{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3b9c7197-082d-5c7f-b472-6f98f401860f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.9", "type": "library", "name": "@angular/platform-browser-dynamic", "version": "15.2.9", "purl": "pkg:npm/%40angular/platform-browser-dynamic@15.2.9" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:08093b59-1eac-5b3b-a9ab-3cceea9869d9", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.9" } ] }, { "bom-ref": "urn:uuid:2f3653d6-0e0d-5d06-b4b0-07227c2fdb81", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9 of @angular/platform-browser-dynamic. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.9" } ] }, { "bom-ref": "urn:uuid:0fddd76e-063d-511a-bf50-c942b4f6be1f", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.9" } ] }, { "bom-ref": "urn:uuid:7e88cf2a-8bd9-58fe-97ff-13625b70de61", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.9" } ] }, { "bom-ref": "urn:uuid:fb622397-c922-517a-aa64-a6280d43206f", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.9 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-68945. The vulnerability exists in the HttpTransferCache feature used during Server-Side Rendering (SSR), which generates cache keys from HTTP request parameters. However, this feature was not introduced until Angular 16.0.0. Angular 15.2.9 lacks the entire HttpTransferCache implementation: no transfer_cache.ts file exists, no HttpTransferCache class, ..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.9" } ] }, { "bom-ref": "urn:uuid:ec39731f-b5d3-573b-87d5-6998e07b0f5e", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 15.2.9 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-88056. The vulnerability requires URL resolution utilities that use String.prototype.trim() on URLs (specifically in HTTP interceptors like relativeUrlsTransformerInterceptorFn), creating a discrepancy with WHATWG URL parsing that enables SSRF. This code pattern does not exist in Angular 15.2.9 and was introduced in later Angular versions (16+). The ta..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.9" } ] }, { "bom-ref": "urn:uuid:6adceff5-d3df-50c4-943d-1ea574c27bb4", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 15.2.9 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.9" } ] }, { "bom-ref": "urn:uuid:60867771-1e23-58a3-af8e-2b501268a54f", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 15.2.9 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 15.2.9 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires the HttpTransferCache feature, which caches HTTP responses into TransferState during SSR with hydration. This feature was introduced in Angular 17.0.0 (October 2023), well after Angular 15.2.9 was released (May 2023). The target version lacks the critical components: no transfer_cache.ts file, no provideClientHydration..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.9" } ] }, { "bom-ref": "urn:uuid:4c5b0fc9-95f7-5591-aa92-17acb9e73300", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 15.2.9 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.9" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@15.2.9" } ] }