{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2314b818-3a38-56f9-851d-93ffbfd91943",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/platform-server",
      "purl": "pkg:npm/%40angular/platform-server@12.0.0-tuxcare.7",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/platform-server@12.0.0-tuxcare.7",
      "version": "12.0.0-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/platform-server",
            "purl": "pkg:npm/%40angular/platform-server@12.0.0",
            "type": "library",
            "version": "12.0.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-59052",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@12.0.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:70b27980-9cf2-5e8a-b32b-84ef32e5e167",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-59052 affects version 12.0.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-101895",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@12.0.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:7e90723a-25b6-597a-8d9d-3532cf88f9f0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-101895 is fixed in version 12.0.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-111754",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@12.0.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:546ceaf1-1ac3-52ab-854f-65ba1fab6ddc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111754 affects version 12.0.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-41423",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@12.0.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:1bad70b6-ddee-52eb-9b2b-79fb71709e0b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41423 does not affect version 12.0.0-tuxcare.7 of @angular/platform-server. not_affected \u2014 The target repository (Angular v12.0.0-tuxcare.2) is not affected by CVE-2026-41423. This version uses Node.js url.parse() for URL parsing, which does not exhibit the hostname override vulnerability. The CVE affects Angular versions 21.0.4+ where the codebase was refactored to use the URL constructor with a base parameter, allowing protocol-relative URLs (//evil.com) to override the hostname. T...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@12.0.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:2172e1c1-8c85-5670-8590-b99c90785636",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 12.0.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@12.0.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:6ad17882-a1e2-5cfd-b028-7515d7d05c47",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50168 is fixed in version 12.0.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@12.0.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:4a0e149c-d5ee-5e48-93c8-0259503f41c1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 12.0.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@12.0.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:eb70cb55-9797-52d9-abf2-0bee837bb6f5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 12.0.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@12.0.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:5fcc7794-1072-5282-ba0c-cf5ce3f6a8e3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69149 is fixed in version 12.0.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@12.0.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:28e9a692-7ce1-5296-8ba9-0556ec523191",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 12.0.0-tuxcare.7 of @angular/platform-server. not_affected \u2014 Angular 12.0.0 is not affected by CVE-2026-88056. The vulnerability pattern (String.prototype.trim() in URL resolution causing Unicode whitespace mismatch) was never present in this version. The original code used Node.js legacy url.parse() and WHATWG URL, neither of which strip Unicode whitespace, preventing the validation/resolution discrepancy described in the CVE. TuxCare's commit ae6a0227c...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88058",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@12.0.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:15d9bd2e-df39-5672-995f-fc5075cf42e6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88058 is fixed in version 12.0.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@12.0.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:30c14c26-80aa-5704-b621-c2454dd1833b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88060 is fixed in version 12.0.0-tuxcare.7 of @angular/platform-server."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/platform-server@12.0.0-tuxcare.7"
    }
  ]
}