-worker@12.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/service-worker@12.2.0"
          }
        }
      ],
      "timestamp": "2026-10-25T10:52:00.208068+00:00",
      "status_notes": "Vulnerability CVE-2026-50169 affects version 12.2.0 of @angular/service-worker, and is fixed in 12.2.0-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-50169"
      },
      "action_statement": "Vulnerability CVE-2026-50169 affects version 12.2.0 of @angular/service-worker, and is fixed in 12.2.0-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/service-worker@12.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/service-worker@12.2.0"
          }
        }
      ],
      "timestamp": "2026-10-19T05:00:00.246665+00:00",
      "status_notes": "Vulnerability CVE-2026-50184 affects version 12.2.0 of @angular/service-worker, and is fixed in 12.2.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50184"
      },
      "action_statement": "Vulnerability CVE-2026-50184 affects version 12.2.0 of @angular/service-worker, and is fixed in 12.2.0-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/service-worker@12.2.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/service-worker@12.2.0"
          }
        }
      ],
      "timestamp": "2026-10-19T05:00:00.246665+00:00",
      "status_notes": "Vulnerability CVE-2026-54264 does not affect version 12.2.0 of @angular/service-worker. not_affected \u2014 The target repository (Angular 12.2.0-tuxcare.2) is NOT AFFECTED by CVE-2026-54264. The AssetGroup class in this version intentionally strips ALL request metadata (including headers) when fetching assets, creating fresh requests with only URLs. This architectural design prevents credential headers from being transmitted to any origin, including on cross-origin redirects. The vulnerable method '...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54264"
      },
      "impact_statement": "not_affected \u2014 The target repository (Angular 12.2.0-tuxcare.2) is NOT AFFECTED by CVE-2026-54264. The AssetGroup class in this version intentionally strips ALL request metadata (including headers) when fetching assets, creating fresh requests with only URLs. This architectural design prevents credential headers from being transmitted to any origin, including on cross-origin redirects. The vulnerable method '..."
    }
  ]
}