{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:81f1176c-0907-59b2-8f74-c2bec31b4c72", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12", "version": "8.0.3-tuxcare.12", "pedigree": { "ancestors": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@8.0.3", "type": "library", "version": "8.0.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:beb69b4c-213e-5f27-bd1b-0bc85193d52a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:27210b0f-c065-54c6-9b39-2dc5955a0b6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:fd1c301f-776d-5907-bf1d-0e3f091ec9f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:4bcb931d-5f63-56f0-ab3e-252645051b19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:bd8fac2b-88b3-5317-b6e4-23d9997516e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:62b57e85-a3a5-5e4a-80b3-5c6d0e056fa1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:20df7190-520f-5b26-b98d-a4f033dbdbdd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:7183948b-4788-5404-a0d5-e593e9f6736f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 8.0.3-tuxcare.12 of @angular/bazel. not_affected \u2014 The target Angular version 8.0.3 is not affected by CVE-2026-41423. The vulnerability requires WHATWG URL API (introduced in Angular 8.2.x+) to manifest the hostname override behavior. Version 8.0.3 uses Node.js legacy url.parse() which does not interpret protocol-relative URLs as having attacker-controlled hostnames.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:5fd44873-6a49-58a7-a839-043cdbdf9a3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:f48fd12d-5f9c-554c-a2d2-1be291cde761", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:c0ae153f-bff9-59be-9d7a-93861dad3f2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:dcfcd457-0174-5fc5-9fb0-cf785fdc1b20", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 8.0.3-tuxcare.12 of @angular/bazel. not_affected \u2014 The target Angular v8.0.3 is NOT affected by CVE-2026-50170. The vulnerability requires the HTTP transfer cache feature (packages/common/http/src/transfer_cache.ts) and client hydration mechanisms, which were introduced in Angular v16+. This version lacks the entire affected component.", "justification": "code_not_present" } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:7a7ec4d8-51ba-528a-bd55-e44adff4c127", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:6df15584-bf43-52f7-b802-a2fd2432e9fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:7eb368a8-ba17-565b-82a3-e084bf50bd77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:e7aff3d4-8ab4-5b8b-8038-62342f5a40d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:4f3bfb54-dc8c-5833-aef7-6e2834195f47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:b27008f8-7900-5595-830f-f212f508bb16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:704dd77d-dd2b-5769-afd2-62a6a322ed46", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 8.0.3-tuxcare.12 of @angular/bazel. not_affected \u2014 The target Angular service-worker version 8.0.3-tuxcare.4 is NOT AFFECTED by CVE-2026-54264. The vulnerability requires the service worker to copy and forward request headers during cross-origin redirects. This version never copies headers: the AssetGroup path creates fresh requests from URLs only (no header preservation), and the DataGroup path delegates to the browser's spec-compliant fetch A...", "justification": "code_not_present" } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:78aa7ed2-531e-53c8-a4b8-ab88a19805d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:81714080-f3d8-5716-8246-ef1acf8b5f5f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 8.0.3-tuxcare.12 of @angular/bazel. not_affected \u2014 Angular 8.0.3-tuxcare.4 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with its weak DJB2 hash-based cache key generation does not exist in this version. HttpTransferCache was introduced in Angular v16+, while this target is v8.0.3.", "justification": "code_not_present" } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:56de9595-31ee-51ac-b613-53d77eb601c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:45c168bd-31f4-563e-95e7-29d2477d8691", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:cb174ea7-278f-5163-a3f8-b8cf1de6d86b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.0.3-tuxcare.12 of @angular/bazel. not_affected \u2014 Angular 8.0.3-tuxcare.5 is NOT AFFECTED by CVE-2026-68945. The vulnerability concerns HttpTransferCache, a feature that caches HTTP requests during Server-Side Rendering (SSR) and generates cache keys that incorrectly treat scalar-comma parameters (role=user,admin) as identical to repeated parameters (role=user&role=admin). This feature does not exist in Angular 8.0.3 \u2014 it was introduced in Ang...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:01f5ea62-3935-5d45-88ba-5049a760e1a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:603aa17b-d2bb-5923-8b71-113d2909a720", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:49ef0039-c744-5e61-a31c-17d32f69a8e6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.0.3-tuxcare.12 of @angular/bazel. not_affected \u2014 Angular 8.0.3 is not affected by CVE-2026-88056. The vulnerability exists only in later Angular versions (v19+, v20+, v21+, v22+) where packages/platform-server/src/url.ts contains a parseUrl function that calls String.prototype.trim() on URL strings. This trim() call strips Unicode whitespace (U+00A0, U+FEFF), converting same-origin URLs into cross-origin protocol-relative URLs, causing SSRF. ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:566b2950-a5bb-5b24-8b1a-5a310ba5fea6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:3f49bbb3-fe75-5845-96e7-0d3aa87c0bd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:fb7280b1-33fd-5f6a-b710-8c8fd3c5d2f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.0.3-tuxcare.12 of @angular/bazel. not_affected \u2014 Angular v8.0.3 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and modern SSR hydration features that were introduced in Angular v16+. Version 8.0.3 predates these features by multiple major releases. The legacy TransferState in v8 is a manual key-value store with no integration with HttpClient, making the described attack chain impo...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:e2f4272a-3074-502e-a7f1-ce8b96a216c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ] }