Angular (Node.js) – Support, CVEs & Health

Security

Known Vulnerabilities

8 active CVEs reported via OSV.dev

GHSA-692r-grfm-v8x7 CVSS_V3

@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

Published: 2026-06-15 Fixed in: 21.2.15

GHSA-c75v-2vq8-878f CVSS_V3

Angular vulnerable to Cross-site Scripting

Published: 2022-05-27 Fixed in: 11.0.5

GHSA-f3m7-gqxr-g87x CVSS_V3

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

Published: 2026-06-15 Fixed in: 21.2.15

GHSA-g93w-mfhg-p222 CVSS_V3

Angular vulnerable to XSS in i18n attribute bindings

Published: 2026-03-13 Fixed in: 22.0.0-next.3

GHSA-jj27-h5hq-8x99 CVSS_V4

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Published: 2026-08-03 Fixed in: 22.0.1

GHSA-jrmj-c5cx-3cw6 CVSS_V4

Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

Published: 2026-01-09 Fixed in: 21.1.0-rc.0

GHSA-prjf-86w9-mfqv CVSS_V3

Angular i18n vulnerable to Cross-Site Scripting

Published: 2026-02-27 Fixed in: 21.2.0

GHSA-rgjc-h3x7-9mwg CVSS_V3

Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

Published: 2026-06-15 Fixed in: 22.0.1