{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0da325c3-12a6-56f9-8d02-2c467d39f41d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/router",
      "purl": "pkg:npm/%40angular/router@8.2.14-tuxcare.13",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13",
      "version": "8.2.14-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/router",
            "purl": "pkg:npm/%40angular/router@8.2.14",
            "type": "library",
            "version": "8.2.14"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-101896",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:ad213c7e-d992-5fc2-be39-8abc59a26f2b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101896 affects version 8.2.14-tuxcare.13 of @angular/router."
      }
    },
    {
      "id": "CVE-2026-111751",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:63638575-1c8b-531b-9e80-f9dd479bd424",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-111751 does not affect version 8.2.14-tuxcare.13 of @angular/router. not_affected \u2014 Angular 8.2.14 is not affected by CVE-2026-111751. The vulnerability was introduced in Angular v21.2.0 when RouterLink was refactored to use a cached computed signal (_urlTree) that retained UrlTree instances and their query parameter dictionaries in heap memory for the lifetime of each directive instance during SSR. Angular 8.2.14 predates this refactoring by many years and uses the traditiona...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-111752",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:b599352f-d3d3-5989-aa85-5f4c65fd64b3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111752 affects version 8.2.14-tuxcare.13 of @angular/router."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/router@8.2.14-tuxcare.13"
    }
  ]
}