{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:35d3c824-d77e-5b76-b130-c25aabe91c32", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.13", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.13", "version": "4.4.7-tuxcare.13", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@4.4.7", "type": "library", "version": "4.4.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.13" } ], "bom-ref": "urn:uuid:271fc881-a02e-5d27-8eb8-d382f278a162", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 4.4.7-tuxcare.13 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.13" } ], "bom-ref": "urn:uuid:f9d0e68f-4d87-56c9-bfb8-02830175ed11", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 4.4.7-tuxcare.13 of @angular/platform-server. not_affected \u2014 Angular v4.4.7 is NOT affected by CVE-2026-101895. The vulnerability is specific to the `domino` DOM emulation library's HTMLParser.js tokenizer state machine. Angular v4.4.7 uses `parse5` (v3.0.2) for server-side rendering HTML parsing, NOT domino. Domino was only adopted by @angular/platform-server in Angular v5+. The vulnerable code path (domino's lib/HTMLParser.js after_doctype_name_state h...", "justification": "code_not_present" } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.13" } ], "bom-ref": "urn:uuid:f8ac683e-1084-55f3-aa18-32d729283384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-111754 does not affect version 4.4.7-tuxcare.13 of @angular/platform-server. not_affected \u2014 Angular 4.4.7 platform-server contains the underlying data flaw (parseUrl lacks post-normalization validation for protocol-relative pathnames), but lacks the exploitation mechanism described in CVE-2026-111754. The CVE describes modern Angular v20-22 where @angular/ssr automatically emits HTTP 302 redirects on router navigation mismatches. Angular 4.4.7 has no such mechanism - platform-server s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.13" } ], "bom-ref": "urn:uuid:b969a76d-2cda-56a6-912d-655f72919c73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 4.4.7-tuxcare.13 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.13" } ], "bom-ref": "urn:uuid:6ccb7852-586c-5753-9931-7e235972f502", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 4.4.7-tuxcare.13 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.13" } ], "bom-ref": "urn:uuid:f232306f-db14-5b3c-aa90-eacf6757b2d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 4.4.7-tuxcare.13 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.13" } ], "bom-ref": "urn:uuid:54e51dec-d605-595b-a9da-915cdd441b89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 4.4.7-tuxcare.13 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.13" } ], "bom-ref": "urn:uuid:92800411-923c-5408-bd0a-7343247e605f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 4.4.7-tuxcare.13 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.13" } ], "bom-ref": "urn:uuid:3ea77b39-a3e2-5f9d-a20a-2f765b1bc8ed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-69149 does not affect version 4.4.7-tuxcare.13 of @angular/platform-server. Angular 4.4.7 does not use domino for DOM emulation. The CVE specifically affects domino's serializer (lib/NodeUtils.js), which fails to escape text nodes in fallback raw-content elements (iframe, noembed, noframes, noscript). Angular 4.4.7 uses parse5 version 3.0.2 for HTML parsing and serialization instead. Domino was introduced to Angular approximately 6 years later in February 2023 (Angular 15+, commit 76731ae5c8). The vulnerable component (domino) is not present in this version, making it not affected by CVE-2026-69149.", "justification": "code_not_present" } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.13" } ], "bom-ref": "urn:uuid:a6791dd7-251a-5dcc-8291-5b262ffe004b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 4.4.7-tuxcare.13 of @angular/platform-server. not_affected \u2014 Angular 4.4.7-tuxcare.10 is not affected by CVE-2026-88056. The vulnerability requires a `urlStr.trim()` call in URL resolution that strips Unicode whitespace (U+00A0, U+FEFF), converting validated same-origin relative paths into cross-origin protocol-relative URLs. This vulnerable code pattern does not exist in Angular 4.4.7. The target version uses a simple `parseUrl()` function in `location....", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.13" } ], "bom-ref": "urn:uuid:757e3d94-8229-51cd-9a52-d23d7fc7c128", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 4.4.7-tuxcare.13 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.13" } ], "bom-ref": "urn:uuid:f452a1fd-1246-5246-afa1-0877d338bc33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 4.4.7-tuxcare.13 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@4.4.7-tuxcare.13" } ] }