{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a73e5386-387f-5d88-ba32-3632312fb943", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21", "version": "5.2.11-tuxcare.21", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@5.2.11", "type": "library", "version": "5.2.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:2add382e-2f21-5e6a-8b6d-5a47a4a113b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 5.2.11-tuxcare.21 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:7a2d1e7a-58bc-5dbb-84dc-b4327a96c824", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 5.2.11-tuxcare.21 of @angular/platform-server, and is fixed in 5.2.11-tuxcare.22." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:bbd3ee63-24f5-5fe1-ad62-088b5f9d2a11", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-111754 does not affect version 5.2.11-tuxcare.21 of @angular/platform-server. not_affected \u2014 Angular v5.2.11 contains the underlying data flaw (parseUrl doesn't validate that normalized pathnames don't start with `//`), but lacks the exploitation mechanism present in modern Angular SSR. CVE-2026-111754 targets versions 20+/21+/22+ where @angular/ssr automatically emits HTTP redirects on router state mismatches. v5.2.11's SSR architecture predates this by many years and only provides HT...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:4df58e10-b48e-5c20-b13a-c91ab47fa96e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.21 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:998627ac-5f31-513d-8ed1-0e4e8e1f8da8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.21 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:9b887dfe-a3b4-55c1-b972-6b2d7d29cf00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.21 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:b1b42505-1a68-5b0c-adad-7aace84dc2a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.21 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:00d18b96-ed6e-5ac3-a5d0-deca4ab3da4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.21 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:e1c185bd-a2e0-5a19-947b-7b335133093d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.21 of @angular/platform-server. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:018ff40c-8ed8-5f76-ad27-a9ecf12a0ee9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 5.2.11-tuxcare.21 of @angular/platform-server. not_affected \u2014 CVE-2026-88058 affects the domino library's HTML serialization (XSS via ancestor fallback raw-content tag injection in comments/processing instructions during SSR). The target Angular 5.2.11-tuxcare.19 repository declares domino 2.1.2 as a dependency but does NOT vendor its source code. The vulnerable code (NodeUtils.js serializeOne() function) lives in the domino npm package, not in Angular's ...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } ], "bom-ref": "urn:uuid:5251d5ff-6df2-5d85-a985-879110e8bed5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 5.2.11-tuxcare.21 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } ] }