{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:29f875c4-5c4d-5807-87f0-66da42fde82e", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.1", "type": "library", "name": "@angular/platform-browser-dynamic", "version": "15.2.1", "purl": "pkg:npm/%40angular/platform-browser-dynamic@15.2.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:763d6e56-dec7-5317-8332-a95a541463c8", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.1 of @angular/platform-browser-dynamic. not_affected \u2014 The target Angular version 15.2.1 uses Node.js url.parse() API which does not exhibit the protocol-relative URL hostname override vulnerability. The vulnerable behavior was introduced in Angular 17+ when the code was refactored to use WHATWG new URL() API. Version 15.2.1 is not affected by CVE-2026-41423." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.1" } ] }, { "bom-ref": "urn:uuid:090b0a5f-7a0d-520d-b0c6-4594f31d4b4b", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.1 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 15.2.1 is not affected by CVE-2026-50170. The HTTP transfer cache feature that contains the vulnerability was introduced in Angular v16+ and does not exist in version 15.2.1. The target repository lacks the entire affected component (packages/common/http/src/transfer_cache.ts) and all related transfer cache functionality." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.1" } ] }, { "bom-ref": "urn:uuid:7d419776-197a-5afb-9c8b-37af5149f2ef", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.1 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 15.2.1-tuxcare.1 is NOT AFFECTED by CVE-2026-54265. The vulnerability exists only in Angular 16+ where the template pipeline architecture introduced a TwoWayProperty operation kind that was missing from the sanitizer resolution switch. Angular 15.2.1 uses the pre-pipeline Ivy compiler where two-way bindings desugar through the same parsePropertyBinding() as one-way bindings, inheriting ..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.1" } ] }, { "bom-ref": "urn:uuid:7c609bd7-d42a-574c-b38a-c83c1e65305b", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.1 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 15.2.1 does not contain the HttpTransferCache feature, which was introduced in Angular 16.0.0. The vulnerable code path involving hash-based HTTP request caching does not exist in this version." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.1" } ] }, { "bom-ref": "urn:uuid:5b89b05a-2075-54e7-9012-7e7c3a193523", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.1 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 15.2.1 does not contain the HttpTransferCache feature that is vulnerable in CVE-2026-68945. The HttpTransferCache functionality, which caches HTTP requests during Server-Side Rendering (SSR) and generates cache keys from request parameters, was introduced in Angular 16.0.0 (released March 31, 2023). The target version 15.2.1 predates this feature introduction by approximately 2 months. ..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.1" } ] }, { "bom-ref": "urn:uuid:71fbf4b3-c511-588f-81e8-5d67cb71010d", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 15.2.1 of @angular/platform-browser-dynamic. not_affected \u2014 Version 15.2.1 is not affected by CVE-2026-88056. The vulnerability requires a `String.prototype.trim()` call in the `parseUrl` function that strips Unicode whitespace, creating a discrepancy between WHATWG URL validation and Angular's URL resolution. This vulnerable code pattern was introduced in version 22.1.0 (May 2026) via refactor commit e14d34e9ee and fixed in version 20.3.30 (August 2026..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.1" } ] }, { "bom-ref": "urn:uuid:1c0bbdf8-e194-521f-94c5-fa9a433a7505", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 15.2.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.1" } ] }, { "bom-ref": "urn:uuid:0b6a12e7-c4d9-5f72-81a5-f598dae2e7d2", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 15.2.1 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 15.2.1 is not affected by CVE-2026-88059. The vulnerability requires the HttpTransferCache feature, which was introduced in Angular v16.0.0 (commit aff1512950, PR #49509) and does not exist in v15.2.1. While the `withRequestsMadeViaParent()` feature exists in v15.2.1, the vulnerable pattern requires BOTH the hierarchical HttpClient configuration AND the HttpTransferCache interceptor. Wi..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.1" } ] }, { "bom-ref": "urn:uuid:edd056d4-18d7-557e-a129-227a3f83bec8", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 15.2.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.1" } ] }