{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:aa221e01-c7a5-558e-96e9-b23acebcc6e7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/router",
      "purl": "pkg:npm/%40angular/router@19.2.21-tuxcare.6",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.6",
      "version": "19.2.21-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/router",
            "purl": "pkg:npm/%40angular/router@19.2.21",
            "type": "library",
            "version": "19.2.21"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-101896",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:7cd55d96-d2cb-5428-b225-befb0a238244",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101896 affects version 19.2.21-tuxcare.6 of @angular/router."
      }
    },
    {
      "id": "CVE-2026-111751",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:feb6cf8c-88bd-5bde-b5da-b4483aec5b5b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-111751 does not affect version 19.2.21-tuxcare.6 of @angular/router. not_affected \u2014 Angular v19.2.21-tuxcare.9 is not affected by CVE-2026-111751. The vulnerability was introduced in v21.2.0 when RouterLink internals were refactored to use Angular signals with computed caching of UrlTree instances. Version 19.2.21 predates this refactoring and uses the traditional on-demand UrlTree computation pattern without persistent caching, which is the same pattern the security patch res...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-111752",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:599e4e4f-b989-52b8-8bb8-3fdfa46402d5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111752 affects version 19.2.21-tuxcare.6 of @angular/router."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/router@19.2.21-tuxcare.6"
    }
  ]
}