{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4ecd8a7e-15b8-5e8f-aeab-939f07a9c031",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/common",
      "purl": "pkg:npm/%40angular/common@12.2.16-tuxcare.6",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/common@12.2.16-tuxcare.6",
      "version": "12.2.16-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/common",
            "purl": "pkg:npm/%40angular/common@12.2.16",
            "type": "library",
            "version": "12.2.16"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@12.2.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:7c69fb65-4d0f-53bf-a93f-49b0a8831e6a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 12.2.16-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-111753",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@12.2.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:ea18eb70-f2d9-5e53-8aea-798e73de33a4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111753 affects version 12.2.16-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@12.2.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:7de5f3c2-93c5-5ee9-b667-19ff511ff34b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 12.2.16-tuxcare.6 of @angular/common. not_affected \u2014 Angular v12.2.16-tuxcare.2 is NOT affected by CVE-2026-50170. The vulnerability concerns the HttpTransferCache feature that caches credentialed HTTP responses during server-side rendering (SSR) and replays them during client hydration. This feature was introduced in Angular v16 and does not exist in v12.2.16. The target repository lacks the transfer_cache.ts file, HttpTransferCache class, trans...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@12.2.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:876a52ba-5450-5a57-8291-760680d784ea",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 12.2.16-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@12.2.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:3ecec2f8-8ebd-5fd1-b695-22a4fa9c829d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 12.2.16-tuxcare.6 of @angular/common. not_affected \u2014 Angular 12.2.16-tuxcare.2 does not contain the vulnerable HttpTransferCache feature. The feature was introduced in Angular 16.0.0 (March 31, 2023), several major versions after this release. Without HttpTransferCache, the attack chain from HTTP request properties to hash-based cache key generation to cache poisoning cannot occur.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@12.2.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:2854365d-26de-561a-86b3-6f54a4254a9d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 12.2.16-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@12.2.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:1fe5b1c6-f42a-5ea7-8910-199c2cabcc81",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.16-tuxcare.6 of @angular/common. not_affected \u2014 Angular version 12.2.16 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature was introduced in Angular 16.0.0 and does not exist in version 12.2.16. The file packages/common/http/src/transfer_cache.ts, the cache key generation logic, and all related APIs (provideClientHydration, withNoHttpTransferCache) are absent from this version. Version 12.2.16 predates the vulnerable...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@12.2.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:b155d2a3-85f7-5220-b6f7-79b9f2ce5c89",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.16-tuxcare.6 of @angular/common. not_affected \u2014 Angular 12.2.16 is not affected by CVE-2026-88059. The vulnerability requires the HttpTransferCache feature with hierarchical HttpClient delegation (withRequestsMadeViaParent()), which was introduced in Angular 16.0.0. Angular 12.2.16 predates this feature by 4 major versions and contains none of the required components: no HttpTransferCache, no withRequestsMadeViaParent(), no provideClientHydr...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/common@12.2.16-tuxcare.6"
    }
  ]
}