{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c0bd3e69-f46c-506f-af9e-c3ae91383717", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler", "purl": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13", "version": "8.2.14-tuxcare.13", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:6d4d4fbf-4fc9-58ee-a7b2-47ef509101bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:cdd334e2-99a8-5391-b3df-02861b9103fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:801a0683-e318-586d-997c-35225a823fd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:4f2d95e4-6cb1-5be9-8b16-f032a77cd55d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 8.2.14-tuxcare.13 of @angular/compiler. not_affected \u2014 CVE-2026-101895 describes a DoS vulnerability in domino's HTML parser where incomplete DOCTYPE declarations with trailing whitespace cause infinite loops. The vulnerable code (domino's after_doctype_name_state EOF handling in HTMLParser.js) is NOT present in this Angular repository. Domino version 2.1.2 is declared as a dependency in @angular/platform-server's package.json but is not vendored i...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:a9808f8f-78b1-5931-8ea9-cbac09643a63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:6ea69781-0513-5cdd-b4f8-ce147e0acc7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:d5a4895a-3967-52d6-90d0-d45ce151a819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:bfaed12e-9c19-541e-b40e-f24637fd67d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:05ed53fb-ca8b-53cc-9328-ac020eb81a11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:4d3dc63a-a37a-5c74-9384-3956f893b4ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:8512e884-6523-59b9-9488-50f0fb29d0d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:84cd56f4-1891-5a1a-acdc-e78d3335e8ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:0ca8ebb0-4618-51f8-b17a-98e58506ad5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:6fd6d358-0487-59c1-b55b-d5ed1e49bf0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:4b4ee2cd-e3e8-5d80-98f9-3e90c91ba253", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:3e96a2b6-ca3b-5307-af14-9ce16f8de0b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:87560f40-492d-58b0-aa34-6c8c390450c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:d8b5335e-9954-5e5d-917f-bc11f1a64c8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:1ce6613f-d854-5f41-9966-6ac55dcad598", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:b72a29e8-e862-5b34-aa47-1710d9874b4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:bf590224-d8e8-5645-a9ed-3f70308333d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:9aadf84f-5220-5b75-94f5-561ec9371c19", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.13 of @angular/compiler. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:b480b431-7721-5535-8fb2-470b89e334a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:a3f96e2c-2ba5-554d-8c16-3e503d823cea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:4657f562-92ae-5fa4-b08a-e635261a7aa0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.13 of @angular/compiler. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:b4ea292a-0136-5722-a3f9-275df122094a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:c56d1780-c376-5f9b-9918-e56c54b8af3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:1f851436-cba8-5fd6-8f5a-f61f8141e045", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.13 of @angular/compiler. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:f5a0811c-ceb0-5471-9e8f-3a62edb24e7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 8.2.14-tuxcare.13 of @angular/compiler." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.13" } ] }