{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5fb918f5-f107-586d-923c-7afd0f2cf854", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.12", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.12", "version": "4.4.7-tuxcare.12", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@4.4.7", "type": "library", "version": "4.4.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:ee29119e-7710-50e7-a8d2-9754d45766c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 4.4.7-tuxcare.12 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:72b6430c-8fb0-5a34-a284-a7c7a44257b3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 4.4.7-tuxcare.12 of @angular/platform-server. not_affected \u2014 Angular v4.4.7 is NOT affected by CVE-2026-101895. The vulnerability is specific to the `domino` DOM emulation library's HTMLParser.js tokenizer state machine. Angular v4.4.7 uses `parse5` (v3.0.2) for server-side rendering HTML parsing, NOT domino. Domino was only adopted by @angular/platform-server in Angular v5+. The vulnerable code path (domino's lib/HTMLParser.js after_doctype_name_state h...", "justification": "code_not_present" } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:802689cf-e350-5c21-a2dc-acdddfa5ea05", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-111754 does not affect version 4.4.7-tuxcare.12 of @angular/platform-server. not_affected \u2014 Angular 4.4.7 platform-server contains the underlying data flaw (parseUrl lacks post-normalization validation for protocol-relative pathnames), but lacks the exploitation mechanism described in CVE-2026-111754. The CVE describes modern Angular v20-22 where @angular/ssr automatically emits HTTP 302 redirects on router navigation mismatches. Angular 4.4.7 has no such mechanism - platform-server s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:68e01d5b-3283-5bf0-8bbe-74ad1953f3e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 4.4.7-tuxcare.12 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:86e58251-784b-53e0-a7dc-ded0a2d71fbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 4.4.7-tuxcare.12 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:bc26cabf-e42d-568b-8d0d-f5d9f6100ed1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 4.4.7-tuxcare.12 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:e3cb7258-55d5-5578-882a-2edd712b446d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 4.4.7-tuxcare.12 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:de0958de-e886-5c69-a634-57fdfe398ee0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 4.4.7-tuxcare.12 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:9146c330-3043-520d-8e98-f569b8a3c559", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-69149 does not affect version 4.4.7-tuxcare.12 of @angular/platform-server. Angular 4.4.7 does not use domino for DOM emulation. The CVE specifically affects domino's serializer (lib/NodeUtils.js), which fails to escape text nodes in fallback raw-content elements (iframe, noembed, noframes, noscript). Angular 4.4.7 uses parse5 version 3.0.2 for HTML parsing and serialization instead. Domino was introduced to Angular approximately 6 years later in February 2023 (Angular 15+, commit 76731ae5c8). The vulnerable component (domino) is not present in this version, making it not affected by CVE-2026-69149.", "justification": "code_not_present" } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:903da5b3-43f1-57e9-bf98-8edeafdfea80", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 4.4.7-tuxcare.12 of @angular/platform-server. not_affected \u2014 Angular 4.4.7-tuxcare.10 is not affected by CVE-2026-88056. The vulnerability requires a `urlStr.trim()` call in URL resolution that strips Unicode whitespace (U+00A0, U+FEFF), converting validated same-origin relative paths into cross-origin protocol-relative URLs. This vulnerable code pattern does not exist in Angular 4.4.7. The target version uses a simple `parseUrl()` function in `location....", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:28d036f4-b4ed-553d-ba77-d2f324676b06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 4.4.7-tuxcare.12 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:b421fa7e-c426-53f9-b4ff-19b7cd908ee8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 4.4.7-tuxcare.12 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.12" } ] }