Skip to content
OpenAdvisories

Package · npm

@angular/common

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Medium 5.9
    CVE-2026-111753

    Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not …

    angular angular @angular/common npm
  • Medium 4.0
    CVE-2026-88059

    Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Ser…

    angular angular angular.js angular.js Debian Ubuntu npm
  • High 8.8
    CVE-2026-68945

    Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinc…

    angular angular common angular.js Debian Ubuntu npm
  • High 8.2
    CVE-2026-50171

    Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a Denial of Service (DoS) vulnerability exists in the @angular/common pack…

    angular angular angular.js angular.js Debian Ubuntu npm
  • High 8.2
    CVE-2026-50170

    Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered in @angular/common when Server-Side Renderi…

    angular angular angular.js angular.js Debian Ubuntu npm
  • High 8.2
    CVE-2026-54268

    Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Ang…

    angular angular angular.js angular.js Debian Ubuntu npm
  • High 8.8
    CVE-2026-54266

    Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR)…

    angular angular angular.js angular.js Debian Ubuntu npm
  • High 7.7
    CVE-2025-66035

    Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP client…

    angular angular angular.js @angular/common Ubuntu npm