{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:28041fc1-6330-5df0-b566-063e2555edec", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@16.2.7-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@16.2.7-tuxcare.7", "version": "16.2.7-tuxcare.7", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@16.2.7", "type": "library", "version": "16.2.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:43f5352d-aae4-5738-8762-332f45c5b845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.7-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:130d5915-12ac-5f9f-9cc3-ff51f5a4b8e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 16.2.7-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:8201aa40-cc71-5947-b568-590c1e103441", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111754 affects version 16.2.7-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:d9654b14-80b4-57e5-968d-008770d9a1d8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 16.2.7-tuxcare.7 of @angular/platform-server. not_affected \u2014 The target repository (Angular 16.2.7-tuxcare.1) uses Node.js legacy url.parse() API which is not vulnerable to the protocol-relative URL SSRF attack that affects WHATWG new URL() API. The vulnerability requires new URL(urlStr, origin) where protocol-relative URLs (//evil.com) can override the hostname component of the base URL. The target's url.parse() treats such inputs as pathname strings wi...", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:1bce3abd-aff3-5ed5-92a6-067567c789da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.7-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:8f512a5c-f104-58c1-8c80-360b28f20d7a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50168 does not affect version 16.2.7-tuxcare.7 of @angular/platform-server. not_affected \u2014 Angular v16.2.7 is not affected by CVE-2026-50168. The vulnerability exists in the relativeUrlsTransformerInterceptorFn HTTP interceptor that resolves relative URLs on the server, but this interceptor was added to Angular in October 2023 (commit 0c66e2424c), after v16.2.7's September 2023 release. Without this interceptor, relative HTTP requests fail rather than being resolved, preventing SSRF ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:9c266b5d-47cf-58da-b626-55e978c03f0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.7-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:e0dfa485-a8ce-580d-b4e0-fac41336b60a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.7-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:bb1635c1-3109-5e40-b306-9a2feae5d54b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.7-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:96dc173b-42fe-5e3a-bf81-c8f3cf982451", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.7-tuxcare.7 of @angular/platform-server. not_affected \u2014 Angular 16.2.7-tuxcare.3 does not contain the vulnerable code pattern described in CVE-2026-88056. The URL parsing functions (parseUrl in url.ts and location.ts) do not call String.prototype.trim(), which is the root cause of the Unicode whitespace bypass vulnerability. The vulnerable pattern existed in later Angular versions (20.3.x) but was never present in version 16.2.7.", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:1fcb16c6-910e-5ea5-b5ff-bef52a3242a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.7-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:89c04115-76c3-548c-8e29-dd073d67e8ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.7-tuxcare.7 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.7-tuxcare.7" } ] }