{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:77c76e6d-6d3f-5d78-9e41-35fdbd92f9a0",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5",
      "type": "library",
      "name": "@angular/service-worker",
      "version": "8.0.3-tuxcare.5",
      "purl": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:11826815-7b0c-535b-afca-6701a51f3f53",
      "id": "CVE-2021-4231",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:74826e44-f19c-5ff6-abd1-f0271a17156a",
      "id": "CVE-2025-66035",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b0ee912d-f36c-5fc8-8f4f-411053052aa9",
      "id": "CVE-2025-66412",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e846342e-8018-50b7-80d2-4f37d906a795",
      "id": "CVE-2026-22610",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:13c14f33-99d2-5300-9b02-c975c21d47fb",
      "id": "CVE-2026-27970",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c60797ff-28ff-5319-ba11-6a7d6cc91b8c",
      "id": "CVE-2026-41423",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41423 does not affect version 8.0.3-tuxcare.5 of @angular/service-worker. not_affected \u2014 The target Angular version 8.0.3 is not affected by CVE-2026-41423. The vulnerability requires WHATWG URL API (introduced in Angular 8.2.x+) to manifest the hostname override behavior. Version 8.0.3 uses Node.js legacy url.parse() which does not interpret protocol-relative URLs as having attacker-controlled hostnames."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:08d331f9-6127-5657-a933-32bb075d98d3",
      "id": "CVE-2026-46417",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7986301e-8024-58f9-be10-c130b1e79b57",
      "id": "CVE-2026-50168",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a35fde7c-97e5-5b17-8d85-1a041a75d30e",
      "id": "CVE-2026-50169",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ee8cbc66-79a5-552a-807b-7b4425795f76",
      "id": "CVE-2026-50170",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 8.0.3-tuxcare.5 of @angular/service-worker. not_affected \u2014 The target Angular v8.0.3 is NOT affected by CVE-2026-50170. The vulnerability requires the HTTP transfer cache feature (packages/common/http/src/transfer_cache.ts) and client hydration mechanisms, which were introduced in Angular v16+. This version lacks the entire affected component."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a5d7c560-57af-52b0-84c0-44d3188b0438",
      "id": "CVE-2026-50171",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0a1c64cf-8bf2-562d-9d54-d40f8c5fdb43",
      "id": "CVE-2026-50184",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:25de73f1-9ea5-533e-97c6-3a83c04c9aaa",
      "id": "CVE-2026-50555",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b9da4684-be78-5e52-bd62-7dfb99a58111",
      "id": "CVE-2026-50556",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:30eabbf9-bd27-5bfb-a82b-3713906ceafc",
      "id": "CVE-2026-50557",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c7393672-21d3-5ee1-94ee-e7cec24d63d7",
      "id": "CVE-2026-52725",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e046e6ea-3d13-5daf-bd5e-cd3c2f5aafa1",
      "id": "CVE-2026-54264",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54264 does not affect version 8.0.3-tuxcare.5 of @angular/service-worker. not_affected \u2014 The target Angular service-worker version 8.0.3-tuxcare.4 is NOT AFFECTED by CVE-2026-54264. The vulnerability requires the service worker to copy and forward request headers during cross-origin redirects. This version never copies headers: the AssetGroup path creates fresh requests from URLs only (no header preservation), and the DataGroup path delegates to the browser's spec-compliant fetch A..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:11454155-129a-56ab-af3f-bcde7f11cd87",
      "id": "CVE-2026-54265",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:38d8245e-6961-546e-8df0-bb314f4d90e6",
      "id": "CVE-2026-54266",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 8.0.3-tuxcare.5 of @angular/service-worker. not_affected \u2014 Angular 8.0.3-tuxcare.4 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with its weak DJB2 hash-based cache key generation does not exist in this version. HttpTransferCache was introduced in Angular v16+, while this target is v8.0.3."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:01e3c310-8f12-5592-b05a-dc10619100f1",
      "id": "CVE-2026-54267",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ed82941b-7391-5e4c-a59a-09d6f53d073e",
      "id": "CVE-2026-54268",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.0.3-tuxcare.5 of @angular/service-worker."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/service-worker@8.0.3-tuxcare.5"
    }
  ]
}