{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7a7360d3-4aa4-502c-b022-d04c8a45723e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.6", "version": "15.2.9-tuxcare.6", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@15.2.9", "type": "library", "version": "15.2.9" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.6" } ], "bom-ref": "urn:uuid:1785f2ef-2bad-5314-9d6a-b1037fa8c706", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 15.2.9-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.6" } ], "bom-ref": "urn:uuid:3a6c3fe8-ca99-5625-bf27-9935a039708f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 15.2.9-tuxcare.6 of @angular/platform-server, and is fixed in 15.2.9-tuxcare.7." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.6" } ], "bom-ref": "urn:uuid:38a1a76f-8d11-5d69-b738-eada6c16133f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111754 affects version 15.2.9-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.6" } ], "bom-ref": "urn:uuid:dfbfcd81-9733-5c52-b284-cd70d9c8e2a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.6 of @angular/platform-server. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.6" } ], "bom-ref": "urn:uuid:a8725d5f-fe3d-50b1-89e2-0a515dc429b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.9-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.6" } ], "bom-ref": "urn:uuid:1c4e9b1e-576f-526a-8490-96086f8d6af8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.9-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.6" } ], "bom-ref": "urn:uuid:bf0e08a5-5474-5f63-8b73-75d6621a3818", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.9-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.6" } ], "bom-ref": "urn:uuid:c7cf7410-03f4-5a78-be4b-b8aa2a321583", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.9-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.6" } ], "bom-ref": "urn:uuid:b433a59c-dc4a-59a1-a274-dcf446174355", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 15.2.9-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.6" } ], "bom-ref": "urn:uuid:735730df-e384-5a0c-9e9f-4a357e1a559a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 15.2.9-tuxcare.6 of @angular/platform-server. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-88056. The vulnerability requires URL resolution utilities that use String.prototype.trim() on URLs (specifically in HTTP interceptors like relativeUrlsTransformerInterceptorFn), creating a discrepancy with WHATWG URL parsing that enables SSRF. This code pattern does not exist in Angular 15.2.9 and was introduced in later Angular versions (16+). The ta...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.6" } ], "bom-ref": "urn:uuid:545cd47c-0ce6-54ef-bd06-781744275858", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 15.2.9-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.6" } ], "bom-ref": "urn:uuid:98cf3fd7-eaab-531c-b9d6-c15ba2fc5aa7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 15.2.9-tuxcare.6 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9-tuxcare.6" } ] }