{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:41ef9ab6-c109-57bc-af61-ead4a1736e24", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/animations", "purl": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12", "type": "library", "bom-ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12", "version": "8.2.14-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:f40100af-e232-5aa3-bd2c-6177110cbb31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:1ceb8505-1be1-535e-8b8a-8f13eab52d34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:d7a47645-e08d-5228-ba6f-14c3b29da87d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:dcdd0f3e-47b6-5726-9821-369cd7414908", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:9a2c436a-a99f-5fcf-8c6f-1ff71d479588", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:4a494f20-435f-5c87-9e60-df9a34db1d75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:9cba2115-3444-5a3a-89cd-aa1d25106653", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:16d4571a-e439-51c5-b3f2-8fc41d845801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:7766216e-277a-5ea6-a209-3251c95ae46c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:f82398b5-cdf2-5f3b-b283-e03dbbbe69ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:2625892b-3dc3-5cf7-ac07-5f511ce3590a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:43aa4c18-9be2-55db-af2c-a8e3bd15d2e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:e1a2b70f-efb9-5d3c-b784-d0a7fd4f15f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:06811b42-a837-58cf-8a9c-218bcbca6b03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:164368fb-9330-5b25-b678-294b8a5c3bdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:49fb086f-faa3-558b-a263-0fbc644d297f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:2108be42-7b5d-537f-a28a-e05097e08f6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:2740cf73-3acf-5351-b43a-0b31e1104b7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:a2e6da4c-a2d2-5350-a91e-80c76dbc943e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:4922b67f-3a2a-5414-8361-9130918a0cd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:79843c90-9acc-5296-b955-7912406e2c7e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.12 of @angular/animations. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:f8a182d2-8e8c-5051-84f2-0e80b6385422", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:9ffea713-f547-5749-b1b5-0caef1e1f74b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:898d7ba5-719f-5a15-a058-5c4175864cc5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.12 of @angular/animations. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:c0252f84-6c05-56ef-b695-6e27dc6430a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 8.2.14-tuxcare.12 of @angular/animations." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:4021f96e-78ea-5361-af8f-8842fa3ca7bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.12 of @angular/animations. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:f2fa048b-7ac1-5cf7-bbed-ac93d5bb0c5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 8.2.14-tuxcare.12 of @angular/animations." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.12" } ] }