{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:187c861c-1e75-5301-9f5d-8f61164e1004", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-webworker", "purl": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8", "version": "7.2.11-tuxcare.8", "pedigree": { "ancestors": [ { "name": "@angular/platform-webworker", "purl": "pkg:npm/%40angular/platform-webworker@7.2.11", "type": "library", "version": "7.2.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:000599bc-86a8-53fd-8b7e-1a84a8c92f96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:aab085b5-ef39-5e98-b880-40ee9ce16607", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:631fc458-cea8-5b58-80f0-3a5b74e9eec5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:290cfc0d-bfce-5539-83b8-a3fb4dd2dbf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:c6891860-f9b0-5c8b-88e7-b949a39ba333", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:dccabce0-3cbe-5cdd-b5f3-e68a589a225b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:c60707b2-3ee2-5008-a8bb-9842abdd52e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:a364b775-1c33-5699-b20e-064d0f1eaa00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:f0c48aac-bb4d-5208-ba3d-cff4e7fd2b6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:82c0ae8e-9162-581f-9faf-3da72b70eec4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50168 does not affect version 7.2.11-tuxcare.8 of @angular/platform-webworker. not_affected \u2014 CVE-2026-50168 addresses vulnerabilities in the WHATWG URL-based parseUrl implementation and allowedHosts validation feature introduced in Angular's CVE-2026-41423 fix. The target (v7.2.11) uses a completely different architecture with Node.js legacy url.parse() and does not have the allowedHosts feature. The specific vulnerable code patterns that CVE-2026-50168 patches do not exist in this ver...", "justification": "code_not_present" } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:950ae5c0-3990-5016-9d2c-c0177db96117", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:376819bf-a58e-5fb2-95e2-5f51c2237217", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 7.2.11-tuxcare.8 of @angular/platform-webworker. not_affected \u2014 Angular v7.2.11 is not affected by CVE-2026-50170. The HTTP Transfer Cache feature that is vulnerable does not exist in this version. The feature was introduced in Angular v16+, and v7.2.11 lacks the transfer_cache.ts module, withHttpTransferCache provider, and provideClientHydration functionality entirely.", "justification": "code_not_present" } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:beec0b48-5530-5136-a010-1ee8f9e4cfda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:bc943652-7e21-5ea9-9655-dc1d1acb615d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:60720686-620b-5d50-bebc-70bbf9cca73b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:ac0c47fa-e574-55ed-909b-db0d8235a824", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:50de22ea-7d32-5888-bb30-3f3a058288cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:dab015d9-fd31-5b6f-94fc-abda22eae917", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:d4652248-22b9-5337-9bb9-a856b95b1c81", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 7.2.11-tuxcare.8 of @angular/platform-webworker. not_affected \u2014 Angular 7.2.11-tuxcare.2 is not affected by CVE-2026-54264. The vulnerability concerns sensitive header leakage on cross-origin redirects in the request metadata preservation feature. This version predates that feature entirely - it strips ALL request headers when making network requests for assets, as evidenced by code comments and the absence of the newRequestWithMetadata method introduced in...", "justification": "code_not_present" } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:3f113588-5806-5e3d-9663-34f2e84c116d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 7.2.11-tuxcare.8 of @angular/platform-webworker. not_affected \u2014 Angular 7.2.11-tuxcare.2 uses View Engine compiler architecture, not Ivy. The vulnerability (CVE-2026-54265) is specific to Ivy's template compiler pipeline where TwoWayProperty operations were missing from the sanitizer resolution switch. View Engine does not have TwoWayProperty operations; two-way bindings desugar early in the template parser to the same parsePropertyBinding() code path as on...", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:313541ca-0c31-5643-8822-9c555721d28b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 7.2.11-tuxcare.8 of @angular/platform-webworker. not_affected \u2014 Angular 7.2.11-tuxcare.2 is not affected by CVE-2026-54266. The HttpTransferCache feature that contains the weak hash vulnerability does not exist in this version - it was introduced in Angular 16.", "justification": "code_not_present" } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:0af3d45e-f40a-5275-8b78-aef3e7b9911a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:826a8a23-7c81-5263-b8a3-d9acce2f7a0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:39f14f90-693a-50c5-bcf7-e004410de199", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.11-tuxcare.8 of @angular/platform-webworker. not_affected \u2014 Angular v7.2.11-tuxcare.3 is NOT AFFECTED by CVE-2026-68945. The vulnerability affects Angular's `HttpTransferCache` feature, which caches HTTP requests during Server-Side Rendering (SSR) for client-side hydration. This feature did not exist in v7.2.11 \u2014 it was introduced in Angular v16. The vulnerable file `packages/common/http/src/transfer_cache.ts` is absent from the target SHA (8c4c3a453736...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:de58cb8c-d43d-5452-aae5-9e5defcda645", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:a6a70c7e-3e10-58b0-9fd7-146ad3c966f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:275600fa-c531-5191-bb01-b09b1293ba1b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.11-tuxcare.8 of @angular/platform-webworker. not_affected \u2014 Angular 7.2.11 is not affected by CVE-2026-88056. The vulnerability requires calling String.prototype.trim() on URL strings before WHATWG URL parsing, creating a discrepancy that enables SSRF. This vulnerable code pattern was introduced in Angular 14+ with a new url.ts file containing parseUrl() that called .trim(). Angular 7.2.11 uses a different parseUrl() implementation in location.ts that d...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:1a89ce3f-191b-5a7f-a94c-5f5e3698baa3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:b06d7cff-b058-55af-ac2a-27566fc417a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:42dac51c-a70a-595e-bfb9-01d97b29e0de", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.11-tuxcare.8 of @angular/platform-webworker. not_affected \u2014 Angular 7.2.11 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache interceptor and hierarchical HttpClient configuration APIs (withRequestsMadeViaParent, provideHttpClient) that were introduced in Angular 14+ and do not exist in this version. While TransferState exists in 7.2.11 as a basic SSR state transfer mechanism, there is no automatic HTTP response caching to T...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:f68ee485-f106-5f37-b081-c494c17d10b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 7.2.11-tuxcare.8 of @angular/platform-webworker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.8" } ] }