{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a984a9b4-519c-5612-b3fe-c6e4875a8f10", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/forms", "purl": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5", "version": "11.2.11-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:cadc02ed-d01f-5417-8707-fa3b93542594", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:e35da360-adb1-51b0-8ced-0145609b77b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:6c94735c-3d75-5705-8601-682a84e01b38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5992514b-e953-51ac-8d68-e621676f0d49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:a0db53d5-0ba4-5819-8197-abc84397e4f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5061a762-a97e-5bdd-8d20-50d3eb708001", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:8e1ad176-d3d8-55d9-aa09-6701526387fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c35d2efe-71f1-58f2-8405-164bd6f6576a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:224b8422-4d93-55f1-b819-974440a8d05e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 11.2.11-tuxcare.5 of @angular/forms. not_affected \u2014 Angular v11.2.11 is NOT AFFECTED by CVE-2026-50170. The vulnerability affects the HTTP transfer cache feature introduced in Angular v16+, which automatically caches HTTP responses during SSR and replays them during client hydration. This feature does not exist in v11.2.11. The target lacks the entire transfer_cache.ts module, withHttpTransferCache API, transferCacheInterceptorFn, and client hyd...", "justification": "code_not_present" } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:dceaed64-f697-5d53-a35f-d2b3ec2bc810", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:6a91bde1-b282-5f8a-98eb-7bd87ecda670", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7aad7f01-2771-594b-b474-e1f2039253b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 11.2.11-tuxcare.5 of @angular/forms. already_fixed \u2014 CVE-2026-50555 has already been fixed in the target repository. The fix is implemented in tools/postinstall-patches.js (lines 96-139) which patches the domino dependency during installation. The fix adds NOSCRIPT to hasRawContent, removes _scripting_enabled conditionals, and implements escapeMatchingClosingTag to prevent XSS via raw-text element breakout.", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:99ae1d1f-fac8-5cb9-b8a5-60da16490747", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:54598f87-3caa-56c7-bd00-4d0842f53f5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:bdc2cc7e-6199-5141-ba1a-fe995421ee73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:63a02b7f-139e-53cc-855f-db24a37a24c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 11.2.11-tuxcare.5 of @angular/forms. not_affected \u2014 Angular 11.2.11-tuxcare.2 is NOT AFFECTED by CVE-2026-54264. The service worker in this version does not forward request headers during asset reconstruction, eliminating the cross-origin credential leak vulnerability. The vulnerable method `newRequestWithMetadata` that copies headers from the original request does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:2a00a72f-9d86-5a18-afdb-36424fbf1685", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 11.2.11-tuxcare.5 of @angular/forms. not_affected \u2014 Angular 11.2.11 is not affected by CVE-2026-54265. The vulnerability targets the new Ivy compiler's TwoWayProperty operation in the template compilation pipeline, which does not exist in Angular 11.2.11. In this version, two-way bindings desugar through the same sanitization-aware parsePropertyBinding code path as one-way bindings, ensuring security-sensitive properties are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:347cc8f5-09a5-5123-bed1-4a9bc9b3b50b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 11.2.11-tuxcare.5 of @angular/forms. not_affected \u2014 Angular version 11.2.11 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache key generation does not exist in this version. This feature was introduced in Angular v16, and version 11.2.11 predates it entirely.", "justification": "code_not_present" } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:659226df-6e55-5975-9bd8-454353c434a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5b6f7206-256f-502e-b7a8-52b0207947d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:71a3f62f-c33e-5f89-b56d-57e5d63d2453", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 11.2.11-tuxcare.5 of @angular/forms. not_affected \u2014 Angular 11.2.11 does not have the HttpTransferCache feature. The vulnerability CVE-2026-68945 affects HttpTransferCache, which was introduced in Angular 16.0.0 (March 2023), approximately 2 years after Angular 11.2.11 was released. The file packages/common/http/src/transfer_cache.ts does not exist in the target version. Angular 11 has a generic TransferState feature for manual state transfer bu...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:ac00babb-c4fd-5e08-9137-7b80943fe08f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:0a91aefd-d31c-5443-83ca-e8a1660af557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:02042450-d330-52d0-ab91-cd8667f7ce27", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 11.2.11-tuxcare.5 of @angular/forms. not_affected \u2014 Angular 11.2.11 is not affected by CVE-2026-88056. The vulnerability was introduced in Angular 19.x when URL resolution logic was refactored to include `String.prototype.trim()`, which strips Unicode whitespace and creates a discrepancy with WHATWG URL parsing. Angular 11.x never contained this vulnerable code pattern\u2014its URL resolution directly uses WHATWG URL standard without intermediate str...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:689e0ca2-a3b9-5d00-8988-dd645520e03a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 11.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:e04c589c-f3d7-5a6c-89b3-b8c4388bc9bf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 11.2.11-tuxcare.5 of @angular/forms. not_affected \u2014 Angular 11.2.11 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache interceptor and the hierarchical HttpClient delegation API (withRequestsMadeViaParent()), both introduced in Angular 16+. Angular 11 lacks the entire feature: packages/common/http/src/transfer_cache.ts does not exist, no HttpTransferCache class or interceptor is present, and neither withRequestsMadeV...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:1dcb1bb2-8df9-5c73-a35d-e156505a2574", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 11.2.11-tuxcare.5 of @angular/forms." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@11.2.11-tuxcare.5" } ] }