{
  "@id": "urn:uuid:d6d1b129-d722-4f9b-93e5-76d3ed5daeef",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:23:37.766436+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/service-worker@5.2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/service-worker@5.2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T05:00:00.246665+00:00",
      "status_notes": "Vulnerability CVE-2026-50169 affects version 5.2.7-tuxcare.2 of @angular/service-worker, and is fixed in 5.2.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50169"
      },
      "action_statement": "Vulnerability CVE-2026-50169 affects version 5.2.7-tuxcare.2 of @angular/service-worker, and is fixed in 5.2.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/service-worker@5.2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/service-worker@5.2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T05:00:00.246665+00:00",
      "status_notes": "Vulnerability CVE-2026-50184 affects version 5.2.7-tuxcare.2 of @angular/service-worker, and is fixed in 5.2.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50184"
      },
      "action_statement": "Vulnerability CVE-2026-50184 affects version 5.2.7-tuxcare.2 of @angular/service-worker, and is fixed in 5.2.7-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/service-worker@5.2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/service-worker@5.2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T05:00:00.246665+00:00",
      "status_notes": "Vulnerability CVE-2026-54264 does not affect version 5.2.7-tuxcare.2 of @angular/service-worker. not_affected \u2014 Angular v5.2.7 is NOT affected by CVE-2026-54264. The service worker's asset-group request reconstruction uses URL-only rebuilding via adapter.newRequest(req.url), which creates fresh Request objects with no headers from the original request. Since headers are never forwarded in the first place, there is no opportunity for sensitive headers to leak on cross-origin redirects. The vulnerable code...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54264"
      },
      "impact_statement": "not_affected \u2014 Angular v5.2.7 is NOT affected by CVE-2026-54264. The service worker's asset-group request reconstruction uses URL-only rebuilding via adapter.newRequest(req.url), which creates fresh Request objects with no headers from the original request. Since headers are never forwarded in the first place, there is no opportunity for sensitive headers to leak on cross-origin redirects. The vulnerable code..."
    }
  ]
}