{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0a43bc2b-1432-5d6f-a870-2a7cd4136a4e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/router",
      "purl": "pkg:npm/%40angular/router@8.0.3-tuxcare.7",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/router@8.0.3-tuxcare.7",
      "version": "8.0.3-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/router",
            "purl": "pkg:npm/%40angular/router@8.0.3",
            "type": "library",
            "version": "8.0.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-101896",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@8.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:992d1823-3d88-5640-9f3e-8ff06897e6ff",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101896 affects version 8.0.3-tuxcare.7 of @angular/router."
      }
    },
    {
      "id": "CVE-2026-111751",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@8.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:5360321a-1178-555b-afad-f83cd94dcbfe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-111751 does not affect version 8.0.3-tuxcare.7 of @angular/router. not_affected \u2014 Angular 8.0.3 is not affected by CVE-2026-111751. The vulnerability requires signals-based computed caching of UrlTree instances introduced in Angular v21.2.0. Version 8.0.3 predates both Angular signals (introduced in v16) and the vulnerable refactor. The target's RouterLink implementation uses simple getters that create UrlTree on-demand without caching, already matching the fixed behavior de...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-111752",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@8.0.3-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:5eba3317-99ff-5916-a9a3-91ff0bf6bb61",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111752 affects version 8.0.3-tuxcare.7 of @angular/router."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/router@8.0.3-tuxcare.7"
    }
  ]
}