{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f6b712a4-cc5e-56c3-af7c-2652809d846e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.8", "version": "5.2.7-tuxcare.8", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@5.2.7", "type": "library", "version": "5.2.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.8" } ], "bom-ref": "urn:uuid:cc1d3849-cc45-533d-8db8-22761e36b27d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 5.2.7-tuxcare.8 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.8" } ], "bom-ref": "urn:uuid:ff3aa8e4-3b95-5c30-935d-107c048fcd65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 5.2.7-tuxcare.8 of @angular/platform-server, and is fixed in 5.2.7-tuxcare.9." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.8" } ], "bom-ref": "urn:uuid:d3d1f77f-5d11-5a78-9f35-a067d9850414", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-111754 does not affect version 5.2.7-tuxcare.8 of @angular/platform-server. not_affected \u2014 Angular 5.2.7 is not affected by CVE-2026-111754. The vulnerability requires WHATWG URL normalization to transform dot-segment paths like `/.//evil.test` into protocol-relative pathnames (`//evil.test`), followed by automatic HTTP redirect emission. Angular 5.2.7 uses legacy Node.js `url.parse()` which does not normalize dot-segments, keeping the pathname as `/.//evil.test`. Additionally, 5.2.7...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.8" } ], "bom-ref": "urn:uuid:7dbbed9d-c1b3-56d4-a4c9-6582b8c0a28d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 5.2.7-tuxcare.8 of @angular/platform-server. not_affected \u2014 Angular version 5.2.7 is not affected by CVE-2026-41423. The vulnerability exists in later Angular versions (9+) that use the WHATWG URL API with hostname tracking. Version 5.2.7 uses Node's legacy url.parse() API and only tracks pathname/search/hash components, making the SSRF attack vector via hostname override impossible.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.8" } ], "bom-ref": "urn:uuid:e3ecf10e-be67-5638-8774-e5c4a2122af8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.7-tuxcare.8 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.8" } ], "bom-ref": "urn:uuid:722a88a1-eb04-5dcf-9571-0325dbfd5f6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.7-tuxcare.8 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.8" } ], "bom-ref": "urn:uuid:9c090aa4-4c7a-5bf8-bd47-f2cfbb43cd5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.7-tuxcare.8 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.8" } ], "bom-ref": "urn:uuid:f537737e-7889-556e-95f8-e241adaa33e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.7-tuxcare.8 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.8" } ], "bom-ref": "urn:uuid:5c806d93-bba1-5fac-b1b4-8bf1a14daf1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.7-tuxcare.8 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.8" } ], "bom-ref": "urn:uuid:d3a8e712-996d-5436-a91d-ee5070b9cf55", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.7-tuxcare.8 of @angular/platform-server. not_affected \u2014 CVE-2026-88056 describes a Unicode whitespace bypass vulnerability in Angular's SSR URL resolution utility (packages/platform-server/src/url.ts parseUrl function that uses String.prototype.trim()). This vulnerable component does not exist in version 5.2.7-tuxcare.5. The url.ts module was introduced in later commits (e46f82d67e on 2026-06-25, after the current HEAD dated 2026-08-14 but on a diff...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.8" } ], "bom-ref": "urn:uuid:944047ff-90ac-5dbf-ad6f-410f85da1ef9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 5.2.7-tuxcare.8 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.8" } ], "bom-ref": "urn:uuid:a4b82a8c-8644-5706-889a-31203cd560b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 5.2.7-tuxcare.8 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.8" } ] }