{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e4d0cacf-61a8-5f7b-abc3-96c0aa1e53c8", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2", "type": "library", "name": "@angular/router", "version": "13.3.12-tuxcare.2", "purl": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:2a1d7837-a139-5818-82d7-e050e0e39da7", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:803c3254-a391-58d2-bb23-401360e631b4", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5fd1e9ce-e189-544e-bad8-1eaab77ec76e", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:480fd6fd-d38a-598f-a42d-50fffa032a70", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b6c7ac74-f4bb-599d-963d-d465dc2a9895", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:08d4f2b1-253f-5eef-9257-7e2ff6b76ce3", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0a9d6dcf-2c7a-5d96-b451-628d26f14f9b", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f5618e5d-f1dd-5950-afc3-0a3773d31f7a", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e1ee8eb5-420e-580a-aa11-3f7eff941fc6", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 13.3.12-tuxcare.2 of @angular/router. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-50170. The HttpTransferCache feature that contains the vulnerability was introduced in Angular v16.0.0 (March 2023) and does not exist in this earlier version." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:273cd284-1c8b-5f4d-a4e4-2c373c38a86f", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4ef1b1bc-15f9-508d-9d47-e4a4a73208c2", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8286cd3e-cccd-5777-a387-8e079ba9d960", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8288c1e8-4c1c-56f9-a050-c15e1cda4afb", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1d636de5-adf7-5d6a-9653-4d48b1777596", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f7bc8f42-a783-5d97-b7b5-ba4821e461de", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:494e04b7-8153-5a4e-a77e-8fdede8c91d7", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 13.3.12-tuxcare.2 of @angular/router. not_affected \u2014 Version 13.3.12 does not have the vulnerable code pattern. The vulnerability exists in versions 20.x+ where the Service Worker's newRequestWithMetadata function preserves request headers but fails to strip sensitive headers on cross-origin redirects. Version 13.3.12 lacks this function entirely and creates fresh requests with URL-only when handling redirects, preventing header leakage." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:019b5c6c-4256-5780-96f1-0b26b4a177c0", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 13.3.12-tuxcare.2 of @angular/router. not_affected \u2014 Angular v13.3.12-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability is specific to the Ivy template pipeline architecture (TwoWayProperty operation) introduced in Angular v17+. This version uses an older Ivy architecture where two-way bindings desugar through the same sanitized property binding path as one-way bindings, preventing the sanitization bypass." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d12f4f82-25f1-58dd-8490-589ec0519b31", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 13.3.12-tuxcare.2 of @angular/router. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache key generation was introduced in Angular v16.0.0-next.7 (March 2023), which is 3+ major versions newer than this target version. Exhaustive code analysis confirms the transfer_cache.ts module, HttpTransferCache class, generateHash function, and all related cache key gener..." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7e260931-2023-5d09-ab3c-6dd0355aee22", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:56911119-28dc-5b80-8689-45ea982cec9d", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 13.3.12-tuxcare.2 of @angular/router." }, "affects": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/router@13.3.12-tuxcare.2" } ] }