{
  "@id": "urn:uuid:0b445b52-4285-422f-81ec-14fb44e2a547",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:18:05.828019+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@9.1.13",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@9.1.13"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2025-66035 affects version 9.1.13 of @angular/common, and is fixed in 9.1.13-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2025-66035"
      },
      "action_statement": "Vulnerability CVE-2025-66035 affects version 9.1.13 of @angular/common, and is fixed in 9.1.13-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@9.1.13",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@9.1.13"
          }
        }
      ],
      "timestamp": "2026-10-20T20:46:00.144564+00:00",
      "status_notes": "Vulnerability CVE-2026-111753 affects version 9.1.13 of @angular/common.",
      "vulnerability": {
        "name": "CVE-2026-111753"
      },
      "action_statement": "Vulnerability CVE-2026-111753 affects version 9.1.13 of @angular/common."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@9.1.13",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@9.1.13"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-50170 does not affect version 9.1.13 of @angular/common. not_affected \u2014 Angular v9.1.13 is not affected by CVE-2026-50170. The vulnerability exists in Angular's HttpTransferCache feature, which was introduced in Angular v16+. This feature does not exist in v9.1.13, making the vulnerability pattern impossible to manifest.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50170"
      },
      "impact_statement": "not_affected \u2014 Angular v9.1.13 is not affected by CVE-2026-50170. The vulnerability exists in Angular's HttpTransferCache feature, which was introduced in Angular v16+. This feature does not exist in v9.1.13, making the vulnerability pattern impossible to manifest."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@9.1.13",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@9.1.13"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-50171 affects version 9.1.13 of @angular/common, and is fixed in 9.1.13-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-50171"
      },
      "action_statement": "Vulnerability CVE-2026-50171 affects version 9.1.13 of @angular/common, and is fixed in 9.1.13-tuxcare.10."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@9.1.13",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@9.1.13"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-54266 does not affect version 9.1.13 of @angular/common. not_affected \u2014 Angular 9.1.13-tuxcare.9 does not contain the HttpTransferCache feature. The vulnerability CVE-2026-54266 affects the hash generation in HttpTransferCache, a feature introduced in Angular v16+. The target version (9.1.13) predates this feature by many major versions. While TransferState (generic state serialization) exists in v9, there is no HTTP caching integration that uses it. The packages/c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54266"
      },
      "impact_statement": "not_affected \u2014 Angular 9.1.13-tuxcare.9 does not contain the HttpTransferCache feature. The vulnerability CVE-2026-54266 affects the hash generation in HttpTransferCache, a feature introduced in Angular v16+. The target version (9.1.13) predates this feature by many major versions. While TransferState (generic state serialization) exists in v9, there is no HTTP caching integration that uses it. The packages/c..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@9.1.13",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@9.1.13"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-54268 affects version 9.1.13 of @angular/common, and is fixed in 9.1.13-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-54268"
      },
      "action_statement": "Vulnerability CVE-2026-54268 affects version 9.1.13 of @angular/common, and is fixed in 9.1.13-tuxcare.10."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@9.1.13",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@9.1.13"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-68945 does not affect version 9.1.13 of @angular/common. not_affected \u2014 Angular v9.1.13 is not affected by CVE-2026-68945. The vulnerable HttpTransferCache feature was introduced in Angular v16.0.0 (March 2023), approximately 7 major versions after v9.1.13. The target version does not contain the HttpTransferCache code, the transfer_cache.ts file, or any automatic HTTP request caching mechanism that could exhibit the cache-key ambiguity vulnerability. While v9 does...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68945"
      },
      "impact_statement": "not_affected \u2014 Angular v9.1.13 is not affected by CVE-2026-68945. The vulnerable HttpTransferCache feature was introduced in Angular v16.0.0 (March 2023), approximately 7 major versions after v9.1.13. The target version does not contain the HttpTransferCache code, the transfer_cache.ts file, or any automatic HTTP request caching mechanism that could exhibit the cache-key ambiguity vulnerability. While v9 does..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@9.1.13",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@9.1.13"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-88059 does not affect version 9.1.13 of @angular/common. not_affected \u2014 Angular 9.1.13 is not affected by CVE-2026-88059. The vulnerability targets HttpTransferCache's cache eligibility evaluation in hierarchical HttpClient configurations using withRequestsMadeViaParent(). These features (HttpTransferCache, provideClientHydration, withRequestsMadeViaParent, provideHttpClient) were introduced in Angular 16 and do not exist in Angular 9.1.13, which uses the older NgM...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-88059"
      },
      "impact_statement": "not_affected \u2014 Angular 9.1.13 is not affected by CVE-2026-88059. The vulnerability targets HttpTransferCache's cache eligibility evaluation in hierarchical HttpClient configurations using withRequestsMadeViaParent(). These features (HttpTransferCache, provideClientHydration, withRequestsMadeViaParent, provideHttpClient) were introduced in Angular 16 and do not exist in Angular 9.1.13, which uses the older NgM..."
    }
  ]
}