{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1da450c3-f1d5-538e-a4e5-f083d1a9e274", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4", "type": "library", "name": "@angular/forms", "version": "12.0.0-tuxcare.4", "purl": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:2d053729-c35c-5de2-bae6-666a745b4904", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9dfc776e-b8c8-52fc-ae66-2ea759600b91", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2711b8bd-8e20-5460-8bcc-8c818e2f7e33", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:daadc99b-ad8c-54b8-a333-5349e8ebb488", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:100b837a-3f36-5d0f-ab0a-0b3c587e89ad", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 12.0.0-tuxcare.4 of @angular/forms. not_affected \u2014 The target repository (Angular v12.0.0-tuxcare.2) is not affected by CVE-2026-41423. This version uses Node.js url.parse() for URL parsing, which does not exhibit the hostname override vulnerability. The CVE affects Angular versions 21.0.4+ where the codebase was refactored to use the URL constructor with a base parameter, allowing protocol-relative URLs (//evil.com) to override the hostname. T..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:26a78d9d-30dd-5fdf-b63f-41d53b2c4d4b", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2fce00f4-0f1d-5151-bbd9-0e2d1780e54a", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:89be51d4-278d-54a2-84d8-eeca416528ef", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0ddee4cf-22ae-5f42-9464-aa93c44433cd", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 12.0.0-tuxcare.4 of @angular/forms. not_affected \u2014 Angular v12.0.0-tuxcare.2 is not affected by CVE-2026-50170. The HTTP transfer cache feature that contains the vulnerability does not exist in this version. The transfer cache was introduced in Angular v16+, while this is version 12." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e7df2902-b52f-5947-9453-32cd85646973", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ff355359-2ad7-532f-86ad-6dbec2937f84", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ea45414e-ae52-569c-b90e-76109a913f11", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:692a43df-5d03-5e11-8540-6f2dcdad9d4e", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cc5618ae-9660-58c9-a732-ddd089698169", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b919e731-713d-5777-863c-e7c783202220", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:160ef8d3-34ce-53d9-9c94-ce28f7bd03b6", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 12.0.0-tuxcare.4 of @angular/forms. not_affected \u2014 Angular version 12.0.0 is not affected by CVE-2026-54264. The service worker's AssetGroup class does not preserve request headers when making network requests, including on cross-origin redirects. Version 12.0.0 predates the architectural change that introduced metadata preservation (including headers), which was later found to be vulnerable in versions 20.x-22.x." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:988e1eac-bf73-5cc0-b10f-8b48e4500223", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 12.0.0-tuxcare.4 of @angular/forms. not_affected \u2014 Angular 12.0.0-tuxcare.2 is not affected by CVE-2026-54265. The vulnerability is specific to the Ivy template pipeline architecture with TwoWayProperty IR operations (introduced in Angular 20+). Angular 12 uses a different architecture where two-way bindings are desugared at parse time into separate property and event bindings, and the property binding is sanitized through the same code path as..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b5b69167-b51a-5a67-bb9b-5605c9d771cd", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 12.0.0-tuxcare.4 of @angular/forms. not_affected \u2014 Angular v12.0.0-tuxcare.2 is not affected by CVE-2026-54266. The HttpTransferCache feature containing the weak DJB2 hash vulnerability does not exist in this version - it was introduced in Angular v16+." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5a8f5780-8ba1-50d8-b449-be1f4d5d5b79", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c9be0e83-1bab-5e50-b306-d43a4a6b5915", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5c919558-2a70-59da-b18f-7cd292ff5a47", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.0.0-tuxcare.4 of @angular/forms. not_affected \u2014 Angular 12.0.0 is not affected by CVE-2026-68945. The vulnerability concerns HttpTransferCache, a feature that caches HTTP requests during Server-Side Rendering (SSR) to reuse them during client-side hydration. This feature was first introduced in Angular 16.0.0 (#49509) and does not exist in Angular 12.0.0. The target version has no transfer_cache.ts implementation, no provideClientHydration A..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0e130772-3858-55f2-928b-5f1311a78b58", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:81a6b137-5954-5098-8b96-aa2271809c61", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 12.0.0-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@12.0.0-tuxcare.4" } ] }