{
  "@id": "urn:uuid:ab025ffb-265c-4769-8c04-30ebfe219a0b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T18:38:29.397001+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-29T03:33:00.233925+00:00",
      "status_notes": "Vulnerability CVE-2026-101895 does not affect version 4.3.5-tuxcare.3 of @angular/language-service. not_affected \u2014 Angular 4.3.5 is NOT AFFECTED by CVE-2026-101895. The vulnerability exists in the `domino` HTML parser library (specifically in `lib/HTMLParser.js`'s tokenizer state machine), but Angular 4.3.5 does not use domino at all. This version uses `parse5` for server-side HTML parsing instead. According to multiple existing CVE patches in this repository, domino was only adopted starting with Angular v...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-101895"
      },
      "impact_statement": "not_affected \u2014 Angular 4.3.5 is NOT AFFECTED by CVE-2026-101895. The vulnerability exists in the `domino` HTML parser library (specifically in `lib/HTMLParser.js`'s tokenizer state machine), but Angular 4.3.5 does not use domino at all. This version uses `parse5` for server-side HTML parsing instead. According to multiple existing CVE patches in this repository, domino was only adopted starting with Angular v..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-30T15:57:50.734473+00:00",
      "status_notes": "Vulnerability CVE-2026-101896 affects version 4.3.5-tuxcare.3 of @angular/language-service.",
      "vulnerability": {
        "name": "CVE-2026-101896"
      },
      "action_statement": "Vulnerability CVE-2026-101896 affects version 4.3.5-tuxcare.3 of @angular/language-service."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41423 does not affect version 4.3.5-tuxcare.3 of @angular/language-service. not_affected \u2014 Angular 4.3.5 is not affected by CVE-2026-41423. The target uses Node.js legacy url.parse() API instead of WHATWG URL API, and ServerPlatformLocation does not expose hostname/protocol/port fields. The vulnerability pattern cannot manifest in this architecture.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41423"
      },
      "impact_statement": "not_affected \u2014 Angular 4.3.5 is not affected by CVE-2026-41423. The target uses Node.js legacy url.parse() API instead of WHATWG URL API, and ServerPlatformLocation does not expose hostname/protocol/port fields. The vulnerability pattern cannot manifest in this architecture."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-46417 affects version 4.3.5-tuxcare.3 of @angular/language-service, and is fixed in 4.3.5-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-46417"
      },
      "action_statement": "Vulnerability CVE-2026-46417 affects version 4.3.5-tuxcare.3 of @angular/language-service, and is fixed in 4.3.5-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50168 does not affect version 4.3.5-tuxcare.3 of @angular/language-service. not_affected \u2014 The target repository (Angular v4.3.5-tuxcare.2) is not affected by CVE-2026-50168. The vulnerability requires features and code paths that do not exist in this older Angular version. The target uses a fundamentally different architecture: Node's url.parse() instead of WHATWG URL API, parseDocument() does not accept a URL parameter, no relativeUrlsTransformerInterceptorFn for URL transformation...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50168"
      },
      "impact_statement": "not_affected \u2014 The target repository (Angular v4.3.5-tuxcare.2) is not affected by CVE-2026-50168. The vulnerability requires features and code paths that do not exist in this older Angular version. The target uses a fundamentally different architecture: Node's url.parse() instead of WHATWG URL API, parseDocument() does not accept a URL parameter, no relativeUrlsTransformerInterceptorFn for URL transformation..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50169 is fixed in version 4.3.5-tuxcare.3 of @angular/language-service.",
      "vulnerability": {
        "name": "CVE-2026-50169"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50184 is fixed in version 4.3.5-tuxcare.3 of @angular/language-service.",
      "vulnerability": {
        "name": "CVE-2026-50184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50555 is fixed in version 4.3.5-tuxcare.3 of @angular/language-service.",
      "vulnerability": {
        "name": "CVE-2026-50555"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50556 is fixed in version 4.3.5-tuxcare.3 of @angular/language-service.",
      "vulnerability": {
        "name": "CVE-2026-50556"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-54264 is fixed in version 4.3.5-tuxcare.3 of @angular/language-service.",
      "vulnerability": {
        "name": "CVE-2026-54264"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-69149 does not affect version 4.3.5-tuxcare.3 of @angular/language-service. Angular 4.3.5 is not affected by CVE-2026-69149. This vulnerability is specific to the domino library's HTML serializer, which fails to escape text nodes in fallback raw-content elements (iframe, noembed, noframes, noscript). Angular 4.3.5 uses parse5 version 3.0.1 for DOM emulation and serialization, not domino. The vulnerable code path through domino's serializer is not present in this version. The CVE explicitly targets Angular versions 20.x, 21.x, and 22.x, which use domino; Angular 4.3.5 predates this dependency change.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-69149"
      },
      "impact_statement": "Angular 4.3.5 is not affected by CVE-2026-69149. This vulnerability is specific to the domino library's HTML serializer, which fails to escape text nodes in fallback raw-content elements (iframe, noembed, noframes, noscript). Angular 4.3.5 uses parse5 version 3.0.1 for DOM emulation and serialization, not domino. The vulnerable code path through domino's serializer is not present in this version. The CVE explicitly targets Angular versions 20.x, 21.x, and 22.x, which use domino; Angular 4.3.5 predates this dependency change."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-88056 does not affect version 4.3.5-tuxcare.3 of @angular/language-service. not_affected \u2014 Angular 4.3.5 is not affected by CVE-2026-88056. The vulnerable code (packages/platform-server/src/url.ts containing parseUrl() with urlStr.trim()) was introduced in Angular 14.3.0+ for CVE-2026-50168 and does not exist in this version. Angular 4.3.5 uses Node.js url.parse() without trim() for URL parsing and lacks the modern SSR URL resolution interceptor architecture described in the CVE.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-88056"
      },
      "impact_statement": "not_affected \u2014 Angular 4.3.5 is not affected by CVE-2026-88056. The vulnerable code (packages/platform-server/src/url.ts containing parseUrl() with urlStr.trim()) was introduced in Angular 14.3.0+ for CVE-2026-50168 and does not exist in this version. Angular 4.3.5 uses Node.js url.parse() without trim() for URL parsing and lacks the modern SSR URL resolution interceptor architecture described in the CVE."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-26T20:08:00.128474+00:00",
      "status_notes": "Vulnerability CVE-2026-88058 affects version 4.3.5-tuxcare.3 of @angular/language-service, and is fixed in 4.3.5-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-88058"
      },
      "action_statement": "Vulnerability CVE-2026-88058 affects version 4.3.5-tuxcare.3 of @angular/language-service, and is fixed in 4.3.5-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@4.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-26T20:08:00.128474+00:00",
      "status_notes": "Vulnerability CVE-2026-88060 affects version 4.3.5-tuxcare.3 of @angular/language-service, and is fixed in 4.3.5-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-88060"
      },
      "action_statement": "Vulnerability CVE-2026-88060 affects version 4.3.5-tuxcare.3 of @angular/language-service, and is fixed in 4.3.5-tuxcare.7."
    }
  ]
}