{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:51d68b58-0e52-596c-bf72-46452a894b59", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.9", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.9", "version": "5.2.7-tuxcare.9", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@5.2.7", "type": "library", "version": "5.2.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.9" } ], "bom-ref": "urn:uuid:f08030ca-9927-5aa4-ae06-f81c17659616", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 5.2.7-tuxcare.9 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.9" } ], "bom-ref": "urn:uuid:1ae3dd3f-3939-5a17-be95-7b38b36e400e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 5.2.7-tuxcare.9 of @angular/platform-server." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.9" } ], "bom-ref": "urn:uuid:e5d3c7b6-f007-5bee-81b4-cb1fa06f9a5f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-111754 does not affect version 5.2.7-tuxcare.9 of @angular/platform-server. not_affected \u2014 Angular 5.2.7 is not affected by CVE-2026-111754. The vulnerability requires WHATWG URL normalization to transform dot-segment paths like `/.//evil.test` into protocol-relative pathnames (`//evil.test`), followed by automatic HTTP redirect emission. Angular 5.2.7 uses legacy Node.js `url.parse()` which does not normalize dot-segments, keeping the pathname as `/.//evil.test`. Additionally, 5.2.7...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.9" } ], "bom-ref": "urn:uuid:0199f63c-85f2-573f-a980-44dd3deb0099", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 5.2.7-tuxcare.9 of @angular/platform-server. not_affected \u2014 Angular version 5.2.7 is not affected by CVE-2026-41423. The vulnerability exists in later Angular versions (9+) that use the WHATWG URL API with hostname tracking. Version 5.2.7 uses Node's legacy url.parse() API and only tracks pathname/search/hash components, making the SSRF attack vector via hostname override impossible.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.9" } ], "bom-ref": "urn:uuid:394a760b-f905-599e-9ca1-e001d43a416b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.7-tuxcare.9 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.9" } ], "bom-ref": "urn:uuid:746750e4-102c-5b0b-ba90-d97d12ab1316", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.7-tuxcare.9 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.9" } ], "bom-ref": "urn:uuid:60f29310-c821-520d-bb88-b41c492ab6b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.7-tuxcare.9 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.9" } ], "bom-ref": "urn:uuid:ab95ffee-4d25-56be-8c69-ea89e2deb218", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.7-tuxcare.9 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.9" } ], "bom-ref": "urn:uuid:42e0dedc-1471-5969-8099-bfe9bbfb2f7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.7-tuxcare.9 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.9" } ], "bom-ref": "urn:uuid:a466b43e-22cb-516a-b957-065e844328b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.7-tuxcare.9 of @angular/platform-server. not_affected \u2014 CVE-2026-88056 describes a Unicode whitespace bypass vulnerability in Angular's SSR URL resolution utility (packages/platform-server/src/url.ts parseUrl function that uses String.prototype.trim()). This vulnerable component does not exist in version 5.2.7-tuxcare.5. The url.ts module was introduced in later commits (e46f82d67e on 2026-06-25, after the current HEAD dated 2026-08-14 but on a diff...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.9" } ], "bom-ref": "urn:uuid:8aba3e8b-1726-51b5-a193-8712637877b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 5.2.7-tuxcare.9 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.9" } ], "bom-ref": "urn:uuid:34d2b1a3-496c-59d4-b13c-5c1d8651eb45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 5.2.7-tuxcare.9 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@5.2.7-tuxcare.9" } ] }