{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5879eab4-63bb-54b1-8bd8-92354f87143a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.7", "version": "5.2.7-tuxcare.7", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@5.2.7", "type": "library", "version": "5.2.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:027b400d-5bde-5d55-9cb0-a1b88fad8266", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 5.2.7-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:9256d330-81b5-541e-8e3f-32b4b9432635", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 5.2.7-tuxcare.7 of @angular/platform-server, and is fixed in 5.2.7-tuxcare.9." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:17324ed2-435f-5b60-89d9-dfe3eaf81b74", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-111754 does not affect version 5.2.7-tuxcare.7 of @angular/platform-server. not_affected \u2014 Angular 5.2.7 is not affected by CVE-2026-111754. The vulnerability requires WHATWG URL normalization to transform dot-segment paths like `/.//evil.test` into protocol-relative pathnames (`//evil.test`), followed by automatic HTTP redirect emission. Angular 5.2.7 uses legacy Node.js `url.parse()` which does not normalize dot-segments, keeping the pathname as `/.//evil.test`. Additionally, 5.2.7...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:1b2dd903-4ad1-5a9f-9330-16900ecb9af2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 5.2.7-tuxcare.7 of @angular/platform-server. not_affected \u2014 Angular version 5.2.7 is not affected by CVE-2026-41423. The vulnerability exists in later Angular versions (9+) that use the WHATWG URL API with hostname tracking. Version 5.2.7 uses Node's legacy url.parse() API and only tracks pathname/search/hash components, making the SSRF attack vector via hostname override impossible.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:ccb5363c-e914-5247-a4be-a379383b0c19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.7-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:de82ee98-255a-547e-a84e-f1e67542279a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.7-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:146bba5b-b0f2-596e-8b90-dc4d5c0e03f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.7-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:7c8374f3-3fc1-5ff4-8275-f65339e3f48d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.7-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:90100379-96a0-5f1f-90c8-e09ca822e9f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.7-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:968d0a7a-7ae5-596f-86c1-6f60fbc7d0e3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.7-tuxcare.7 of @angular/platform-server. not_affected \u2014 CVE-2026-88056 describes a Unicode whitespace bypass vulnerability in Angular's SSR URL resolution utility (packages/platform-server/src/url.ts parseUrl function that uses String.prototype.trim()). This vulnerable component does not exist in version 5.2.7-tuxcare.5. The url.ts module was introduced in later commits (e46f82d67e on 2026-06-25, after the current HEAD dated 2026-08-14 but on a diff...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:a8f5fc2d-783c-5ea8-bdb0-9f78c8c69925", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 5.2.7-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:2e52921a-c2a5-5497-a656-4e1fd4812766", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 5.2.7-tuxcare.7 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.7" } ] }