@angular/compiler
22.2.3 · 14 Oct 2026MIT3.3M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @angular/compiler. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 22.2.3 | Safe from 22.1.0 | |
| 21.2.25 | Safe from 21.2.20 | |
| 20.3.34 | Safe from 20.3.28 | |
| 19.2.25 | 3 open advisories, worst high | |
| 18.2.14 | 98 open advisories, worst high · last release Sep 2025, no longer updated |
- HighAngular i18n: Cross-Site Scripting (XSS) via event-handler attributesGHSA-jj27-h5hq-8x99 · 3 Aug 2026
- 22.x22.0.0Fixed in 22.0.1
- 21.x21.0.0 – 21.2.18Fixed in 21.2.19
- 20.x20.0.0 – 20.3.26Fixed in 20.3.27
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.27
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.27
- HighAngular vulnerable to XSS in i18n attribute bindingsGHSA-g93w-mfhg-p222 · 13 Mar 2026
- 21.x21.0.0 – 21.2.3Fixed in 21.2.4
- 20.x20.0.0 – 20.3.17Fixed in 20.3.18
- 19.x19.0.0 – 19.2.19Fixed in 19.2.20
- 18.x and older17.0.0 – 18.2.14No fix, no longer updated · move to 19.2.20
- HighAngular has XSS Vulnerability via Unsanitized SVG Script AttributesGHSA-jrmj-c5cx-3cw6 · 9 Jan 2026
- 21.x21.0.0 – 21.0.6Fixed in 21.0.7
- 20.x20.0.0 – 20.3.15Fixed in 20.3.16
- 19.x19.0.0 – 19.2.17Fixed in 19.2.18
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 19.2.18
- HighAngular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML AttributesGHSA-v4hv-rgfq-gp49 · 2 Dec 2025
- 21.x21.0.0 – 21.0.1Fixed in 21.0.2
- 20.x20.0.0 – 20.3.14Fixed in 20.3.15
- 19.x19.0.0 – 19.2.16Fixed in 19.2.17
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 19.2.17
- ModerateAngular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compilerGHSA-hh8m-fm6v-7cvg · 10 Sep 2026
- 22.x22.0.0 – 22.0.8Fixed in 22.1.0
- 21.x21.0.0 – 21.2.19Fixed in 21.2.20
- 20.x20.0.0 – 20.3.27Fixed in 20.3.28
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.28
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.28
- Moderate@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)GHSA-58w9-8g37-x9v5 · 15 Jun 2026
- 22.x22.0.0Fixed in 22.0.1
- 21.x21.0.0 – 21.2.16Fixed in 21.2.17
- 20.x20.0.0 – 20.3.24Fixed in 20.3.25
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.25
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.25
- ModerateAngular: Template and Attribute Namespace Sanitization Bypass (XSS)GHSA-f3m7-gqxr-g87x · 15 Jun 2026
- 21.x21.0.0 – 21.2.14Fixed in 21.2.15
- 20.x20.0.0 – 20.3.21Fixed in 20.3.22
- 19.x19.0.0 – 19.2.21Fixed in 19.2.22
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 19.2.22
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.