{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:77deded0-db28-5af3-8b8f-8cbc427b7d4f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/forms", "purl": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12", "type": "library", "bom-ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12", "version": "5.2.11-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:baa7beb6-1aa3-5bcf-a780-30f8ef0df63e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:69f2311c-bc54-567e-b65f-7d404c581bb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:11930573-461a-5c2e-a3cc-8a26d58dc5b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:7b9cafd3-b44f-5a7e-9159-459f7e6ade7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:471e694d-d146-5b16-9101-6a5742d43682", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:c23987b8-0548-592a-8b77-59af3a3d070e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:cb9c3be9-20cd-50c3-be1f-30c06e255c9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:e0b9988b-a38e-5f08-8deb-03b108bba5e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:568b021b-53fb-5cd9-81c6-23b7b52b3002", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:bab12102-48d0-51c0-8074-67100f31fae7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:a05800fc-74c2-52cb-8390-0b0264c208eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:c435f49f-cb56-59a6-9754-5b98dfeb0dad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:8618a656-cf4a-58ce-86b0-c8337f4e1668", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:3298e5ee-6e27-5bf1-8aa8-e4db6b459111", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:106a9042-3096-5071-b0c4-b33f8a2984b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:29010161-4163-5236-baaa-fe9f829e7b34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:c378a8f4-1982-5568-b25d-643259ef3d98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:af9020f2-79c8-5b4e-a587-7706ee225f87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:33fa5855-e9df-568a-acaf-a31a1076e091", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:22973d48-9b5a-5d49-a2e7-dc6c790167ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:4179dedb-e0bf-504c-80ce-6211cfe35228", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.12 of @angular/forms. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:4ac9569b-3be7-51fb-82fb-4035d05f66bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 5.2.11-tuxcare.12 of @angular/forms, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:9dfc9329-37fe-5cc5-9ccc-4246cf705d38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 5.2.11-tuxcare.12 of @angular/forms, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:b6c7a67c-8607-5ec8-9667-e71eede295ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.12 of @angular/forms. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:1b7015c3-ddf9-533d-afc6-9ecc8c40e535", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.12 of @angular/forms." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:795f49af-0882-507e-954c-e4a08df84717", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.12 of @angular/forms. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ], "bom-ref": "urn:uuid:52b10003-c072-52d9-86a8-7095bb1c8db9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.12 of @angular/forms." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.12" } ] }