{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:72dca169-2ddf-5817-9c67-cb919059e581", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/forms", "purl": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16", "version": "17.3.12-tuxcare.16", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:fd9a4290-0c9d-556b-bbbc-1900ea744d10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:0856cea5-a955-5c9c-81d9-b2fb71759b0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:209f54f4-9f57-5587-be23-50bcbe0a4dc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:db237a65-7444-5d91-898a-6dc02f1ad93d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 17.3.12-tuxcare.16 of @angular/forms. not_affected \u2014 The vulnerable code (domino's lib/HTMLParser.js with the after_doctype_name_state infinite loop bug) is NOT present in this Angular source repository. Domino exists only as a declared npm dependency in package.json (line 110: \"domino\": \"https://github.com/angular/domino.git#8f228f8862540c6ccd14f76b5a1d9bb5458618af\"). The BUILD.bazel shows domino is bundled at build time from @npm//:node_modules...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:38d31f87-bfdf-5548-8dd9-830114a3afbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:585bc7ac-1e08-572c-be1c-6c3c5a822f5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b8513dcd-4a59-5de9-b0e8-fdf8830e4e9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:799627b8-738b-5adb-b483-1c4799cf0558", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:e27c31b3-29d4-5bee-886d-c00eb12c52d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b1f4999d-09e7-5005-afd0-accd46ded6a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f9fad4fc-e13b-5e31-a02e-1c8ab7b12061", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:4a867c9d-62bf-5d0e-b2a4-f49aa097e099", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:545dcfd3-ef9d-5728-ac02-ce7a9395b5db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:51ee9e42-2a7e-57ea-95f3-d0cc624d10e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:871a534e-8c8d-58ab-967e-769a0bb325f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:e1eb5324-7bd6-57da-8994-4c794cc4e332", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b85ee3ea-4e38-52f8-97c4-b3bff963ca73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:321d5d8e-b3d7-5f39-a2c7-4d3f552548db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:57f5f642-1ae9-582a-a873-badbddcf2f98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:a38996ab-12b2-5463-8067-8687dcf0b754", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b67dfa96-e0a7-57f4-8963-54fd0afb6214", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:df43d24b-b58a-56b8-8095-b670fc883987", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:2041cea7-6215-57d1-a228-7ae983060292", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:081d079d-b5fe-5f83-a0ea-bc265c3738f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:fc1801f9-ad7c-597c-8079-57b004b8aa62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:e213d798-a693-555b-b0bd-fa88a94b4dc6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.16 of @angular/forms. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:9e58ae5a-805c-5bb8-bcd9-ab9e18325587", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:01e2d53b-fa95-5813-b626-1a13224f6d5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b8f1b1f3-6bb1-5237-925a-424995a6d835", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:09261de8-a83a-533a-97ae-add67128e3db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.3.12-tuxcare.16 of @angular/forms." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.16" } ] }