{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dade1751-44a1-5888-917f-cfaf0c4a0902", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10", "version": "12.2.17-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:066b7c67-78c6-51a0-9b7c-8f1e6e12975b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:0137100f-621e-572e-95ae-094755277445", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:4ccab376-01ac-511e-926d-67ab685a3837", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:2b49eb0c-f73b-5654-94c7-3a7e79f7c72b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:03612901-1086-5072-8f55-5f887f9ff494", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:d7ce6794-b378-50e8-beda-49a7f90a2394", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:241a415d-b6dc-547c-85ff-5e01b3371117", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:6496bf57-b6f9-5a1f-aaa2-28a97cf73c9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:f3e19a3e-700e-5604-942b-3dfd6eb3863b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:52b6e57a-668f-5032-9e29-f935128eaf8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:0c95b035-6e2f-50d4-b2a4-362fe4d15167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:e314985f-a70d-53c2-8b7e-f46f7fa0c385", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:06e93269-71a0-5ffc-beec-10619ce1f675", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:79e27237-06ce-5f35-8db3-5cc471911f58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:f8e1e37b-c6c1-53e0-8f6e-63a720f6dfb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:1eff48e6-c1f0-5048-96d7-e0a484825d57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:276f09b1-2ca7-5981-b6fd-8ead8c9b60b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:7dd7c1c3-eb2d-57dc-abef-ab47b724ef8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:a9d4d799-4f53-59fa-a068-c1989066bc26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:aca5b55f-2ec5-5c9b-907e-0b0ba88809b0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.10 of @angular/language-service. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:deefec3c-22c4-5e54-89e9-4b2aff2e5b84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:dd548b1e-986a-5625-8c31-ef28cc087e40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:0205f75d-83cf-5924-966b-1ebda47a3fcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:b177f75e-0cf6-584d-bf96-92f33c8901a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 12.2.17-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:8dd6e3bb-a9df-5a71-bf9e-70c9ee9e99be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.10 of @angular/language-service. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:83775199-def9-596c-af34-b43eda7b73a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 12.2.17-tuxcare.10 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.10" } ] }