{
  "@id": "urn:uuid:95e634dd-103b-47da-ad9c-eabcf1f012d9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T15:11:52.923350+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2025-66412 is fixed in version 12.0.0-tuxcare.7 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2025-66412"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2026-101895 is fixed in version 12.0.0-tuxcare.7 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-101895"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2026-101896 affects version 12.0.0-tuxcare.7 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-101896"
      },
      "action_statement": "Vulnerability CVE-2026-101896 affects version 12.0.0-tuxcare.7 of @angular/forms."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2026-41423 does not affect version 12.0.0-tuxcare.7 of @angular/forms. not_affected \u2014 The target repository (Angular v12.0.0-tuxcare.2) is not affected by CVE-2026-41423. This version uses Node.js url.parse() for URL parsing, which does not exhibit the hostname override vulnerability. The CVE affects Angular versions 21.0.4+ where the codebase was refactored to use the URL constructor with a base parameter, allowing protocol-relative URLs (//evil.com) to override the hostname. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41423"
      },
      "impact_statement": "not_affected \u2014 The target repository (Angular v12.0.0-tuxcare.2) is not affected by CVE-2026-41423. This version uses Node.js url.parse() for URL parsing, which does not exhibit the hostname override vulnerability. The CVE affects Angular versions 21.0.4+ where the codebase was refactored to use the URL constructor with a base parameter, allowing protocol-relative URLs (//evil.com) to override the hostname. T..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2026-46417 is fixed in version 12.0.0-tuxcare.7 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-46417"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2026-50168 is fixed in version 12.0.0-tuxcare.7 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-50168"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2026-50169 is fixed in version 12.0.0-tuxcare.7 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-50169"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2026-50184 is fixed in version 12.0.0-tuxcare.7 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-50184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2026-50555 is fixed in version 12.0.0-tuxcare.7 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-50555"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2026-50556 is fixed in version 12.0.0-tuxcare.7 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-50556"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2026-54264 does not affect version 12.0.0-tuxcare.7 of @angular/forms. not_affected \u2014 Angular version 12.0.0 is not affected by CVE-2026-54264. The service worker's AssetGroup class does not preserve request headers when making network requests, including on cross-origin redirects. Version 12.0.0 predates the architectural change that introduced metadata preservation (including headers), which was later found to be vulnerable in versions 20.x-22.x.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54264"
      },
      "impact_statement": "not_affected \u2014 Angular version 12.0.0 is not affected by CVE-2026-54264. The service worker's AssetGroup class does not preserve request headers when making network requests, including on cross-origin redirects. Version 12.0.0 predates the architectural change that introduced metadata preservation (including headers), which was later found to be vulnerable in versions 20.x-22.x."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2026-54265 does not affect version 12.0.0-tuxcare.7 of @angular/forms. not_affected \u2014 Angular 12.0.0-tuxcare.2 is not affected by CVE-2026-54265. The vulnerability is specific to the Ivy template pipeline architecture with TwoWayProperty IR operations (introduced in Angular 20+). Angular 12 uses a different architecture where two-way bindings are desugared at parse time into separate property and event bindings, and the property binding is sanitized through the same code path as...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54265"
      },
      "impact_statement": "not_affected \u2014 Angular 12.0.0-tuxcare.2 is not affected by CVE-2026-54265. The vulnerability is specific to the Ivy template pipeline architecture with TwoWayProperty IR operations (introduced in Angular 20+). Angular 12 uses a different architecture where two-way bindings are desugared at parse time into separate property and event bindings, and the property binding is sanitized through the same code path as..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2026-69149 is fixed in version 12.0.0-tuxcare.7 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-69149"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2026-88056 does not affect version 12.0.0-tuxcare.7 of @angular/forms. not_affected \u2014 Angular 12.0.0 is not affected by CVE-2026-88056. The vulnerability pattern (String.prototype.trim() in URL resolution causing Unicode whitespace mismatch) was never present in this version. The original code used Node.js legacy url.parse() and WHATWG URL, neither of which strip Unicode whitespace, preventing the validation/resolution discrepancy described in the CVE. TuxCare's commit ae6a0227c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-88056"
      },
      "impact_statement": "not_affected \u2014 Angular 12.0.0 is not affected by CVE-2026-88056. The vulnerability pattern (String.prototype.trim() in URL resolution causing Unicode whitespace mismatch) was never present in this version. The original code used Node.js legacy url.parse() and WHATWG URL, neither of which strip Unicode whitespace, preventing the validation/resolution discrepancy described in the CVE. TuxCare's commit ae6a0227c..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2026-88058 is fixed in version 12.0.0-tuxcare.7 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-88058"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-18T23:35:04.706370+00:00",
      "status_notes": "Vulnerability CVE-2026-88060 is fixed in version 12.0.0-tuxcare.7 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-88060"
      }
    }
  ]
}