angular has 21 CVEs on record. Cadence is steady at roughly 8 per quarter. The busiest recent month was June 2026 with 13. The median CVSS is 8.6 (high). None have a confirmed exploitation report. The dominant weakness classes are CWE-79 (10) and CWE-200 (4). Most affected products: @angular/common (5), angular (5), @angular/core (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.6
- Publish → KEV
- —
- Last 90 days
- 8 prev 13
Products
- @angular/common 5
- angular 5
- @angular/core 3
- @angular/platform-server 3
- @angular/service-worker 3
- @angular/compiler 2
Worst active — by depth score
CVE-2026-88060High· 8.6Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements59CVE-2026-88058High· 8.6Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages59CVE-2026-88056High· 8.6Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages59CVE-2026-69151HighAngular i18n: Cross-Site Scripting (XSS) via event-handler attributes41CVE-2026-69149HighAngular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)41
angular vulnerabilities
CVEs affecting angular, newest first. Open any entry for full detail, references, and exploit status.
21 CVEsRSS
CVE-2026-88057Medium· 5.3Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compi…
CVE-2026-88059Medium· 4.0Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authentic…
CVE-2026-88056High· 8.6PoCAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processe…
CVE-2026-88058High· 8.6PoCAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server se…
CVE-2026-88060High· 8.6PoCAngular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server se…
CVE-2026-68945HighAngular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
CVE-2026-69149HighAngular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
CVE-2026-69151HighAngular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
CVE-2026-54267HighAngular Client Hydration DOM Clobbering & Response-Cache Poisoning
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
CVE-2026-50168High@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
CVE-2026-50169MediumAngular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
CVE-2026-52725Medium@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
CVE-2026-50170High@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
CVE-2026-50171High@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
CVE-2026-50184Medium@angular/service-worker: Request Credential & Cache Policy Stripping
@angular/service-worker: Request Credential & Cache Policy Stripping
CVE-2026-50555High@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-50557MediumAngular: Template and Attribute Namespace Sanitization Bypass (XSS)
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
CVE-2026-54265Medium@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)
@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)
CVE-2026-54266High@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
CVE-2026-54268High@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
CVE-2026-54264High@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker