{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b15ab9f2-e72d-5642-a0fd-3914d1148932",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/common",
      "purl": "pkg:npm/%40angular/common@8.0.0-tuxcare.6",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/common@8.0.0-tuxcare.6",
      "version": "8.0.0-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/common",
            "purl": "pkg:npm/%40angular/common@8.0.0",
            "type": "library",
            "version": "8.0.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:ba862cff-a56e-5f76-8a68-cc8ee557e315",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.0.0-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-111753",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e8445a70-6367-5346-af84-784f8bf0d689",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111753 affects version 8.0.0-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:65db83b3-3e43-599e-adf7-1a488eb86029",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 8.0.0-tuxcare.6 of @angular/common. not_affected \u2014 Angular v8.0.0 is not affected by CVE-2026-50170. The vulnerability requires the HTTP TransferCache feature (automatic caching of HTTP responses during SSR with client hydration), which was introduced in Angular v16+. Version 8.0.0 lacks the vulnerable code path entirely: no transfer_cache.ts, no transferCacheInterceptorFn, no shouldCacheRequest() function, and no automatic HTTP response cachin...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:0d343c3a-a16c-52b6-a088-4dca73ca44d3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.0.0-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:43247c1d-7507-565e-a952-d951ebc5cb6d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 8.0.0-tuxcare.6 of @angular/common. not_affected \u2014 Angular 8.0.0 does not contain the vulnerable HttpTransferCache feature. The CVE-2026-54266 vulnerability affects HttpTransferCache, which was introduced in Angular 9+. While this version has the underlying TransferState mechanism, it lacks the automatic HTTP request caching feature with the vulnerable DJB2 hash-based cache key generation.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:13892134-b3b6-5a2e-89ba-ddc2bd87900c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.0.0-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:777b322c-1d92-5d61-a0a8-1c6f52f24235",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 8.0.0-tuxcare.6 of @angular/common. not_affected \u2014 Angular v8.0.0 is NOT AFFECTED by CVE-2026-68945. The vulnerability concerns HttpTransferCache's cache-key generation creating collisions when HTTP request parameters use repeated keys vs scalar comma-separated values. However, HttpTransferCache does not exist in v8.0.0 \u2014 it was introduced in Angular v16. This version only has the manual TransferState API (a simple key-value store), with no aut...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:50614927-82f9-556b-8474-c9514dbdbb04",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 8.0.0-tuxcare.6 of @angular/common. not_affected \u2014 Angular 8.0.0-tuxcare.4 is NOT affected by CVE-2026-88059. The vulnerability requires HttpTransferCache (automatic HTTP response caching during SSR hydration), hierarchical HttpClient with withRequestsMadeViaParent() delegation, and the standalone API provideHttpClient() \u2014 all features introduced in Angular 16 or later. Angular 8 predates these features by approximately 7 years. While Angular 8...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/common@8.0.0-tuxcare.6"
    }
  ]
}