@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-88056 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-88056 Source advisory: OSV:GHSA-F6MR-PJWC-34M4...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.8), @bitblit/ngx-acute-common (>=6.1.210-alpha, <=6.1.222-alpha) +16 more potentially affected by CVE-2026-88059 via @angular/common (>=22.0.0, <=22.0.8)

@angular/common NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =23.0.0-alpha.2, =23.0.0-alpha.2, =0.0.0, =0.249.2, =0.250.0 and more Source cves: CVE-2026-88059 Source advisory: OSV:GHSA-P297-FM68-3Q8C...

Use of Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the HttpTransferCache process. An attacker can access sensitive user-specific information by exploiting a scenario where a child HttpClient delegates requests to a parent client that...

Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

A security bypass vulnerability was discovered in @angular/common when Server-Side Rendering SSR and hydration are enabled in applications using a hierarchical HttpClient configuration with withRequestsMadeViaParent. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +311 more potentially affected by CVE-2026-88059 via @angular/common (>=19.0.0, <=19.2.25)

@angular/common NPM version =19.0.0, =3.19.0, =0.0.327, =19.0.0, =8.0.0, =3.0.0, =1.0.0, =3.0.3 - @astro-sports-developers/shared 0.0.3 and more Source cves: CVE-2026-88059 Source advisory: OSV:GHSA-P297-FM68-3Q8C...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +33 more potentially affected by CVE-2026-88059 via @angular/common (>=20.0.0, <=20.3.25)

@angular/common NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =1.1.89, =0.0.57, =0.7.2, =0.7.3 and more Source cves: CVE-2026-88059 Source advisory: OSV:GHSA-P297-FM68-3Q8C...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.209-alpha) +53 more potentially affected by CVE-2026-88059 via @angular/common (>=21.0.0, <=21.2.19)

@angular/common NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =4.0.0, =6.1.0-edge.5 and more Source cves: CVE-2026-88059 Source advisory: OSV:GHSA-P297-FM68-3Q8C...

GHSA-P297-FM68-3Q8C Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

A security bypass vulnerability was discovered in @angular/common when Server-Side Rendering SSR and hydration are enabled in applications using a hierarchical HttpClient configuration with withRequestsMadeViaParent. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.8), @bitblit/ngx-acute-common (>=6.1.210-alpha, <=6.1.222-alpha) +16 more potentially affected by CVE-2026-88057 via @angular/compiler (>=22.0.0, <=22.0.8)

@angular/compiler NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =23.0.0-alpha.2, =23.0.0-alpha.2, =0.0.0, =0.249.2, =0.250.0 and more Source cves: CVE-2026-88057 Source advisory: OSV:GHSA-HH8M-FM6V-7CVG...

@absolutejs/absolute (0.12.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +36 more potentially affected by CVE-2026-88057 via @angular/compiler (>=20.0.0, <=20.3.21)

@angular/compiler NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =0.0.57, =0.0.60 - @saritasa/renewaire-frontend-sdk 0.1.0-dev.101 and more Source cves: CVE-2026-88057 Source advisory:...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +299 more potentially affected by CVE-2026-88057 via @angular/compiler (>=19.0.0, <=19.2.25)

@angular/compiler NPM version =19.0.0, =3.19.0, =0.0.327, =19.0.0, =8.0.0, =3.0.0, =1.0.0, =3.0.3 - @astro-sports-developers/shared 0.0.3 and more Source cves: CVE-2026-88057 Source advisory: OSV:GHSA-HH8M-FM6V-7CVG...

GHSA-HH8M-FM6V-7CVG Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks such as href, src, action, xlink:href, and data to protect against Cross-Site Scripting XSS. Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings host: 'attr.href':...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +44 more potentially affected by CVE-2026-88057 via @angular/core (>=20.0.0, <=20.3.25)

@angular/core NPM version =20.0.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - @getflip/swirl-components-angular 0.472.0-beta-20260406102253 and more Source cves:...

@amwaljs/checkout-angular (0.2.11), @augustalabs/ki-assistent (>=1.0.8, <=1.0.14) +21 more potentially affected by CVE-2026-88057 via @angular/compiler (>=21.0.0, <=21.2.19)

@angular/compiler NPM version =21.0.0, =1.0.8, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =1.0.0, =4.4.0-beta.2, =1.0.0-next.27766, =1.0.77-rc.1, =0.0.1, =0.5.11 - foliokit 0.0.0 and more Source cves: CVE-2026-88057 Source advisory:...

Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks such as href, src, action, xlink:href, and data to protect against Cross-Site Scripting XSS. Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings host: 'attr.href':...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.209-alpha) +57 more potentially affected by CVE-2026-88057 via @angular/core (>=21.0.0, <=21.2.19)

@angular/core NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =3.0.0 - @koalarx/ui 21.2.4 and more Source cves: CVE-2026-88057 Source advisory: OSV:GHSA-HH8M-FM6V-7CVG...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.8), @bitblit/ngx-acute-common (>=6.1.210-alpha, <=6.1.222-alpha) +18 more potentially affected by CVE-2026-88057 via @angular/core (>=22.0.0, <=22.0.8)

@angular/core NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =23.0.0-alpha.2, =23.0.0-alpha.2, =0.0.0, =25.0.0 - @memobit/angular 1.0.1 - @nativescript/template-blank-ng 9.1.0 - @nativescript/template-drawer-navigation-ng 9.1.0 - @nativescript/template-hello-world-ng 9.1.0 -...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via incorrect computation of security contexts for host bindings. The ingestHostBinding function and the sanitizer resolution pipeline fail to evaluate security contexts against the concrete host element,...

Cross-site Scripting (XSS)

Overview @angular/core is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly. Affected versions of this...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +332 more potentially affected by CVE-2026-88057 via @angular/core (>=19.0.0, <=19.2.25)

@angular/core NPM version =19.0.0, =3.19.0, =0.0.327, =19.0.0, =8.0.0, =3.0.0, =1.0.0, =3.0.3 and more Source cves: CVE-2026-88057 Source advisory: OSV:GHSA-HH8M-FM6V-7CVG...