Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Angular — Vulnerabilities & Security Advisories 45

All 45 CVE vulnerabilities found in Angular, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses associated with the Angular web framework developed by Google. The collection encompasses a comprehensive range of vulnerabilities, including cross-site scripting, prototype pollution, and improper input validation, covering the entire historical timeline from the framework's initial release to the most recent stable versions. Readers can utilize this resource to track official advisories issued by the Angular team, understand the specific characteristics and impact of distinct weakness classes prevalent in client-side JavaScript applications, or review the complete vulnerability history of the product to assess legacy risks in existing deployments. The data is curated from multiple authoritative sources to ensure accuracy and completeness without relying on unverified reports. By centralizing this information, the page serves as a critical reference for security professionals, developers, and auditors seeking to harden Angular-based applications against known threats. It enables efficient identification of affected versions and provides context for remediation strategies, helping organizations maintain robust security postures while managing complex software dependencies. This aggregation supports proactive defense by highlighting patterns in past exploits and facilitating timely updates to mitigate potential attacks before they compromise sensitive data or system integrity.

Vendor: unspecified

CVE ID Title CVSS Severity Published
CVE-2026-111753 Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035) CWE-201 5.9 Medium 2026-11-05
CVE-2026-111751 Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR) CWE-400 8.2 High 2026-11-03
CVE-2026-111754 Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR) CWE-601 5.1 Medium 2026-11-03
CVE-2026-111752 Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) CWE-400 8.2 High 2026-11-03
CVE-2026-101896 Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR) CWE-400 8.2 High 2026-10-14
CVE-2026-101897 Angular DevTools (Local DoS) CWE-346 5.1 Medium 2026-10-14
CVE-2026-101895 Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE CWE-400 8.7 High 2026-10-14
CVE-2026-88060 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CWE-79 8.6 High 2026-09-10
CVE-2026-88059 Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent` CWE-200 4.0 Medium 2026-09-10
CVE-2026-88058 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CWE-79 8.6 High 2026-09-10
CVE-2026-88057 Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler CWE-79 5.3 Medium 2026-09-10
CVE-2026-88056 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CWE-918 8.6 High 2026-09-10
CVE-2026-69151 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes CWE-79 7.6 High 2026-08-03
CVE-2026-69149 Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS) CWE-79 8.6 High 2026-08-03
CVE-2026-68945 Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning CWE-345 8.8 High 2026-08-03
CVE-2026-50171 Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) CWE-400 - - 2026-06-22
CVE-2026-50184 Angular: Request Credential & Cache Policy Stripping in Angular Service Worker CWE-200 - - 2026-06-22
CVE-2026-50169 Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities CWE-200 - - 2026-06-22
CVE-2026-46417 Angular: SSRF via Hostname Hijacking in @angular/platform-server CWE-918 - - 2026-06-22
CVE-2026-50168 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass CWE-346 - - 2026-06-22
CVE-2026-50170 Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache CWE-524 - - 2026-06-22
CVE-2026-50556 Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR CWE-79 - - 2026-06-22
CVE-2026-50555 Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-server CWE-79 - - 2026-06-22
CVE-2026-54264 Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker CWE-200 - - 2026-06-22
CVE-2026-54268 Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate) CWE-400 - - 2026-06-22
CVE-2026-54267 Angular Client Hydration DOM Clobbering & Response-Cache Poisoning CWE-79 - - 2026-06-22
CVE-2026-54266 Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning CWE-328 - - 2026-06-22
CVE-2026-54265 Angular: Two-Way Property Binding Sanitization Bypass (XSS) CWE-79 - - 2026-06-22
CVE-2026-50178 Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension CWE-79 - - 2026-06-22
CVE-2026-52725 Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS) CWE-79 - - 2026-06-22

All 45 known CVE vulnerabilities affecting Angular with full Chinese analysis, references, and POCs where available.