{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1face12f-7d96-5125-9cb4-f52d791def2b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/forms", "purl": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21", "type": "library", "bom-ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21", "version": "5.2.11-tuxcare.21", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:598036f1-6e6b-5d7f-b8e0-608a9350fde0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:c64ccf5d-ce48-5806-b3ff-a650aa4758a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:8d18c990-856f-5f6d-9f1f-78de4c444197", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:933ace64-622b-519a-b108-f55ae1672d9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:668311e8-d3ad-58ed-b9d5-6ec8467f2fd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:854beec0-4382-5902-91b0-f9da6bc5e55f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:e08e7662-91a4-5f9a-a648-01e333a7e941", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:1233271d-21d2-5799-8ab7-bfcc13f3bd9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:fe6c4658-7db4-59a3-8472-78eb1cebc63c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:415956ee-c89d-5393-81ab-625e41b4f048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:59ef762c-b07d-5127-91e2-c68017900f2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:951e9ee3-39b1-5bce-8397-3cd746891911", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:1ac13502-57fd-57cb-bdad-499585daf95e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:0581e7d7-9ada-5043-a66a-88340ee19511", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:cae593c9-2b6f-5cf7-9d9d-11d7f3376faf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:1a32368a-5a1a-51a8-804d-63cfd84899dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:e30812bf-b7e0-5891-a860-69c7189a3c70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:f23e2031-ed66-53df-883f-a97f95000e22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:27a3b356-0ee2-5acc-9fe6-65bc3a384b83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:04979744-f961-5f9f-9d7f-8a9a021be574", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:d95e0c26-5b89-5fdd-be41-4624607e7337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:85061e49-a080-502c-b637-e6a5f3bebdaa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.21 of @angular/forms. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:26214939-d25e-5788-a861-6bb366b765fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:2192dc80-994e-5e02-8c7f-451748e9952d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:5af7d928-89cb-5b6b-8da8-32ac4527dc14", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.21 of @angular/forms. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:127d4682-c729-5598-b59a-2d49f90276ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:dcbfc8d8-7745-5147-8cff-3450803f9304", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 5.2.11-tuxcare.21 of @angular/forms. not_affected \u2014 CVE-2026-88058 affects the domino library's HTML serialization (XSS via ancestor fallback raw-content tag injection in comments/processing instructions during SSR). The target Angular 5.2.11-tuxcare.19 repository declares domino 2.1.2 as a dependency but does NOT vendor its source code. The vulnerable code (NodeUtils.js serializeOne() function) lives in the domino npm package, not in Angular's ...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:44bad330-32b2-50ea-b91d-5c56f860078d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.21 of @angular/forms. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:04a2ca75-824b-5335-860f-0c0e3f60863b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 5.2.11-tuxcare.21 of @angular/forms." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.21" } ] }