{
  "@id": "urn:uuid:4e4141a0-6091-4e04-8438-69dd56098b8f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:18:05.828019+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2025-66035 affects version 14.2.8 of @angular/common, and is fixed in 14.2.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-66035"
      },
      "action_statement": "Vulnerability CVE-2025-66035 affects version 14.2.8 of @angular/common, and is fixed in 14.2.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-20T20:47:00.216698+00:00",
      "status_notes": "Vulnerability CVE-2026-111753 affects version 14.2.8 of @angular/common.",
      "vulnerability": {
        "name": "CVE-2026-111753"
      },
      "action_statement": "Vulnerability CVE-2026-111753 affects version 14.2.8 of @angular/common."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-50170 does not affect version 14.2.8 of @angular/common. not_affected \u2014 Angular v14.2.8-tuxcare.1 is not affected by CVE-2026-50170. The HTTP Transfer Cache feature, which is the vulnerable component, does not exist in this version. This feature was introduced in Angular v16+. The target repository lacks the transfer_cache.ts file and all related functionality (provideClientHydration, withHttpTransferCache, transferCacheInterceptorFn, hasAuthHeaders, shouldCacheReq...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50170"
      },
      "impact_statement": "not_affected \u2014 Angular v14.2.8-tuxcare.1 is not affected by CVE-2026-50170. The HTTP Transfer Cache feature, which is the vulnerable component, does not exist in this version. This feature was introduced in Angular v16+. The target repository lacks the transfer_cache.ts file and all related functionality (provideClientHydration, withHttpTransferCache, transferCacheInterceptorFn, hasAuthHeaders, shouldCacheReq..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-50171 affects version 14.2.8 of @angular/common, and is fixed in 14.2.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-50171"
      },
      "action_statement": "Vulnerability CVE-2026-50171 affects version 14.2.8 of @angular/common, and is fixed in 14.2.8-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-54266 does not affect version 14.2.8 of @angular/common. not_affected \u2014 Angular 14.2.8 is not affected by CVE-2026-54266. The HttpTransferCache feature containing the vulnerable weak hash function was introduced in Angular 16+, and does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54266"
      },
      "impact_statement": "not_affected \u2014 Angular 14.2.8 is not affected by CVE-2026-54266. The HttpTransferCache feature containing the vulnerable weak hash function was introduced in Angular 16+, and does not exist in this version."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-54268 affects version 14.2.8 of @angular/common, and is fixed in 14.2.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-54268"
      },
      "action_statement": "Vulnerability CVE-2026-54268 affects version 14.2.8 of @angular/common, and is fixed in 14.2.8-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-68945 does not affect version 14.2.8 of @angular/common. not_affected \u2014 Angular v14.2.8 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature (which generates ambiguous cache keys for HTTP requests with repeated parameters during SSR) does not exist in this version. HttpTransferCache was introduced in Angular v16.0.0, well after v14.2.8. The repository contains only the base TransferState API (a generic key-value store) and basic HTTP intercep...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68945"
      },
      "impact_statement": "not_affected \u2014 Angular v14.2.8 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature (which generates ambiguous cache keys for HTTP requests with repeated parameters during SSR) does not exist in this version. HttpTransferCache was introduced in Angular v16.0.0, well after v14.2.8. The repository contains only the base TransferState API (a generic key-value store) and basic HTTP intercep..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-88059 does not affect version 14.2.8 of @angular/common. not_affected \u2014 Angular 14.2.8 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent), client hydration (provideClientHydration), and the functional provider API (provideHttpClient) - all features introduced in Angular 15-16+. Angular 14.2.8 uses the legacy NgModule-based HttpClientModule and has no HttpTransferCache f...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-88059"
      },
      "impact_statement": "not_affected \u2014 Angular 14.2.8 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent), client hydration (provideClientHydration), and the functional provider API (provideHttpClient) - all features introduced in Angular 15-16+. Angular 14.2.8 uses the legacy NgModule-based HttpClientModule and has no HttpTransferCache f..."
    }
  ]
}