{
  "@id": "urn:uuid:fdac6b76-9f8f-4368-8c5a-0b5d6051f1a2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T15:11:52.923350+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-101895 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-101895"
      },
      "action_statement": "Vulnerability CVE-2026-101895 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-101896 affects version 13.3.12 of @angular/platform-browser-dynamic.",
      "vulnerability": {
        "name": "CVE-2026-101896"
      },
      "action_statement": "Vulnerability CVE-2026-101896 affects version 13.3.12 of @angular/platform-browser-dynamic."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-41423 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41423"
      },
      "action_statement": "Vulnerability CVE-2026-41423 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-46417 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-46417"
      },
      "action_statement": "Vulnerability CVE-2026-46417 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-50168 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-50168"
      },
      "action_statement": "Vulnerability CVE-2026-50168 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-50169 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-50169"
      },
      "action_statement": "Vulnerability CVE-2026-50169 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-50184 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-50184"
      },
      "action_statement": "Vulnerability CVE-2026-50184 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-50555 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-50555"
      },
      "action_statement": "Vulnerability CVE-2026-50555 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-50556 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-50556"
      },
      "action_statement": "Vulnerability CVE-2026-50556 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-54264 does not affect version 13.3.12 of @angular/platform-browser-dynamic. not_affected \u2014 Version 13.3.12 does not have the vulnerable code pattern. The vulnerability exists in versions 20.x+ where the Service Worker's newRequestWithMetadata function preserves request headers but fails to strip sensitive headers on cross-origin redirects. Version 13.3.12 lacks this function entirely and creates fresh requests with URL-only when handling redirects, preventing header leakage.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54264"
      },
      "impact_statement": "not_affected \u2014 Version 13.3.12 does not have the vulnerable code pattern. The vulnerability exists in versions 20.x+ where the Service Worker's newRequestWithMetadata function preserves request headers but fails to strip sensitive headers on cross-origin redirects. Version 13.3.12 lacks this function entirely and creates fresh requests with URL-only when handling redirects, preventing header leakage."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-69149 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-69149"
      },
      "action_statement": "Vulnerability CVE-2026-69149 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-88056 does not affect version 13.3.12 of @angular/platform-browser-dynamic. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-88056. The vulnerable code pattern (String.prototype.trim() call on URLs during server-side resolution) was introduced in Angular v22.x (May 2026, commit 6e71049021) and later fixed in Aug 2026 (commit 9339a7a2de). Version 13.3.12 predates this refactor by multiple major releases and never contained the vulnerable trim() call. Both parseUrl implement...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-88056"
      },
      "impact_statement": "not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-88056. The vulnerable code pattern (String.prototype.trim() call on URLs during server-side resolution) was introduced in Angular v22.x (May 2026, commit 6e71049021) and later fixed in Aug 2026 (commit 9339a7a2de). Version 13.3.12 predates this refactor by multiple major releases and never contained the vulnerable trim() call. Both parseUrl implement..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-88058 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-88058"
      },
      "action_statement": "Vulnerability CVE-2026-88058 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12"
          }
        }
      ],
      "timestamp": "2026-10-19T04:02:09.200184+00:00",
      "status_notes": "Vulnerability CVE-2026-88060 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-88060"
      },
      "action_statement": "Vulnerability CVE-2026-88060 affects version 13.3.12 of @angular/platform-browser-dynamic, and is fixed in 13.3.12-tuxcare.6."
    }
  ]
}