npm Package Vulnerabilities
Vulnerabilities associated with @angular/common.
Packages
Clear package- openclaw588 vulnerabilities
- n8n139 vulnerabilities
- parse-server116 vulnerabilities
- flowise112 vulnerabilities
- electron65 vulnerabilities
- next64 vulnerabilities
- directus58 vulnerabilities
- nocodb54 vulnerabilities
- hono47 vulnerabilities
- axios43 vulnerabilities
- vm243 vulnerabilities
- ghost41 vulnerabilities
- @budibase/server40 vulnerabilities
- undici35 vulnerabilities
- flowise-components29 vulnerabilities
- @anthropic-ai/claude-code28 vulnerabilities
- dompurify28 vulnerabilities
- pnpm28 vulnerabilities
- astro25 vulnerabilities
- @openzeppelin/contracts-upgradeable22 vulnerabilities
- better-auth22 vulnerabilities
- vite22 vulnerabilities
- @openzeppelin/contracts21 vulnerabilities
- fuxa-server21 vulnerabilities
- nuxt21 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-68945HIGH | Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State PoisoningAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2. CWE-345Aug 3, 2026 | CVSS8.8v4.0 | EPSS0.119% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-50171HIGH | Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a Denial of Service (DoS) vulnerability exists in the @angular/common package of Angular. The formatNumber function, which is also utilized by DecimalPipe, PercentPipe, and CurrencyPipe, does not properly validate the upper bounds of the digitsInfo parameter. Specifically, the minimum and maximum fraction digits p… | CVSS8.2v4.0 | EPSS0.161% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-50170HIGH | Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCacheAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered in @angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via TransferState. However, the cac… CWE-524Jun 22, 2026 | CVSS8.2v4.0 | EPSS0.268% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-54268HIGH | Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string… | CVSS8.2v4.0 | EPSS0.327% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-54266HIGH | Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State PoisoningAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration. This avoids repeating the same HTTP requests on the client. The cached responses are stored in TransferState using a cache key generated by hashing request properties (method, respons… | CVSS8.8v4.0 | EPSS0.09% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-66035HIGH | Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLsAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism t… | CVSS7.7v4.0 | EPSS0.645% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |