{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:227ed83a-a87a-5d24-95a6-a0af59f55c3e", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2", "type": "library", "name": "@angular/compiler", "version": "13.3.12-tuxcare.2", "purl": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:533881f7-f2ac-55e4-b589-d03bebc8cc50", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6e2e0805-c64d-56b0-8e18-5d9437f92434", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:76296aeb-bdcc-557b-9ec4-7a58bd84995a", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2a42417f-afbe-5c94-9fd7-44b521e1f388", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d8603a00-2bb8-589a-8510-c481f50a052f", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d7ffb0ec-9cea-57c3-b5a7-4e7bf5c58fe4", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1b0fe6bb-aaef-5125-9ffe-90e3dfdf0e3d", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0316efa3-890b-53e2-b250-4e48ea93dbd5", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:df9bb556-4de3-5ff0-a480-fb8a3e8b98e7", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 13.3.12-tuxcare.2 of @angular/compiler. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-50170. The HttpTransferCache feature that contains the vulnerability was introduced in Angular v16.0.0 (March 2023) and does not exist in this earlier version." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ac346d7e-25ac-59fd-a8dd-4c7a87f96cc1", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:759b7566-6303-50e6-b3ed-9ef67a454328", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0b33c929-9611-511a-b3b1-a6fc9865b833", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c4d86168-f731-514e-ad45-8b83597cf01d", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a2deb84d-37c6-5dcd-9777-7c1f8345d49c", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e4952ad0-c50e-5b43-b98c-a518d8948e04", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0ba44b04-d78d-5c9a-8fdc-21f05c63ee62", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 13.3.12-tuxcare.2 of @angular/compiler. not_affected \u2014 Version 13.3.12 does not have the vulnerable code pattern. The vulnerability exists in versions 20.x+ where the Service Worker's newRequestWithMetadata function preserves request headers but fails to strip sensitive headers on cross-origin redirects. Version 13.3.12 lacks this function entirely and creates fresh requests with URL-only when handling redirects, preventing header leakage." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:60e67236-6631-58e2-a78c-8df6dfce0e99", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 13.3.12-tuxcare.2 of @angular/compiler. not_affected \u2014 Angular v13.3.12-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability is specific to the Ivy template pipeline architecture (TwoWayProperty operation) introduced in Angular v17+. This version uses an older Ivy architecture where two-way bindings desugar through the same sanitized property binding path as one-way bindings, preventing the sanitization bypass." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:af38b297-b734-571a-a822-43517cad03f4", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 13.3.12-tuxcare.2 of @angular/compiler. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache key generation was introduced in Angular v16.0.0-next.7 (March 2023), which is 3+ major versions newer than this target version. Exhaustive code analysis confirms the transfer_cache.ts module, HttpTransferCache class, generateHash function, and all related cache key gener..." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c738dc53-2327-543d-b688-21d024a1e01b", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6db5ff08-2d3f-5849-8921-bbc879cf658d", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 13.3.12-tuxcare.2 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@13.3.12-tuxcare.2" } ] }