{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3e70dde1-8054-5ca1-aa77-3e2e55b3ac25", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3", "type": "library", "name": "@angular/service-worker", "version": "15.0.3-tuxcare.3", "purl": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:6600f6d1-b0dd-5f69-9db2-f29ff3021d41", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2b59d56e-2787-5bdb-8ce5-b855deba90bc", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b45b955b-875d-5f3f-bc06-37a82e0f2342", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a0137ddb-60f4-5b48-9139-f450f82b0df3", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1085873f-29ae-536c-b756-4bcb66080f29", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:78375c58-266c-5667-8524-b8a8996e40f0", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:86f07491-ea2d-54be-bdfc-c61da97e9644", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5f5bf5d5-f600-5444-97b0-9994afa25f55", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:df77ef22-8416-58d4-955b-c8eed4917c39", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.0.3-tuxcare.3 of @angular/service-worker. not_affected \u2014 Angular 15.0.3-tuxcare.1 is NOT affected by CVE-2026-50170. The HTTP TransferCache feature that is vulnerable in later Angular versions (v16+) does not exist in this version. The vulnerable code (transfer_cache.ts, hasAuthHeaders(), shouldCacheRequest(), withHttpTransferCache, provideClientHydration) is absent from Angular 15.0.3." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:da45fc8e-df70-5c0e-8ee7-f7e8c3b8ee4c", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0f14218d-3bab-5abd-ad50-afa99d9539fa", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e1205629-f378-5ac9-a3e3-c8060b16e34a", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:99b6d255-d5d0-5048-9ce3-8d0737098f8c", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c9783358-0e22-5972-9e41-00ec427d25ed", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ee08f3a6-1597-5c02-b7cd-c8e1882bd7be", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:71eebac0-8689-58ab-9690-3f522ab7c287", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f87fb4a0-e85e-5ef0-b8cb-c9afb80d4229", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.0.3-tuxcare.3 of @angular/service-worker. not_affected \u2014 Angular 15.0.3 is NOT AFFECTED by CVE-2026-54265. This version uses a different compiler architecture where two-way bindings desugar through the same code path as one-way bindings, both receiving identical security context resolution and sanitizer assignment. The vulnerable code (Ivy template pipeline with separate TwoWayProperty operation type) does not exist in this version." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:22b64c67-ad5d-5751-be20-4d11e15e50ac", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.0.3-tuxcare.3 of @angular/service-worker. not_affected \u2014 Angular v15.0.3-tuxcare.1 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache keys does not exist in this version. This feature was introduced in Angular v16+. The target has no code path from HTTP request handling to the vulnerability's cache poisoning goal." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ff2517f3-a2ce-5ab2-86ae-5c0c403e450b", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:228d5d44-615d-5db6-90da-c5998a095e35", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.0.3-tuxcare.3 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.3" } ] }