@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-50168 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-50168 Source advisory: OSV:GHSA-XRXM-CP7J-8XF6...

Server-side Request Forgery (SSRF)

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parse...

GHSA-RGJC-H3X7-9MWG Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

To optimize client-side bootstrap in Server-Side Rendered SSR environments, Angular supports Hydration via provideClientHydration. During SSR, Angular serializes the application's runtime state such as cached HttpClient responses and outputs it into the HTML stream as a tag with a predictable...

Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

To optimize client-side bootstrap in Server-Side Rendered SSR environments, Angular supports Hydration via provideClientHydration. During SSR, Angular serializes the application's runtime state such as cached HttpClient responses and outputs it into the HTML stream as a tag with a predictable...

ngx-mat-input-tel (22.0.0) potentially affected by CVE-2026-54267 via @angular/core (22.0.0)

@angular/core NPM version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/core and may be impacted: - ngx-mat-input-tel 22.0.0 Source cves: CVE-2026-54267 Source advisory: OSV:GHSA-RGJC-H3X7-9MWG...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +329 more potentially affected by CVE-2026-54267 via @angular/core (>=19.0.0-next.9, <=19.2.25)

@angular/core NPM version =19.0.0-next.9, =3.19.0, =0.0.327, =19.0.0, =8.0.0, =3.0.0, =1.0.0, =3.0.3 - @astro-sports-developers/shared 0.0.3 and more Source cves: CVE-2026-54267 Source advisory: OSV:GHSA-RGJC-H3X7-9MWG...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +41 more potentially affected by CVE-2026-54267 via @angular/core (>=20.0.0-rc.0, <=20.3.21)

@angular/core NPM version =20.0.0-rc.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - @getflip/swirl-components-angular 0.472.0-beta-20260406102253 and more Source cves:...

ngx-mat-input-tel (22.0.0) potentially affected by CVE-2026-54267 via @angular/core (22.0.0)

@angular/core NPM version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/core and may be impacted: - ngx-mat-input-tel 22.0.0 Source cves: CVE-2026-54267 Source advisory: GHSA-RGJC-H3X7-9MWG...

Modification of Assumed-Immutable Data

Overview @angular/core is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly. Affected versions of this...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +329 more potentially affected by CVE-2026-54267 via @angular/core (>=19.0.0-next.9, <=19.2.25)

@angular/core NPM version =19.0.0-next.9, =3.19.0, =0.0.327, =19.0.0, =8.0.0, =3.0.0, =1.0.0, =3.0.3 - @astro-sports-developers/shared 0.0.3 and more Source cves: CVE-2026-54267 Source advisory: GHSA-RGJC-H3X7-9MWG...

ngx-mat-input-tel (22.0.0) potentially affected by CVE-2026-54267 via @angular/core (22.0.0)

@angular/core NPM version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/core and may be impacted: - ngx-mat-input-tel 22.0.0 Source cves: CVE-2026-54267 Source advisory: SNYK:JS-ANGULARCORE-17353317...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +41 more potentially affected by CVE-2026-54267 via @angular/core (>=20.0.0-rc.0, <=20.3.21)

@angular/core NPM version =20.0.0-rc.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - @getflip/swirl-components-angular 0.472.0-beta-20260406102253 and more Source cves:...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +41 more potentially affected by CVE-2026-54267 via @angular/core (>=20.0.0-rc.0, <=20.3.21)

@angular/core NPM version =20.0.0-rc.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - @getflip/swirl-components-angular 0.472.0-beta-20260406102253 and more Source cves:...

ROOT-APP-NPM-AIKIDO-2026-11077 AIKIDO-2026-11077 in @rootio/angular__core - Patched by Root

Root has patched AIKIDO-2026-11077 in the @rootio/angularcore package for Root:npm. Multiple fixed versions available...

PT-2026-49561

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.0-rc.2 Angular versions prior to 21.2.15 Angular versions prior to 20.3.22 Angular versions prior to 19.2.23 Description An issue exists in @angular/common when Server-Side Rendering SSR and hydration are enabled...

PT-2026-49567

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.0-rc.2 Angular versions prior to 21.2.15 Angular versions prior to 20.3.22 Angular versions prior to 19.2.22 Description An issue in the @angular/compiler and @angular/core packages allows bypassing element and...

PT-2026-49562

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.0-rc.2 Angular versions prior to 21.2.15 Angular versions prior to 20.3.22 Angular versions prior to 19.2.23 Description A Denial of Service DoS issue exists in the @angular/common package. The formatNumber...

PT-2026-49580

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.1 Angular versions prior to 21.2.17 Angular versions prior to 20.3.25 Description An information disclosure issue exists in the @angular/service-worker package. When the Service Worker fetches assets, it preserve...

PT-2026-49560

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.0-rc.2 Angular versions prior to 21.2.15 Angular versions prior to 20.3.22 Angular versions prior to 19.2.23 Description An issue in the @angular/service-worker package compromises the integrity of request-policy...

PT-2026-49566

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.0-rc.2 Angular versions prior to 21.2.16 Angular versions prior to 20.3.24 Angular versions prior to 19.2.25 Description A Cross-Site Scripting XSS issue exists in the DOM emulation dependency domino used by...