angular common vulnerabilities

Latest angular common CVEs

Newest publication first

1. CVE-2026-111753 Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

   Published 2026-11-05

   Medium·CVSS 5.9 EPSS 0.54%

   Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URL...

2. CVE-2026-88059 Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

   Published 2026-09-10

   Medium·CVSS 5.8 EPSS 0.34%

   Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (S...

3. CVE-2026-68945 Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

   Published 2026-08-03

   High·CVSS 8.8 EPSS 0.18%

   Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests...

4. CVE-2026-50171 Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

   Published 2026-06-22

   High·CVSS 8.2 EPSS 0.26%

   Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a Denial of Service (DoS) vulnerability exists in the @angular/common package of Angular. The f...

5. CVE-2026-50170 Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

   Published 2026-06-22

   High·CVSS 8.2 EPSS 0.43%

   Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered in @angular/common when Server-Side Rendering (SSR) and hydratio...

6. CVE-2026-54268 Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

   Published 2026-06-22

   High·CVSS 8.2 EPSS 0.58%

   Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The f...

7. CVE-2026-54266 Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

   Published 2026-06-22

   High·CVSS 8.8 EPSS 0.13%

   Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be...

8. CVE-2025-66035 Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs

   Published 2025-11-26

   High·CVSS 7.7 EPSS 0.72%

   Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.