create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-88056 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-88056 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-19778590...

3d-card (0.0.2), @cosla/sensemaking-web-ui (>=1.0.5, <=1.0.9) +20 more potentially affected by CVE-2026-88056 via @angular/platform-server (>=19.2.18, <=19.2.25)

@angular/platform-server NPM version =19.2.18, =1.0.5, =0.0.1-rc.2, =1.0.0, =0.0.2, =19.1.0, =16.0.0, =1.52.0, =0.0.0, =0.0.0, =14.1.0, =14.3.0 and more Source cves: CVE-2026-88056 Source advisory: OSV:GHSA-F6MR-PJWC-34M4...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-88056 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-88056 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-19778590...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.209-alpha) +53 more potentially affected by CVE-2026-88059 via @angular/common (>=21.0.0, <=21.2.19)

@angular/common NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =4.0.0, =6.1.0-edge.5 and more Source cves: CVE-2026-88059 Source advisory: OSV:GHSA-P297-FM68-3Q8C...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +33 more potentially affected by CVE-2026-88059 via @angular/common (>=20.0.0, <=20.3.25)

@angular/common NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =1.1.89, =0.0.57, =0.7.2, =0.7.3 and more Source cves: CVE-2026-88059 Source advisory: SNYK:JS-ANGULARCOMMON-19778383...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.25), @angelmartz/template-drawer-navigation-ng (9.1.0) +17 more potentially affected by CVE-2026-88059 via @angular/common (>=22.0.0, <=22.0.8)

@angular/common NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =23.0.0-alpha.2, =23.0.0-alpha.2, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.46 and more Source cves: CVE-2026-88059 Source advisory: OSV:GHSA-P297-FM68-3Q8C...

Use of Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the HttpTransferCache process. An attacker can access sensitive user-specific information by exploiting a scenario where a child HttpClient delegates requests to a parent client that...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +314 more potentially affected by CVE-2026-88059 via @angular/common (>=19.0.0, <=19.2.25)

@angular/common NPM version =19.0.0, =3.19.0, =0.0.327, =19.0.0, =8.0.0, =3.0.0, =1.0.0, =3.0.3 - @astro-sports-developers/shared 0.0.3 and more Source cves: CVE-2026-88059 Source advisory: OSV:GHSA-P297-FM68-3Q8C...

Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

A security bypass vulnerability was discovered in @angular/common when Server-Side Rendering SSR and hydration are enabled in applications using a hierarchical HttpClient configuration with withRequestsMadeViaParent. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +33 more potentially affected by CVE-2026-88059 via @angular/common (>=20.0.0, <=20.3.25)

@angular/common NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =1.1.89, =0.0.57, =0.7.2, =0.7.3 and more Source cves: CVE-2026-88059 Source advisory: OSV:GHSA-P297-FM68-3Q8C...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.209-alpha) +53 more potentially affected by CVE-2026-88059 via @angular/common (>=21.0.0, <=21.2.19)

@angular/common NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =4.0.0, =6.1.0-edge.5 and more Source cves: CVE-2026-88059 Source advisory: SNYK:JS-ANGULARCOMMON-19778383...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.25), @angelmartz/template-drawer-navigation-ng (9.1.0) +17 more potentially affected by CVE-2026-88059 via @angular/common (>=22.0.0, <=22.0.8)

@angular/common NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =23.0.0-alpha.2, =23.0.0-alpha.2, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.46 and more Source cves: CVE-2026-88059 Source advisory: SNYK:JS-ANGULARCOMMON-19778383...

GHSA-P297-FM68-3Q8C Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

A security bypass vulnerability was discovered in @angular/common when Server-Side Rendering SSR and hydration are enabled in applications using a hierarchical HttpClient configuration with withRequestsMadeViaParent. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +335 more potentially affected by CVE-2026-88057 via @angular/core (>=19.0.0, <=19.2.25)

@angular/core NPM version =19.0.0, =3.19.0, =0.0.327, =19.0.0, =8.0.0, =3.0.0, =1.0.0, =3.0.3 and more Source cves: CVE-2026-88057 Source advisory: OSV:GHSA-HH8M-FM6V-7CVG...

@absolutejs/absolute (0.12.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +36 more potentially affected by CVE-2026-88057 via @angular/compiler (>=20.0.0, <=20.3.21)

@angular/compiler NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =0.0.57, =0.0.60 - @saritasa/renewaire-frontend-sdk 0.1.0-dev.101 and more Source cves: CVE-2026-88057 Source advisory:...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via incorrect computation of security contexts for host bindings. The ingestHostBinding function and the sanitizer resolution pipeline fail to evaluate security contexts against the concrete host element,...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.25), @angelmartz/template-drawer-navigation-ng (9.1.0) +17 more potentially affected by CVE-2026-88057 via @angular/compiler (>=22.0.0, <=22.0.8)

@angular/compiler NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =23.0.0-alpha.2, =23.0.0-alpha.2, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.46 and more Source cves: CVE-2026-88057 Source advisory: SNYK:JS-ANGULARCOMPILER-19778381...

@absolutejs/absolute (0.12.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +36 more potentially affected by CVE-2026-88057 via @angular/compiler (>=20.0.0, <=20.3.21)

@angular/compiler NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =0.0.57, =0.0.60 - @saritasa/renewaire-frontend-sdk 0.1.0-dev.101 and more Source cves: CVE-2026-88057 Source advisory:...

@amwaljs/checkout-angular (0.2.11), @augustalabs/ki-assistent (>=1.0.8, <=1.0.14) +23 more potentially affected by CVE-2026-88057 via @angular/compiler (>=21.0.0, <=21.2.19)

@angular/compiler NPM version =21.0.0, =1.0.8, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =1.0.0, =4.4.0-beta.2, =0.19.0, =1.0.0-next.27766, =1.0.77-rc.1, =1.0.87 and more Source cves: CVE-2026-88057 Source advisory: OSV:GHSA-HH8M-FM6V-7CVG...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +44 more potentially affected by CVE-2026-88057 via @angular/core (>=20.0.0, <=20.3.25)

@angular/core NPM version =20.0.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - @getflip/swirl-components-angular 0.472.0-beta-20260406102253 and more Source cves:...