CVE-2026-54268: Uncontrolled Resource Consumption

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service DoS vulnerability exists in the @angular/common package of the Angular framework. The formatDate function,...

CVE-2026-54267: Improper Neutralization of Input During Web Page Generation

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, to optimize client-side bootstrap in Server-Side Rendered SSR environments, Angular supports Hydration via...

CVE-2026-54266: Use of Weak Hash

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering SSR so that they can be reused during...

CVE-2026-54265: Improper Neutralization of Input During Web Page Generation

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property...

CVE-2026-50184: Exposure of Sensitive Information to an Unauthorized Actor

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during...

CVE-2026-50168: Origin Validation Error

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints an...

CVE-2026-46417: Server-Side Request Forgery (SSRF)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22, a Server-Side Request Forgery SSRF vulnerability exists in @angular/platform-server. The issue stems from how...

CVE-2026-49241: Improper Neutralization of Input During Web Page Generation

The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. Prior to 21.2.4, the client-side Angular Language Service VS Code extension reads the custom TypeScript SDK paths typescript.tsdk and js/ts.tsdk.path directly from workspace configurations...

CVE-2026-50555: Improper Neutralization of Input During Web Page Generation

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino wh...

CVE-2026-50178: Improper Neutralization of Input During Web Page Generation

The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. the client-side Angular Language Service VS Code extension configures the tooltip Markdown renderer with the isTrusted: true option located in client/src/client.ts. This setting instructs VS...

CVE-2026-54264: Exposure of Sensitive Information to an Unauthorized Actor

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Servi...

CVE-2026-50171: Uncontrolled Resource Consumption

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a Denial of Service DoS vulnerability exists in the @angular/common package of Angular. The formatNumber functio...

CVE-2026-50557: Improper Neutralization of Input During Web Page Generation

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute...

CVE-2026-50169: Exposure of Sensitive Information to an Unauthorized Actor

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during...

MAL-2026-6255 Malicious code in fork-angular-daterangepicker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d81ecc9a5b511f1d867597c3834e62c3c174209ba7718db45bf27af5d862d90f package.json declares a preinstall lifecycle hook "preinstall": "node index.js" that runs index.js on every npm install. index.js line 3 hardcodes...

Malicious code in fork-angular-daterangepicker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d81ecc9a5b511f1d867597c3834e62c3c174209ba7718db45bf27af5d862d90f package.json declares a preinstall lifecycle hook "preinstall": "node index.js" that runs index.js on every npm install. index.js line 3 hardcodes...

Denial Of Service (DoS)

angular/common is vulnerable to Denial of Service DoS. The vulnerability is due to improper validation of the digitsInfo parameter in the formatNumber function, which allows an attacker to supply excessively large fraction digit values that trigger an unbounded loop and excessive memory...

Cross-Site Scripting (XSS)

Angular is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of namespaced script elements and attributes in the @angular/compiler and @angular/core packages, which allows an attacker to inject specially crafted namespaced templates that bypass Angular's...

Cross-Site Scripting (XSS)

Angular is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the Angular template compiler failing to apply the required sanitizer for sensitive native DOM properties used with two-way property bindings, which allows an attacker to bypass Angular's built-in DOM sanitization and...

Denial Of Service (DoS)

@angular/common is vulnerable to Denial of Service DoS. The vulnerability is due to insufficient validation of the format parameter in the formatDate function, which allows an attacker to supply a maliciously crafted, excessively long date format string, causing excessive CPU and memory consumpti...