{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dbee8e99-c10f-5f7e-8a88-5668c4768736", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/common", "purl": "pkg:npm/%40angular/common@18.1.2-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6", "version": "18.1.2-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:bcc104fb-24d4-51f3-af36-49f885b918e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:db9f1401-8f5b-5c99-a630-0505fa54fc0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:e29cb226-f49d-5444-89dc-afa226167b0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:e3371eb6-8073-5b5c-bee6-43dabf5a8176", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 18.1.2-tuxcare.6 of @angular/common. not_affected \u2014 The Angular repository (v18.1.2-tuxcare.6) does not contain the vulnerable code for CVE-2026-101895. The DoS vulnerability exists in domino's HTMLParser.js (after_doctype_name_state infinite loop), but domino is an external npm dependency whose source code is not vendored or bundled in this repository. While Angular's platform-server does call domino.createWindow(html) and exposes the vulnerabi...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:5791eb58-379b-51e5-b288-20f56790e7e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:ac01b5cb-416f-588b-8cb2-7da13217f117", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:15da58d9-6ac2-5563-aa5d-f0ee89ac8277", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:7342a642-13b1-5c09-8dda-c9a98f64c118", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:75f42cc8-bc67-57ae-8a7a-e483df1f5487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:ada5cb79-af7e-5c94-b008-5b16ee2b7c28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:ba66ef78-c9f9-563e-947e-27970a9c56c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:ea17c489-0ae4-51f6-88ab-33bedb565046", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:f5fcd2d4-00e4-5a43-953a-70df90079dbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:b0adbc93-5430-5314-9864-f63054fd017a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:59da7c60-8986-5122-9b18-b5578b23995f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.6 of @angular/common. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:462262e9-abed-5576-970e-6980c23d32d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.6 of @angular/common. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:a6da0959-183c-5ce9-820a-b15b6aa8817d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:c66ab6fb-b17b-55f0-82c1-28160d81b4ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:d85e575e-4db8-5cc7-95eb-e3c5fb48e713", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:f8ab9e86-0a5b-500e-b076-f317cfae8be0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:ee54ddfb-cea7-522b-9374-18bd5e797354", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:54af169d-f41e-5369-9b66-53dd50261bfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:24c50add-d5cc-5c56-8f57-7dc8d2602c27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:f7e64279-988b-5e65-a240-477f97324052", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:58960b80-c586-5479-a146-d358ed03a462", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:b6d12664-24b0-54b7-9059-b3c7bfb87c1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:af7c3501-077d-5956-bd7d-a0ac864d0d3c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.6 of @angular/common. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:c4a7931d-f405-5b36-b6ec-7c2e5e25e119", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:3b6f0012-2e55-580b-8dcd-c784bb97115d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:3002e606-f1d8-5cc2-9e29-efa927147fdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:100a7b3c-af32-5448-b500-ee9526646c5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.1.2-tuxcare.6 of @angular/common." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.6" } ] }