{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bb972225-1b66-5b25-8081-7fefd3ed0ba9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11", "version": "12.2.17-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:1a44d7c9-48d2-5fbf-90ae-4fcbcd414c68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:d58e136e-ee24-5e13-a58c-e9fe6df1515b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:bc5ba43f-e08c-54e2-a0ce-90e0b478277e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 12.2.17-tuxcare.11 of @angular/bazel. not_affected \u2014 CVE-2026-101895 affects the domino HTML parser (lib/HTMLParser.js), not Angular's source code. The Angular framework repository declares domino as a dependency (package.json: \"domino\": \"^2.1.2\", yarn.lock: version 2.1.6), but does not vendor or bundle domino's source code. Exhaustive search confirms no HTMLParser.js or after_doctype_name_state code exists in the Angular repository. While Angula...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:6da5ee74-b98f-5791-8c28-9d71f31bfd02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:e2c992c4-7e83-5019-890b-26dbb81b76e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:e253df11-744b-5da2-92d6-942d97ee5043", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:69a57707-8d67-504a-9e77-f5a3d66d327e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:f7633db2-c1d8-5d9b-931b-1433c8347486", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:b39288dd-1204-5272-97c1-e616bfc38dcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:44d3e108-48cb-54a0-85c1-a20a5eca0cbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:aca005eb-bc57-562d-b925-b15dbd6c5ed4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:a0de7c4b-9fea-55f8-8727-d07ed061697d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:2682c6fd-0cd3-5fac-bc9e-aa8cb7bfef83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:4816cac6-bc81-5348-a671-d5251c046935", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:018d0ce0-08f8-5097-996a-ee7834b74244", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:fb3a943b-284c-52fc-8f25-1cf031587b7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:c747e0ff-0d54-54c5-853b-f3f8081d2c5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:45caf640-51d1-5230-a9e6-f166e56f0e66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:be0bdb44-fc9e-59a5-9eaf-34bc7c955271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:efa4f0c1-7f42-5952-8437-745d9878bbf1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:057a292c-ca64-5034-a980-acf92f1aeb68", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.11 of @angular/bazel. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:a0903d0b-cdea-53ef-891b-494aede642d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:d977487e-3042-5eea-ba8a-882562a35e85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:f53a9271-1080-5e03-b5a5-246048d64c56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88056 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:310fc5b2-84f5-5587-a4c8-2f3b0179a747", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:c00fa722-6440-5e4c-99b8-87dc4668fe5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:b85e75c3-dbe0-5cd1-b944-64c8937851c6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.11 of @angular/bazel. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ], "bom-ref": "urn:uuid:563b67eb-26af-5bed-b92c-c64ecfc26db9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 12.2.17-tuxcare.11 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.11" } ] }