CVE-2026-111752

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111752", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-16T17:52:09.081Z", "datePublished": "2026-11-03T20:52:16.675Z", "dateUpdated": "2026-11-09T15:50:21.453Z"}, "containers": {"cna": {"title": "Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-405", "lang": "en", "description": "CWE-405: Asymmetric Resource Consumption (Amplification)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7"}, {"name": "https://github.com/angular/angular/issues/70932", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/issues/70932"}, {"name": "https://github.com/angular/angular/issues/70997", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/issues/70997"}, {"name": "https://github.com/angular/angular/pull/71055", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/pull/71055"}, {"name": "https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c"}, {"name": "https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0"}, {"name": "https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79"}, {"name": "https://github.com/angular/angular/releases/tag/v20.3.33", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/releases/tag/v20.3.33"}, {"name": "https://github.com/angular/angular/releases/tag/v21.2.25", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/releases/tag/v21.2.25"}, {"name": "https://github.com/angular/angular/releases/tag/v22.2.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/releases/tag/v22.2.1"}], "affected": [{"vendor": "angular", "product": "angular", "versions": [{"version": "<= 19.2.25", "status": "affected"}, {"version": ">= 20.0.0, < 20.3.33", "status": "affected"}, {"version": ">= 21.0.0, < 21.2.25", "status": "affected"}, {"version": ">= 22.0.0, < 22.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-03T20:52:16.675Z"}, "descriptions": [{"lang": "en", "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1."}], "source": {"advisory": "GHSA-62vg-58rm-qff7", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T15:49:59.445156Z", "id": "CVE-2026-111752", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T15:50:21.453Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-111752", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T15:49:59.445156Z"}}}], "references": [{"url": "https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T15:50:16.726Z"}}], "cna": {"title": "Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)", "source": {"advisory": "GHSA-62vg-58rm-qff7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "angular", "product": "angular", "versions": [{"status": "affected", "version": "<= 19.2.25"}, {"status": "affected", "version": ">= 20.0.0, < 20.3.33"}, {"status": "affected", "version": ">= 21.0.0, < 21.2.25"}, {"status": "affected", "version": ">= 22.0.0, < 22.2.1"}]}], "references": [{"url": "https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7", "name": "https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/angular/angular/issues/70932", "name": "https://github.com/angular/angular/issues/70932", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/angular/angular/issues/70997", "name": "https://github.com/angular/angular/issues/70997", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/angular/angular/pull/71055", "name": "https://github.com/angular/angular/pull/71055", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c", "name": "https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0", "name": "https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79", "name": "https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/angular/angular/releases/tag/v20.3.33", "name": "https://github.com/angular/angular/releases/tag/v20.3.33", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/angular/angular/releases/tag/v21.2.25", "name": "https://github.com/angular/angular/releases/tag/v21.2.25", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/angular/angular/releases/tag/v22.2.1", "name": "https://github.com/angular/angular/releases/tag/v22.2.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-405", "description": "CWE-405: Asymmetric Resource Consumption (Amplification)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-03T20:52:16.675Z"}}}, "cveMetadata": {"cveId": "CVE-2026-111752", "state": "PUBLISHED", "dateUpdated": "2026-11-09T15:50:21.453Z", "dateReserved": "2026-10-16T17:52:09.081Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-03T20:52:16.675Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "angular", "vendor": "angular", "versions": [{"status": "affected", "version": "<= 19.2.25"}, {"status": "affected", "version": ">= 20.0.0, < 20.3.33"}, {"status": "affected", "version": ">= 21.0.0, < 21.2.25"}, {"status": "affected", "version": ">= 22.0.0, < 22.2.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1."}], "id": "CVE-2026-111752", "lastModified": "2026-11-12T20:07:11.090", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111752", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T15:49:59.445156Z", "version": "2.0.3"}}]}, "published": "2026-11-03T21:16:57.993", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/issues/70932"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/issues/70997"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/pull/71055"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/releases/tag/v20.3.33"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/releases/tag/v21.2.25"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/releases/tag/v22.2.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-405"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "@angular/router: @angular/router: Denial of Service via improper route outlet matching in Server-Side Rendering", "id": "2566522", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566522"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in @angular/router. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending crafted HTTP requests containing multiple unconfigured outlet URL segments to an application using Server-Side Rendering (SSR). Due to improper route validation, the router repeatedly evaluates route configurations and excessively consumes memory and CPU resources, causing the server worker process to crash."], "name": "CVE-2026-111752", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/volsync-operator-bundle", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/volsync-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "ceph", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "gjs", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "dotnet5.0-build-reference-packages", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "mozjs60", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "ceph", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "gjs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "redhat-fuse-maven-repository.zip", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "redhat-fuse-sources.zip", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-11-03T20:52:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-111752\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111752\nhttps://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c\nhttps://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0\nhttps://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79\nhttps://github.com/angular/angular/issues/70932\nhttps://github.com/angular/angular/issues/70997\nhttps://github.com/angular/angular/pull/71055\nhttps://github.com/angular/angular/releases/tag/v20.3.33\nhttps://github.com/angular/angular/releases/tag/v21.2.25\nhttps://github.com/angular/angular/releases/tag/v22.2.1\nhttps://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7"], "statement": "A flaw was found in @angular/router. Prior to versions 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak; client-side SPAs and build-time prerendering are not affected. This issue is fixed in @angular/router 20.3.33, 21.2.25, and 22.2.1.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,19.2.25]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[20.0.0,20.3.33)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.0.0,21.2.25)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.0.0,22.2.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "angular", "source": "cna", "vendor": "angular"}, "product": "angular", "vendor": "angular"}], "created": "2026-11-03T23:30:06.910273+00:00", "updated": "2026-11-04T13:15:14.747434+00:00", "vendors": ["angular", "angular$PRODUCT$angular"]}