p PatchFirst

PatchFirst · Latest vulnerabilities

@angular/common vulnerabilities

Vulnerabilities published for @angular/common in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 8

  1. CVE-2026-111753

    Not ratedFix available

    @angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

    An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37) (`CVE-2025-66035`) in `@angular/common`'s HTTP Client (`HttpClient`) allows Cross-Site Request Forgery (XSRF) tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the browser's WHATWG URL parser. ### Technical Description To address `CVE-2025-66035`, `xsrfInterceptorFn` introduced a regular expression (`const ABSOLUTE_URL_REGEX = /^(?:https?:)?\/\//i`) to detect and skip absolute and protocol-relative URLs before attaching

    @angular/common @angular/common @angular/commonNode.js
    • Update to 20.3.34
    • Update to 21.0.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-88059

    Medium · CVSS 4EPSS 0.34%Fix available

    Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in

    @angular/common @angular/common @angular/common @angular/commonNode.js
    • Update to 20.3.28
    • Update to 21.2.20
    • Update to 22.1.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-68945

    High · CVSS 8.8EPSS 0.18%Fix available

    Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.

    @angular/common @angular/common @angular/common @angular/commonNode.js
    • Update to 20.3.27
    • Update to 21.2.19
    • Update to 22.0.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2026-50171

    High · CVSS 8.2EPSS 0.26%Fix available

    Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a Denial of Service (DoS) vulnerability exists in the @angular/common package of Angular. The formatNumber function, which is also utilized by DecimalPipe, PercentPipe, and CurrencyPipe, does not properly validate the upper bounds of the digitsInfo parameter. Specifically, the minimum and maximum fraction digits parsed from the digitsInfo string (e.g., 1.2-4) are converted to integers and used without limits. When parsing a maliciously crafted digitsInfo string

    @angular/common @angular/common @angular/common @angular/common @angular/commonNode.js
    • Update to 19.2.23
    • Update to 20.3.22
    • Update to 21.2.15
    • Update to 22.0.0-rc.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-50170

    High · CVSS 8.2EPSS 0.43%Fix available

    Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered in @angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via TransferState. However, the caching mechanism fails to inspect the withCredentials flag or the Cookie header of outgoing requests. As a result, credentialed, user-specific responses

    @angular/common @angular/common @angular/common @angular/common @angular/commonNode.js
    • Update to 19.2.23
    • Update to 20.3.22
    • Update to 21.2.15
    • Update to 22.0.0-rc.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2026-54268

    High · CVSS 8.2EPSS 0.58%Fix available

    Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in

    @angular/common @angular/common @angular/common @angular/commonNode.js
    • Update to 20.3.25
    • Update to 21.2.17
    • Update to 22.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2026-54266

    High · CVSS 8.8EPSS 0.13%Fix available

    Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration. This avoids repeating the same HTTP requests on the client. The cached responses are stored in TransferState using a cache key generated by hashing request properties (method, response type, mapped URL, serialized body, and sorted query parameters). The cache keys are generated using a weak 32-bit DJB2-like polynomial rolling hash.

    @angular/common @angular/common @angular/common @angular/commonNode.js
    • Update to 20.3.25
    • Update to 21.2.17
    • Update to 22.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2025-66035

    High · CVSS 7.7EPSS 0.66%Fix available

    Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protoco

    @angular/common @angular/common @angular/commonNode.js
    • Update to 19.2.16
    • Update to 20.3.14
    • Update to 21.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →