{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4f72f019-fd7c-57ea-9e0c-63c1d31503b9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/localize", "purl": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16", "version": "17.3.12-tuxcare.16", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:e84ff792-feb0-5de1-88e5-a4b9278b83e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:93c9d04f-51b3-5d37-b984-b8f436698334", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:aa0ee68f-96ea-5f1e-87fc-efea5c4f3699", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:7ef5de70-b461-53be-b9d0-73cd4d2371e6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 17.3.12-tuxcare.16 of @angular/localize. not_affected \u2014 The vulnerable code (domino's lib/HTMLParser.js with the after_doctype_name_state infinite loop bug) is NOT present in this Angular source repository. Domino exists only as a declared npm dependency in package.json (line 110: \"domino\": \"https://github.com/angular/domino.git#8f228f8862540c6ccd14f76b5a1d9bb5458618af\"). The BUILD.bazel shows domino is bundled at build time from @npm//:node_modules...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:4e4809fc-935e-5c23-a123-384b9de2e073", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:731b3eb5-517c-5167-8999-cf1849e6f8ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:2027be38-821f-50b7-bcf0-69de5a6d9039", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:d6f9bab2-9286-546a-9425-c9199e63473a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:ce98e85a-f41b-54d1-a718-1a77cf1155ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:245001a7-1eaa-5cf5-bde0-ccabe0765f4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:afd3cd31-3b1e-5a55-93ad-9c3d03d3f980", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f869ac8e-2678-574f-8a9f-7cebbefcf0bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f70e05ee-9037-5515-9089-c123a09cccd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:bb245e5a-0b96-5b81-9be3-ce2c135b3f65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:c57c4609-4c07-52a9-b2d6-2077d5948eb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:be431cb3-d1ed-522d-a2e0-e4c8ee0c2426", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:97fcbdb4-948f-52e6-8466-d5ae3116f395", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:e4c3247f-112d-5974-8b39-7a9982b26b19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:8d913b3c-8ac7-510c-b6d3-0899fafc2555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:d5b8c752-3fc4-5803-bbb6-db8da8b99a4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:fdf3b84d-53e5-5819-be05-ce88ddbe386b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:defde090-c6ab-5884-8809-c1c9e1218d4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:d3e6fa94-c652-58df-8361-0eb3b81af0d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:86e05cc6-7182-5600-810b-00877225c869", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:0cbd2327-9ca7-59f6-a046-a90b934e5e03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:9bdc6903-537b-5f26-afda-68e367cb54fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.16 of @angular/localize. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:6013d42d-9244-57db-bbbf-e578f22ac7eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f9745352-d854-5a95-9514-4f482e912a35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:1ecfbfff-0c4a-51b6-8aa7-c348dd06770a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:24529007-4717-5bce-8d88-a157cfcfb3ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.3.12-tuxcare.16 of @angular/localize." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.16" } ] }