{
  "@id": "urn:uuid:b71a5810-50fb-42e8-97b4-0ffef8bc065d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T15:11:52.923350+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-101895 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-101895"
      },
      "action_statement": "Vulnerability CVE-2026-101895 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-101896 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic.",
      "vulnerability": {
        "name": "CVE-2026-101896"
      },
      "action_statement": "Vulnerability CVE-2026-101896 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-41423 does not affect version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic. not_affected \u2014 The target Angular version 12.2.0-tuxcare.2 is NOT AFFECTED by CVE-2026-41423. This version uses the Node.js legacy url.parse() API which does not parse protocol-relative URLs (//host) as absolute URLs. The vulnerable code pattern using WHATWG URL API (new URL(urlStr, origin)) was introduced in a later refactoring in October 2023 and does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41423"
      },
      "impact_statement": "not_affected \u2014 The target Angular version 12.2.0-tuxcare.2 is NOT AFFECTED by CVE-2026-41423. This version uses the Node.js legacy url.parse() API which does not parse protocol-relative URLs (//host) as absolute URLs. The vulnerable code pattern using WHATWG URL API (new URL(urlStr, origin)) was introduced in a later refactoring in October 2023 and does not exist in this version."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-46417 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-46417"
      },
      "action_statement": "Vulnerability CVE-2026-46417 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-50168 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50168"
      },
      "action_statement": "Vulnerability CVE-2026-50168 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-50169 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50169"
      },
      "action_statement": "Vulnerability CVE-2026-50169 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-50184 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50184"
      },
      "action_statement": "Vulnerability CVE-2026-50184 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-50555 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50555"
      },
      "action_statement": "Vulnerability CVE-2026-50555 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-50556 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50556"
      },
      "action_statement": "Vulnerability CVE-2026-50556 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-54264 does not affect version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic. not_affected \u2014 The target repository (Angular 12.2.0-tuxcare.2) is NOT AFFECTED by CVE-2026-54264. The AssetGroup class in this version intentionally strips ALL request metadata (including headers) when fetching assets, creating fresh requests with only URLs. This architectural design prevents credential headers from being transmitted to any origin, including on cross-origin redirects. The vulnerable method '...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54264"
      },
      "impact_statement": "not_affected \u2014 The target repository (Angular 12.2.0-tuxcare.2) is NOT AFFECTED by CVE-2026-54264. The AssetGroup class in this version intentionally strips ALL request metadata (including headers) when fetching assets, creating fresh requests with only URLs. This architectural design prevents credential headers from being transmitted to any origin, including on cross-origin redirects. The vulnerable method '..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-69149 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-69149"
      },
      "action_statement": "Vulnerability CVE-2026-69149 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-88056 does not affect version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic. not_affected \u2014 Angular v12.2.0 is not affected by CVE-2026-88056. The vulnerable code pattern (using String.prototype.trim() on URL strings in parseUrl/resolveUrl functions) does not exist in this version. The CVE describes a vulnerability introduced in later Angular versions (v19+) where a new url.ts file was added with urlStr.trim() logic. The v12.2.0 codebase predates this vulnerable code entirely. The exi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-88056"
      },
      "impact_statement": "not_affected \u2014 Angular v12.2.0 is not affected by CVE-2026-88056. The vulnerable code pattern (using String.prototype.trim() on URL strings in parseUrl/resolveUrl functions) does not exist in this version. The CVE describes a vulnerability introduced in later Angular versions (v19+) where a new url.ts file was added with urlStr.trim() logic. The v12.2.0 codebase predates this vulnerable code entirely. The exi..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-88058 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-88058"
      },
      "action_statement": "Vulnerability CVE-2026-88058 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@12.2.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-88060 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-88060"
      },
      "action_statement": "Vulnerability CVE-2026-88060 affects version 12.2.0-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 12.2.0-tuxcare.6."
    }
  ]
}