{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7138273a-5f9b-5ff5-928d-5e76a888aed6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16", "version": "17.3.12-tuxcare.16", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:421ad452-28f6-5070-aa97-80185bd379e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:90ff7f21-db82-5cda-957f-c9f911a7f1cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:90a7b585-ea63-5d92-8977-2f4a7479673b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:e0a92a6b-5083-590c-997f-b6f1fc7f299d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 17.3.12-tuxcare.16 of @angular/platform-server. not_affected \u2014 The vulnerable code (domino's lib/HTMLParser.js with the after_doctype_name_state infinite loop bug) is NOT present in this Angular source repository. Domino exists only as a declared npm dependency in package.json (line 110: \"domino\": \"https://github.com/angular/domino.git#8f228f8862540c6ccd14f76b5a1d9bb5458618af\"). The BUILD.bazel shows domino is bundled at build time from @npm//:node_modules...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b0fb25f2-3e96-5985-a147-fd280f8e7d02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:7d4a0a58-0374-5dc3-8e68-7a2c6f2557b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:afc2dc46-cc91-5444-94ce-64d6adad7a87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:c80c7106-b9e9-5dae-be54-65bb54ce575d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:e305e4cb-584c-5d96-b231-a0153cc412bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:7b6dbf79-b3d0-596d-9fb2-4f5ebf5ea3c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:776c5e9b-c4b3-57a9-a794-f64a28e20255", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f33439e6-6601-515c-90ad-dab856ab735e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:7fc3a7a7-5f9f-5a2a-8905-ac53f8c4ad0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b8230278-02d7-52fb-b9b6-b1911bb818f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:dc51c367-8f01-54fe-abe6-cca425b29a2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:168f1a25-ba24-5816-ba06-f7687f16434b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f1e466c7-c50b-5488-80b7-b32f11702f30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:4c1e86df-3523-525d-94d3-72fbdf32fd1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:798ebdcc-32ac-53c9-8440-ed70e44f022f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:6f07c2b5-52d2-5bc8-b919-e4e80adc6992", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:ed1f781a-755d-5130-bd7a-791421470613", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:dcbaaa55-c93e-5140-a224-c7f218663a80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:6965d248-f7f1-533d-84a5-7993888cc01f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b28b23bc-e90d-5e3a-90f7-2f301dc01e1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:51d45bdc-aba8-59a3-91de-1c01f5e0290c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:62835f9b-175e-5c72-a90b-578ec3fdb297", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.16 of @angular/platform-server. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:516c675f-0127-5530-9c37-a40142a57379", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:edc3e6a7-5cb3-5349-945c-a382c89f262c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:56c3a91f-94b8-5722-9a80-e9714233c62b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:dbaefb15-605d-57f0-ac0f-37c73e3995e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.3.12-tuxcare.16 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@17.3.12-tuxcare.16" } ] }