{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:16940603-9f82-52d8-8752-e477a11663b6", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4", "type": "library", "name": "@angular/forms", "version": "13.3.12-tuxcare.4", "purl": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:73ae6e60-8b75-59db-bae6-42dcdf876e0b", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0aed775f-bf6f-57af-a74c-718e9a210a75", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9d723ca8-dc8a-5135-9bfb-f8dd0f39b4c4", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a9081d46-8e46-5f0e-818a-98440dbc6a96", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:29e7df18-fb03-57d3-88c0-aeb765068554", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9f0f15a2-fbf0-53a1-b826-4f91c46a85ec", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c76eecb6-7b78-5a67-90f9-bce39f37bef7", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5574989c-294c-50ba-8d01-61d2c7d06ade", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e3a55b9f-89b1-5e05-bc2f-9b42c02b4041", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 13.3.12-tuxcare.4 of @angular/forms. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-50170. The HttpTransferCache feature that contains the vulnerability was introduced in Angular v16.0.0 (March 2023) and does not exist in this earlier version." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:dcae96e1-48fe-5a07-a8cc-357ce52de495", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f9533862-b21f-5235-b536-1bc2e3877afb", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c0107163-8c08-5d03-9837-160547edd22e", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:36e003f5-aca9-5063-8f13-03d79cc25ef8", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:569c9710-6449-5f90-a307-1c0e8cd74ebf", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4c521c28-7fff-5d3a-a12d-eda3c7d8be21", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9bd71823-a8e9-5be0-b8a4-0ba5236d9b84", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 13.3.12-tuxcare.4 of @angular/forms. not_affected \u2014 Version 13.3.12 does not have the vulnerable code pattern. The vulnerability exists in versions 20.x+ where the Service Worker's newRequestWithMetadata function preserves request headers but fails to strip sensitive headers on cross-origin redirects. Version 13.3.12 lacks this function entirely and creates fresh requests with URL-only when handling redirects, preventing header leakage." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:17ffdf25-ba5b-5da3-b9ea-6f21cd63e627", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 13.3.12-tuxcare.4 of @angular/forms. not_affected \u2014 Angular v13.3.12-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability is specific to the Ivy template pipeline architecture (TwoWayProperty operation) introduced in Angular v17+. This version uses an older Ivy architecture where two-way bindings desugar through the same sanitized property binding path as one-way bindings, preventing the sanitization bypass." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:98d6b862-1bb2-5abd-a73a-5925ae225b04", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 13.3.12-tuxcare.4 of @angular/forms. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache key generation was introduced in Angular v16.0.0-next.7 (March 2023), which is 3+ major versions newer than this target version. Exhaustive code analysis confirms the transfer_cache.ts module, HttpTransferCache class, generateHash function, and all related cache key gener..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2f5690cd-c123-5803-9168-6d1d56cbea09", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b5a746ff-f474-5ac7-ad15-95914c81146f", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d78a06f2-350d-5e90-b1cc-800bd7b3f3d5", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 13.3.12-tuxcare.4 of @angular/forms. not_affected \u2014 CVE-2026-68945 describes a cache-key collision vulnerability in Angular's HttpTransferCache feature that allows distinct HTTP requests with repeated query parameters to share cached responses during SSR. The target version (13.3.12-tuxcare.3) does not contain the HttpTransferCache feature, which was introduced in Angular 16.0.0-next.7 (commit aff1512950). Since the vulnerable component does not..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b5c472eb-2d27-5d96-822e-e23effcf0886", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1921f2f9-17c4-5626-9f66-f9ddf8bc3948", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 13.3.12-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@13.3.12-tuxcare.4" } ] }