{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:df1c0db5-ef32-5924-9d2d-1bd716b64ac6",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/service-worker",
      "purl": "pkg:npm/%40angular/service-worker@12.2.16-tuxcare.5",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/service-worker@12.2.16-tuxcare.5",
      "version": "12.2.16-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/service-worker",
            "purl": "pkg:npm/%40angular/service-worker@12.2.16",
            "type": "library",
            "version": "12.2.16"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@12.2.16-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:5a3106a3-0e11-5a06-b49c-a0634284738d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50169 affects version 12.2.16-tuxcare.5 of @angular/service-worker, and is fixed in 12.2.16-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@12.2.16-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:916ac091-8763-55ee-9e82-8e9c8e18c9e1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 12.2.16-tuxcare.5 of @angular/service-worker."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/service-worker@12.2.16-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:09c54391-48b2-5da7-8f50-e22abf675e2e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54264 does not affect version 12.2.16-tuxcare.5 of @angular/service-worker. not_affected \u2014 Angular 12.2.16-tuxcare.2 is NOT affected by CVE-2026-54264. The vulnerable code pattern does not exist in this version. The service worker creates fresh requests using only the redirect URL without copying any headers from the original request, preventing credential leakage to third-party origins on cross-origin redirects.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/service-worker@12.2.16-tuxcare.5"
    }
  ]
}