{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b0fd6325-aee5-52b4-a3ec-eff94250c3e2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.11", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.11", "version": "4.4.7-tuxcare.11", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@4.4.7", "type": "library", "version": "4.4.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.11" } ], "bom-ref": "urn:uuid:6c3a6743-5f0a-573d-bdc6-d96dd87969c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 4.4.7-tuxcare.11 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.11" } ], "bom-ref": "urn:uuid:37008df9-f030-51e3-8e8e-a4de1300e14e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 4.4.7-tuxcare.11 of @angular/platform-server. not_affected \u2014 Angular v4.4.7 is NOT affected by CVE-2026-101895. The vulnerability is specific to the `domino` DOM emulation library's HTMLParser.js tokenizer state machine. Angular v4.4.7 uses `parse5` (v3.0.2) for server-side rendering HTML parsing, NOT domino. Domino was only adopted by @angular/platform-server in Angular v5+. The vulnerable code path (domino's lib/HTMLParser.js after_doctype_name_state h...", "justification": "code_not_present" } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.11" } ], "bom-ref": "urn:uuid:7bce5f96-8f59-5ebb-a93d-415d229186f7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-111754 does not affect version 4.4.7-tuxcare.11 of @angular/platform-server. not_affected \u2014 Angular 4.4.7 platform-server contains the underlying data flaw (parseUrl lacks post-normalization validation for protocol-relative pathnames), but lacks the exploitation mechanism described in CVE-2026-111754. The CVE describes modern Angular v20-22 where @angular/ssr automatically emits HTTP 302 redirects on router navigation mismatches. Angular 4.4.7 has no such mechanism - platform-server s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.11" } ], "bom-ref": "urn:uuid:5f73a51e-63e0-5889-8e6f-0f67a8360df2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 4.4.7-tuxcare.11 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.11" } ], "bom-ref": "urn:uuid:a24dcfd9-4fbc-5229-b295-6f5ba188bd63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 4.4.7-tuxcare.11 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.11" } ], "bom-ref": "urn:uuid:3d1de9e6-e090-53fe-93d6-23b02bb529d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 4.4.7-tuxcare.11 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.11" } ], "bom-ref": "urn:uuid:85767763-ed74-5ac6-8711-088a5f12cc95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 4.4.7-tuxcare.11 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.11" } ], "bom-ref": "urn:uuid:2cec2f48-5e8f-5d48-97ce-7a05816efdd1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 4.4.7-tuxcare.11 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.11" } ], "bom-ref": "urn:uuid:7204c714-5edb-57f4-890f-20cc145f3e1e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-69149 does not affect version 4.4.7-tuxcare.11 of @angular/platform-server. Angular 4.4.7 does not use domino for DOM emulation. The CVE specifically affects domino's serializer (lib/NodeUtils.js), which fails to escape text nodes in fallback raw-content elements (iframe, noembed, noframes, noscript). Angular 4.4.7 uses parse5 version 3.0.2 for HTML parsing and serialization instead. Domino was introduced to Angular approximately 6 years later in February 2023 (Angular 15+, commit 76731ae5c8). The vulnerable component (domino) is not present in this version, making it not affected by CVE-2026-69149.", "justification": "code_not_present" } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.11" } ], "bom-ref": "urn:uuid:9315b492-0cd4-53df-b2eb-31d3786cbf94", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 4.4.7-tuxcare.11 of @angular/platform-server. not_affected \u2014 Angular 4.4.7-tuxcare.10 is not affected by CVE-2026-88056. The vulnerability requires a `urlStr.trim()` call in URL resolution that strips Unicode whitespace (U+00A0, U+FEFF), converting validated same-origin relative paths into cross-origin protocol-relative URLs. This vulnerable code pattern does not exist in Angular 4.4.7. The target version uses a simple `parseUrl()` function in `location....", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.11" } ], "bom-ref": "urn:uuid:d27d3278-d914-56d8-85c3-2336aad8cfd9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88058 affects version 4.4.7-tuxcare.11 of @angular/platform-server, and is fixed in 4.4.7-tuxcare.12." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.11" } ], "bom-ref": "urn:uuid:7dd41b26-edb8-52ea-8b30-e37c6670f2f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 4.4.7-tuxcare.11 of @angular/platform-server, and is fixed in 4.4.7-tuxcare.12." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.11" } ] }