{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:34915958-4e2c-5219-ac2e-d102914a4444", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.8", "version": "10.1.0-tuxcare.8", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@10.1.0", "type": "library", "version": "10.1.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:9855e926-13db-56ee-ac63-126ebaeb7561", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 10.1.0-tuxcare.8 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:c9c376e1-7fb2-52af-b94d-2937c0d3376c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 10.1.0-tuxcare.8 of @angular/platform-server." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:90e0c887-d899-546b-a213-4f0cdd59870f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111754 affects version 10.1.0-tuxcare.8 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:8e8e3741-f813-5e18-b83c-8c00b2e1397d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 10.1.0-tuxcare.8 of @angular/platform-server. not_affected \u2014 Version 10.1.0 uses Node.js legacy url.parse() API which does not parse protocol-relative URLs (//host) or backslash-prefixed URLs (/\\host) in a way that allows hostname hijacking. The SSRF vulnerability only manifests when using the WHATWG URL API (new URL()) without protection.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:0a1b0a84-c2a8-58b1-b2f9-7efa7a0bc819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 10.1.0-tuxcare.8 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:3fb2b44b-99c8-5c2d-82b7-1e33b308f284", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 10.1.0-tuxcare.8 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:ddf75b20-f8ea-527f-ab92-2179bbbd1bc9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 10.1.0-tuxcare.8 of @angular/platform-server. already_fixed \u2014 CVE-2026-50555 has been addressed in this Angular repository through a TuxCare backport (commit 72e33f04a7, June 30 2026). The fix patches the domino dependency via postinstall script to escape closing tag patterns in noscript elements, preventing XSS via breakout injection.", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:23fd58fa-4af6-5967-9e44-3894b6a4a4b5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 10.1.0-tuxcare.8 of @angular/platform-server. already_fixed \u2014 CVE-2026-50556 has already been fixed in the target repository. The fix is present in tools/postinstall-patches.js (lines 104-142) and was committed on 2026-07-01 in commit 138c554f9d. The target applies the exact same fix as the upstream patch f74cccd496283b6141fbdbeb25b168f4b1c9836a via a postinstall script that patches the domino dependency.", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:e548a069-3dad-55f1-ac5c-a422c68a7673", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 10.1.0-tuxcare.8 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:b22cdfb8-a94f-50e8-9abb-84a1d790262a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 10.1.0-tuxcare.8 of @angular/platform-server. not_affected \u2014 Angular version 10.1.0 is not affected by CVE-2026-88056. The vulnerability requires `String.prototype.trim()` to be applied to URLs before resolution, creating a mismatch between WHATWG URL validation and Angular's internal processing. Version 10.1.0's implementation does not contain this vulnerable code pattern. The `parseUrl` function in v10.1.0 passes URL strings directly to the `new URL()`...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:2e96ab9d-30c5-5981-ad08-0c80d5891397", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 10.1.0-tuxcare.8 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:6e4098f3-310a-5e12-8a7b-995572d45d2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 10.1.0-tuxcare.8 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.8" } ] }