{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dda28012-a9b8-56f0-a67b-98f6c9b010cf", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.4", "version": "15.2.9-tuxcare.4", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@15.2.9", "type": "library", "version": "15.2.9" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.4" } ], "bom-ref": "urn:uuid:0f5467c6-3b2b-5b4b-a5c1-b392f00b622c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 15.2.9-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.4" } ], "bom-ref": "urn:uuid:26f158a2-f158-5a40-a0ec-918fb3e6bb26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 15.2.9-tuxcare.4 of @angular/platform-server, and is fixed in 15.2.9-tuxcare.7." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.4" } ], "bom-ref": "urn:uuid:1aa85322-bd68-5cf2-9e36-70b387da669f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111754 affects version 15.2.9-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.4" } ], "bom-ref": "urn:uuid:24381349-3b3c-5159-b5d6-51cbd67034cc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.4 of @angular/platform-server. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.4" } ], "bom-ref": "urn:uuid:e0f9e5aa-58cb-5499-ac90-baab456e6162", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.9-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.4" } ], "bom-ref": "urn:uuid:e2c1008f-a933-5521-89f2-41ee756ac135", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.9-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.4" } ], "bom-ref": "urn:uuid:a1133b66-64a6-5d2f-b5c1-cda85d5e6318", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.9-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.4" } ], "bom-ref": "urn:uuid:c57d8268-620f-5a30-9730-4ae39ff4a532", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.9-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.4" } ], "bom-ref": "urn:uuid:e13c630b-4786-5c10-a9ce-eaf192ec0353", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 15.2.9-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.4" } ], "bom-ref": "urn:uuid:d0a04add-a13b-5b71-8b76-73438c411b0c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 15.2.9-tuxcare.4 of @angular/platform-server. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-88056. The vulnerability requires URL resolution utilities that use String.prototype.trim() on URLs (specifically in HTTP interceptors like relativeUrlsTransformerInterceptorFn), creating a discrepancy with WHATWG URL parsing that enables SSRF. This code pattern does not exist in Angular 15.2.9 and was introduced in later Angular versions (16+). The ta...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.4" } ], "bom-ref": "urn:uuid:5f7ab23d-296b-5e52-bc5a-2de5e882a312", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88058 affects version 15.2.9-tuxcare.4 of @angular/platform-server, and is fixed in 15.2.9-tuxcare.5." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.4" } ], "bom-ref": "urn:uuid:9d43d58a-7071-5ac2-b94d-2f0519871a2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 15.2.9-tuxcare.4 of @angular/platform-server, and is fixed in 15.2.9-tuxcare.5." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.4" } ] }