Skip to content
OpenAdvisories

Package · npm

@nguniversal/common

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.2
    CVE-2026-27739 Public exploit

    Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline

    The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 have a Server-Side Request Forgery (SSRF) vulnerability in the Angular SSR request handling pipeline. The vulnerability exist…

    angular angular-cli @nguniversal/common @nguniversal/express-engine npm
  • High 7.1
    CVE-2025-59052

    Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the "platform injector") to hold request-specific state during server-side rendering. For historic…

    angular angular @angular/platform-server @angular/ssr npm
  • High —
    GHSA-r3hf-q8q7-fv2p

    Angular critical CSS inlining Cross-site Scripting Vulnerability Advisory

    ### Impact Angular Universal applications on 16.1.0 and 16.1.1 using critical CSS inlining are vulnerable to a [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) attack where an attacker can trick another user into visiting a page whic…

    @nguniversal/common npm