{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f1fa94e7-e4a2-50b1-9131-9ee9e85bcbb2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8", "version": "12.2.17-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:0b6bc550-d66d-5f18-a623-174b71ee13bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:ffa18e00-0fa5-5f5e-b034-e8ed66654a65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:3ff16c0f-1255-504a-960f-3fa25401a191", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:7d44e702-7ed3-5406-ae06-c0ece6e2554d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:553f7003-c675-53f7-97b1-c2afdcd53f5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:ed29cc72-e446-5120-a52a-9b8fe6147d0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:eb77a123-f8bf-5222-8335-d3f3e03fa19b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:c3e014e9-a491-5b4f-9bcb-426a7a54288b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:681898ba-8cbd-5455-b73d-4c6dcb14b456", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:92de15db-f4d9-5d91-8587-e2a3a202cebf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:0766bae4-de83-52f1-b309-01ffc79bc8ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:c53486a6-6bcf-5cd5-957e-7c4617922012", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:9f5f5cd7-079f-509b-9c08-fedd4f1f0ce1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:a348cbed-d00e-51be-aed8-35aabd347619", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:779026d1-f8e7-5401-8516-0e3c82dd13fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:8eccbcff-366c-595d-a695-cf06903b29b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:c62103ae-1b33-55d3-9bc6-65441c546485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:f4286b94-077d-5fdc-a169-9afbd96be253", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:2c870705-1b31-53e3-97a2-710d99223979", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:887856ed-d76a-5f7a-97be-cbde34a3fdb4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.8 of @angular/language-service. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:8125d302-46c4-5e57-8961-2a4cd2ebea22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 12.2.17-tuxcare.8 of @angular/language-service, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:2f2899e6-d737-5795-b684-bc8c4f4b9e2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 12.2.17-tuxcare.8 of @angular/language-service, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:decf3fbe-d96c-58aa-ade3-7e62cf6033ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:940a4160-347c-5090-9441-e704bd2556d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 12.2.17-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:f9da4cd1-5028-5fe0-ac3b-091c7a9e6faa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.8 of @angular/language-service. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:3e484a41-7d67-5608-b667-a4a6ef5e19f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 12.2.17-tuxcare.8 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.8" } ] }