{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c396af5e-c279-528a-9783-52fad7470a7d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.6", "version": "5.2.7-tuxcare.6", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@5.2.7", "type": "library", "version": "5.2.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:0246de73-f767-55f4-98df-02980708c830", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 5.2.7-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:8e0a99ed-800d-5f9f-b02e-d82c122acb2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 5.2.7-tuxcare.6 of @angular/platform-server, and is fixed in 5.2.7-tuxcare.9." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:316f1647-bfb6-5e5d-8298-85f5db864720", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-111754 does not affect version 5.2.7-tuxcare.6 of @angular/platform-server. not_affected \u2014 Angular 5.2.7 is not affected by CVE-2026-111754. The vulnerability requires WHATWG URL normalization to transform dot-segment paths like `/.//evil.test` into protocol-relative pathnames (`//evil.test`), followed by automatic HTTP redirect emission. Angular 5.2.7 uses legacy Node.js `url.parse()` which does not normalize dot-segments, keeping the pathname as `/.//evil.test`. Additionally, 5.2.7...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:960337bf-7bae-5604-981c-7389e9ce9ae8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 5.2.7-tuxcare.6 of @angular/platform-server. not_affected \u2014 Angular version 5.2.7 is not affected by CVE-2026-41423. The vulnerability exists in later Angular versions (9+) that use the WHATWG URL API with hostname tracking. Version 5.2.7 uses Node's legacy url.parse() API and only tracks pathname/search/hash components, making the SSRF attack vector via hostname override impossible.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:b7f088fa-a6ea-5e44-a431-268d3c956d19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.7-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:ddd73fe6-2efa-5488-a9a8-428492baaa9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.7-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:ac69edc4-eee9-5d4e-8fc8-24091b250d8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.7-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:74106c6b-a45f-5d97-bb95-5efb839655ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.7-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:e7acdd54-d76f-5723-94db-7089bda0b4cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.7-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:aac529f7-8ce4-5368-8831-f3e4e548e0c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.7-tuxcare.6 of @angular/platform-server. not_affected \u2014 CVE-2026-88056 describes a Unicode whitespace bypass vulnerability in Angular's SSR URL resolution utility (packages/platform-server/src/url.ts parseUrl function that uses String.prototype.trim()). This vulnerable component does not exist in version 5.2.7-tuxcare.5. The url.ts module was introduced in later commits (e46f82d67e on 2026-06-25, after the current HEAD dated 2026-08-14 but on a diff...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:817e4f29-b705-5c89-a22e-56abb30a0e82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88058 affects version 5.2.7-tuxcare.6 of @angular/platform-server, and is fixed in 5.2.7-tuxcare.7." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:6525c98b-959e-5dbd-826b-6a57e787be68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.7-tuxcare.6 of @angular/platform-server, and is fixed in 5.2.7-tuxcare.7." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.6" } ] }