{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:97e3f71b-e959-580b-9d57-a66e4568e593", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8", "version": "8.0.3-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:751e05a4-f0ab-5884-9bfc-ad2bd71ac66b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:1c04102a-a891-59f9-8c54-03ea71f768e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:18a05cda-3346-510a-bcda-98ff0837c555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:9d1b12bf-adae-5fe1-98c2-e0d6ac05f42f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:0e4f79f8-b763-5a28-a89d-f480ec881f24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:a28a477e-a8ab-5478-8020-64a6f605ea17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:70a402da-5f53-5858-9808-1c1f3d857809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 8.0.3-tuxcare.8 of @angular/language-service. not_affected \u2014 The target Angular version 8.0.3 is not affected by CVE-2026-41423. The vulnerability requires WHATWG URL API (introduced in Angular 8.2.x+) to manifest the hostname override behavior. Version 8.0.3 uses Node.js legacy url.parse() which does not interpret protocol-relative URLs as having attacker-controlled hostnames.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:a3835ece-012e-57e4-b815-b12a81a1224f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:a3d1bc41-38b9-5ee7-a845-38088040ecf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:0cebc978-7a94-5b65-84e1-5558f61ae99d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:8732b77c-9f22-5d51-a165-c1652893f02c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 8.0.3-tuxcare.8 of @angular/language-service. not_affected \u2014 The target Angular v8.0.3 is NOT affected by CVE-2026-50170. The vulnerability requires the HTTP transfer cache feature (packages/common/http/src/transfer_cache.ts) and client hydration mechanisms, which were introduced in Angular v16+. This version lacks the entire affected component.", "justification": "code_not_present" } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:115a7bb7-3cff-56dc-b436-7792c5ea4683", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:9f235333-c87c-52a9-9b74-9f3091f17031", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:0b6359e4-63f2-58e3-9a27-2660bb1308cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:7443ba05-e084-5363-a3a6-b92e72e1d20c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:fe2f91ba-0f32-51b5-b7d7-022fc64c31a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:4793426b-9a0d-5a5f-9e39-a1dc7e5cb625", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:53b748fc-e8c3-58e7-bfa0-41bce808d084", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 8.0.3-tuxcare.8 of @angular/language-service. not_affected \u2014 The target Angular service-worker version 8.0.3-tuxcare.4 is NOT AFFECTED by CVE-2026-54264. The vulnerability requires the service worker to copy and forward request headers during cross-origin redirects. This version never copies headers: the AssetGroup path creates fresh requests from URLs only (no header preservation), and the DataGroup path delegates to the browser's spec-compliant fetch A...", "justification": "code_not_present" } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:7d041834-af93-503c-95d7-7244ae18a036", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:4af4353b-4b8f-5338-981b-75cb9329caa7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 8.0.3-tuxcare.8 of @angular/language-service. not_affected \u2014 Angular 8.0.3-tuxcare.4 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with its weak DJB2 hash-based cache key generation does not exist in this version. HttpTransferCache was introduced in Angular v16+, while this target is v8.0.3.", "justification": "code_not_present" } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:d38c3691-4287-5021-8fa4-aa5419c9b6e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:34e5809c-c17d-581e-8787-8d9f4b07bf14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:2485069b-18a1-5c38-9d47-5ccdf9a075e4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.0.3-tuxcare.8 of @angular/language-service. not_affected \u2014 Angular 8.0.3-tuxcare.5 is NOT AFFECTED by CVE-2026-68945. The vulnerability concerns HttpTransferCache, a feature that caches HTTP requests during Server-Side Rendering (SSR) and generates cache keys that incorrectly treat scalar-comma parameters (role=user,admin) as identical to repeated parameters (role=user&role=admin). This feature does not exist in Angular 8.0.3 \u2014 it was introduced in Ang...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:ee18ca79-9b0c-5805-980c-590e5a55a85d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:373a0e27-5e11-55b9-8aa4-30643357123e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:aa434dbe-ad37-50ed-895f-dee4ea3b1804", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.0.3-tuxcare.8 of @angular/language-service. not_affected \u2014 Angular 8.0.3 is not affected by CVE-2026-88056. The vulnerability exists only in later Angular versions (v19+, v20+, v21+, v22+) where packages/platform-server/src/url.ts contains a parseUrl function that calls String.prototype.trim() on URL strings. This trim() call strips Unicode whitespace (U+00A0, U+FEFF), converting same-origin URLs into cross-origin protocol-relative URLs, causing SSRF. ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:d6f0735f-dad5-5bfe-b323-66675c0e0315", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:482624b1-e011-5423-bfc9-e29e8269a429", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:6cf94d32-07ce-5cb7-beb2-3f4e0a4b8ff9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.0.3-tuxcare.8 of @angular/language-service. not_affected \u2014 Angular v8.0.3 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and modern SSR hydration features that were introduced in Angular v16+. Version 8.0.3 predates these features by multiple major releases. The legacy TransferState in v8 is a manual key-value store with no integration with HttpClient, making the described attack chain impo...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:350985f8-9641-540c-8cef-fa695a3f9785", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 8.0.3-tuxcare.8 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@8.0.3-tuxcare.8" } ] }