{
  "@id": "urn:uuid:ca154a87-6430-4817-9ccf-c949e469f57e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:18:05.828019+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@11.2.14",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@11.2.14"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2025-66035 affects version 11.2.14 of @angular/common, and is fixed in 11.2.14-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2025-66035"
      },
      "action_statement": "Vulnerability CVE-2025-66035 affects version 11.2.14 of @angular/common, and is fixed in 11.2.14-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@11.2.14",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@11.2.14"
          }
        }
      ],
      "timestamp": "2026-10-20T20:46:00.144564+00:00",
      "status_notes": "Vulnerability CVE-2026-111753 affects version 11.2.14 of @angular/common.",
      "vulnerability": {
        "name": "CVE-2026-111753"
      },
      "action_statement": "Vulnerability CVE-2026-111753 affects version 11.2.14 of @angular/common."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@11.2.14",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@11.2.14"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-50170 does not affect version 11.2.14 of @angular/common. not_affected \u2014 Angular v11.2.14 is NOT affected by CVE-2026-50170. The vulnerability requires the HttpTransferCache feature for server-side rendering (SSR) and client hydration, which was introduced in Angular v16. Version 11.2.14 predates this feature and lacks the vulnerable code path entirely.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50170"
      },
      "impact_statement": "not_affected \u2014 Angular v11.2.14 is NOT affected by CVE-2026-50170. The vulnerability requires the HttpTransferCache feature for server-side rendering (SSR) and client hydration, which was introduced in Angular v16. Version 11.2.14 predates this feature and lacks the vulnerable code path entirely."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@11.2.14",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@11.2.14"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-50171 affects version 11.2.14 of @angular/common, and is fixed in 11.2.14-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-50171"
      },
      "action_statement": "Vulnerability CVE-2026-50171 affects version 11.2.14 of @angular/common, and is fixed in 11.2.14-tuxcare.7."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@11.2.14",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@11.2.14"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-54266 does not affect version 11.2.14 of @angular/common. not_affected \u2014 Angular 11.2.14-tuxcare.7 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash does not exist in this version. HttpTransferCache was introduced in Angular 16.0.0 (March 2023), while the target is Angular 11.2.14 (released much earlier). The file packages/common/http/src/transfer_cache.ts and its vulnerable generateHash() function do not exist in the ta...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54266"
      },
      "impact_statement": "not_affected \u2014 Angular 11.2.14-tuxcare.7 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash does not exist in this version. HttpTransferCache was introduced in Angular 16.0.0 (March 2023), while the target is Angular 11.2.14 (released much earlier). The file packages/common/http/src/transfer_cache.ts and its vulnerable generateHash() function do not exist in the ta..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@11.2.14",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@11.2.14"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-54268 affects version 11.2.14 of @angular/common, and is fixed in 11.2.14-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-54268"
      },
      "action_statement": "Vulnerability CVE-2026-54268 affects version 11.2.14 of @angular/common, and is fixed in 11.2.14-tuxcare.7."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@11.2.14",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@11.2.14"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-68945 does not affect version 11.2.14 of @angular/common. not_affected \u2014 Angular 11.2.14 is not affected by CVE-2026-68945. The vulnerability concerns Angular's `HttpTransferCache` feature, which automatically caches HTTP requests during Server-Side Rendering (SSR) and can generate ambiguous cache keys from repeated HTTP parameters. This feature does not exist in Angular 11.2.14 - it was introduced in later versions (between v11 and v20). The fix commit \"distinguish...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68945"
      },
      "impact_statement": "not_affected \u2014 Angular 11.2.14 is not affected by CVE-2026-68945. The vulnerability concerns Angular's `HttpTransferCache` feature, which automatically caches HTTP requests during Server-Side Rendering (SSR) and can generate ambiguous cache keys from repeated HTTP parameters. This feature does not exist in Angular 11.2.14 - it was introduced in later versions (between v11 and v20). The fix commit \"distinguish..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@11.2.14",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@11.2.14"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-88059 does not affect version 11.2.14 of @angular/common. not_affected \u2014 Angular version 11.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and modern SSR hydration features that were introduced approximately 3 years after this version (October 2023+). At version 11.2.14, Angular uses traditional NgModule-based HttpClient configuration with no hierarchical delegation mechanism or automatic HTTP reque...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-88059"
      },
      "impact_statement": "not_affected \u2014 Angular version 11.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and modern SSR hydration features that were introduced approximately 3 years after this version (October 2023+). At version 11.2.14, Angular uses traditional NgModule-based HttpClient configuration with no hierarchical delegation mechanism or automatic HTTP reque..."
    }
  ]
}