{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:85c4395e-1771-5a1c-809f-a4cb1a6c8902",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/common",
      "purl": "pkg:npm/%40angular/common@5.1.0-tuxcare.6",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/common@5.1.0-tuxcare.6",
      "version": "5.1.0-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/common",
            "purl": "pkg:npm/%40angular/common@5.1.0",
            "type": "library",
            "version": "5.1.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:a8617044-bffe-5fef-aa3b-d6ab78d0c869",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.1.0-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-111753",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:a820baf3-3d76-53aa-9df1-f50549540aff",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111753 affects version 5.1.0-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:965dd2d1-ed0a-565d-a7a6-b6f4cfb40438",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 5.1.0-tuxcare.6 of @angular/common. not_affected \u2014 Angular 5.1.0 is not affected by CVE-2026-50170. The vulnerability exists in the HTTP Transfer Cache feature, which was introduced in Angular 16+ and does not exist in this version. While Angular 5.1.0 supports HTTP requests with Cookie headers and withCredentials flags, it lacks the transfer cache mechanism that would cache and reuse these responses during SSR hydration, making the attack chai...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:29bd4c1e-b41a-51ea-9650-b06226e0c13a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.1.0-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:7c893816-f3c0-55e6-99b8-5b32a853f729",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 5.1.0-tuxcare.6 of @angular/common. not_affected \u2014 Angular version 5.1.0 is NOT AFFECTED by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. There is no transfer_cache.ts file, no generateHash function using weak DJB2 hashing, and no mechanism to cache HTTP requests in TransferState using hash-based keys. The attack chain from HTTP requests to cache key collision cannot...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:becdf046-50b7-57e3-a21a-2c0eb2649147",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.1.0-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:53ceeeda-32df-5014-8bd6-dd4ba342459d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 5.1.0-tuxcare.6 of @angular/common. not_affected \u2014 Angular 5.1.0 is not affected by CVE-2026-68945. The vulnerable component HttpTransferCache does not exist in this version\u2014it was introduced in Angular v16. Without HttpTransferCache, the cache key collision vulnerability described in the CVE cannot manifest. This conclusion is supported by TuxCare's own security analysis of similar HttpTransferCache CVEs (CVE-2026-54266, CVE-2026-50170), which...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:20988131-19b3-50a5-b4ad-a5cfc7ad77df",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 5.1.0-tuxcare.6 of @angular/common. not_affected \u2014 Angular 5.1.0-tuxcare.4 is not affected by CVE-2026-88059. The vulnerability exists in the `HttpTransferCache` feature with hierarchical `HttpClient` configurations using `withRequestsMadeViaParent()`. This entire feature set\u2014including `HttpTransferCache`, the transfer cache interceptor, `withRequestsMadeViaParent()`, `provideClientHydration()`, and the modern hydration system\u2014was introduced in...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/common@5.1.0-tuxcare.6"
    }
  ]
}