{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c3ff02bc-1433-5bf0-8082-4c56341d5973", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14", "version": "16.2.12-tuxcare.14", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:0de3c80d-6cca-5e64-ae46-6b571a41b110", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:4e28c68d-e926-5285-8862-dff05997515e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:28989fc7-90de-56e2-aef9-aada72960ab4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:817f1db8-1442-556d-98c0-5a6110b19d8c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 16.2.12-tuxcare.14 of @angular/platform-server. not_affected \u2014 The target repository (@angular/platform-server version 16.2.12-tuxcare.14) is not affected by CVE-2026-101895 because the vulnerable code pattern does not exist in this repository. The CVE describes an infinite loop in domino's lib/HTMLParser.js (specifically in after_doctype_name_state when handling incomplete DOCTYPE declarations with EOF). Domino is referenced only as a declared dependency ...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:40a7dd77-97a7-5617-b2b9-a3a5af057532", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:739b899e-7366-5133-b951-1f943fc51866", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:161d9ece-faa7-505e-aea8-6ebddd35f186", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:bac098ad-b37e-5693-86e9-d731423e6179", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:59a3497a-1dc5-522e-9c76-0290bf443633", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:06fdd4b0-b320-51dc-8dec-df952a342b84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:5e230d0a-5ecb-5392-a8db-80cd53d2e0aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:3c214a51-f9db-5608-a277-a597ec442170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:3ab46052-f5f5-55b3-b3eb-0875f89dba01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:01137dac-fd1e-5def-8429-4daacef14b20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:03150349-97b9-5ca6-b9d4-f00258582d88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:27a1f94f-7233-579d-9c14-f56ab45ea375", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:c5fa7204-00e2-544c-8001-675c9e3a9ae7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:fde549c1-1692-5730-aa75-726469f744b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:628961d7-096d-5f6b-9f5d-2db3a94691e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:146a8b59-46a1-5f86-9c9b-47c4c5485280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:8a1aa242-e9d4-567b-9925-217405f23c4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:d3e72061-c6ce-5a97-9cb4-6a4e9a068724", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:a49016b6-3476-553a-93ff-835eb0b8c799", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:5662e2e2-d87d-5a1c-895f-dfc0b78349fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:579675b5-b335-57b2-b364-3981dce39cdf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.14 of @angular/platform-server. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:568a3e23-061e-59f5-8def-6430fade7e4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:fcc8d67b-8eda-5326-abb2-e10bc97e56d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:fc587847-7b53-5b91-b39e-4404abe3f62b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ], "bom-ref": "urn:uuid:3549c620-6c7b-5c0a-9b38-9f6bbe0452d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.12-tuxcare.14 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.12-tuxcare.14" } ] }