{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:410d67ea-67db-5a54-a6c4-0a45eb286d61", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/http", "purl": "pkg:npm/%40angular/http@8.2.14-tuxcare.13", "type": "library", "bom-ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13", "version": "8.2.14-tuxcare.13", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:6156a02a-77ee-5835-ad37-1ce96cac251f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:1f52b138-cad1-5ff3-b8ae-48229e9b8ccd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:74a37b3f-84ef-5f92-979d-97bcbb7d6560", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:513f931d-54a6-536e-8376-a76bcabc846d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 8.2.14-tuxcare.13 of @angular/http. not_affected \u2014 CVE-2026-101895 describes a DoS vulnerability in domino's HTML parser where incomplete DOCTYPE declarations with trailing whitespace cause infinite loops. The vulnerable code (domino's after_doctype_name_state EOF handling in HTMLParser.js) is NOT present in this Angular repository. Domino version 2.1.2 is declared as a dependency in @angular/platform-server's package.json but is not vendored i...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:ec6d385d-f432-591a-befd-d21ae20906a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:e0987b6f-2b17-5ea5-9311-27bd3e8a2434", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:7f787beb-c652-5118-9257-b5e99b1c86f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:0e343281-5a22-5f8b-a357-758c8ed7141a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:555ed3b9-aa70-5fbb-a37a-5834cc28cdb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:d0e28525-1b72-5a77-bdf5-64109944739f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:c5f7e379-4519-5abe-b383-4fc2599de2b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:d57c3c97-89c4-55ff-938f-6a60919d1f49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:6b53934d-69eb-5d4c-bda8-68338b3a9ad3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:d905f926-672f-581a-8df8-dc6688dba61a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:56712c3b-9e56-5386-b629-3edade7eac40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:e559ec7f-8fa7-5a97-a62f-c0b52a20f814", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:89a9ce83-4879-5a85-9b4d-34d9abb688f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:6e3547b9-17fb-5126-9d95-c22376532f22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:569550b2-5a60-5975-90b2-f0e1910ebf18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:73bf2568-8cb2-5a20-8da1-98872e15c3df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:cb71abf5-b3ef-59cf-bf8f-ddab4f6b207f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:b58e2db1-2614-54a8-8fc8-4317dc5aa6c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.13 of @angular/http. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:395b4e67-f393-546e-9767-40691ece8bba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:85c629e6-217f-5685-8059-7d1cb78276c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:e02ccbe7-5505-550e-ae82-abc10e6e4fac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.13 of @angular/http. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:a048539b-136c-5683-ae61-9be58bc13f85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:c8662c31-cb7c-51e9-bc46-aa5f243317d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:5d35902b-3670-5569-8c73-0257b2314a19", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.13 of @angular/http. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ], "bom-ref": "urn:uuid:e0310809-7ee3-595a-8a76-4bbb9fa1424d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 8.2.14-tuxcare.13 of @angular/http." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/http@8.2.14-tuxcare.13" } ] }