@angular/common
22.2.3 · 14 Oct 2026MIT3.3M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @angular/common. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 22.2.3 | Safe from 22.1.1 | |
| 21.2.25 | Safe from 21.2.20 | |
| 20.3.34 | Safe from 20.3.34 | |
| 19.2.25 | 5 open advisories, worst high | |
| 18.2.14 | 128 open advisories, worst high · last release Sep 2025, no longer updated |
- HighAngular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State PoisoningGHSA-jhpw-976m-542j · 3 Aug 2026
- 22.x22.0.0 – 22.0.1Fixed in 22.0.2
- 21.x21.0.0 – 21.2.18Fixed in 21.2.19
- 20.x20.0.0 – 20.3.26Fixed in 20.3.27
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.27
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.27
- High@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)GHSA-48r7-hpm6-gfxm · 15 Jun 2026
- 22.x22.0.0Fixed in 22.0.1
- 21.x21.0.0 – 21.2.16Fixed in 21.2.17
- 20.x20.0.0 – 20.3.24Fixed in 20.3.25
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.25
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.25
- High@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State PoisoningGHSA-39pv-4j6c-2g6v · 15 Jun 2026
- 22.x22.0.0Fixed in 22.0.1
- 21.x21.0.0 – 21.2.16Fixed in 21.2.17
- 20.x20.0.0 – 20.3.24Fixed in 20.3.25
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.25
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.25
- High@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)GHSA-p3vc-36g9-x9gr · 15 Jun 2026
- 21.x21.0.0 – 21.2.14Fixed in 21.2.15
- 20.x20.0.0 – 20.3.21Fixed in 20.3.22
- 19.x19.0.0 – 19.2.22Fixed in 19.2.23
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 19.2.23
- High@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCacheGHSA-q6f4-qqrg-jv6x · 15 Jun 2026
- 21.x21.0.0 – 21.2.14Fixed in 21.2.15
- 20.x20.0.0 – 20.3.21Fixed in 20.3.22
- 19.x19.0.0 – 19.2.22Fixed in 19.2.23
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 19.2.23
- HighAngular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP ClientGHSA-58c5-g7wp-6w37 · 26 Nov 2025
- 21.x21.0.0Fixed in 21.0.1
- 20.x20.0.0 – 20.3.13Fixed in 20.3.14
- 19.x19.0.0 – 19.2.15Fixed in 19.2.16
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 19.2.16
- Moderate@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)GHSA-jfgx-762w-99vr · 20 Oct 2026
- 21.x21.0.0 – 21.0.2Fixed in 21.0.3
- 20.x20.0.0 – 20.3.33Fixed in 20.3.34
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.34
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.34
- ModerateAngular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`GHSA-p297-fm68-3q8c · 10 Sep 2026
- 22.x22.0.0 – 22.1.0Fixed in 22.1.1
- 21.x21.0.0 – 21.2.19Fixed in 21.2.20
- 20.x20.0.0 – 20.3.27Fixed in 20.3.28
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.28
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.28
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.