@angular/core

22.2.3 · 14 Oct 2026MIT3.4M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for @angular/core. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	22.2.3	Safe from 22.1.0
	21.2.25	Safe from 21.2.20
	20.3.34	Safe from 20.3.28
	19.2.25	3 open advisories, worst high
	18.2.14	121 open advisories, worst high · last release Sep 2025, no longer updated

Your version

High
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributesGHSA-jj27-h5hq-8x99 · 3 Aug 2026
- 22.x22.0.0Fixed in 22.0.1
- 21.x21.0.0 – 21.2.18Fixed in 21.2.19
- 20.x20.0.0 – 20.3.26Fixed in 20.3.27
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.27
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.27
High
Angular Client Hydration DOM Clobbering & Response-Cache PoisoningGHSA-rgjc-h3x7-9mwg · 15 Jun 2026
- 22.x22.0.0Fixed in 22.0.1
- 21.x21.0.0 – 21.2.16Fixed in 21.2.17
- 20.x20.0.0 – 20.3.24Fixed in 20.3.25
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.25
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.25
High
Angular vulnerable to XSS in i18n attribute bindingsGHSA-g93w-mfhg-p222 · 13 Mar 2026
- 21.x21.0.0 – 21.2.3Fixed in 21.2.4
- 20.x20.0.0 – 20.3.17Fixed in 20.3.18
- 19.x19.0.0 – 19.2.19Fixed in 19.2.20
- 18.x and older17.0.0 – 18.2.14No fix, no longer updated · move to 19.2.20
High
Angular i18n vulnerable to Cross-Site ScriptingGHSA-prjf-86w9-mfqv · 27 Feb 2026
- 21.x21.0.0 – 21.1.5Fixed in 21.1.6
- 20.x20.0.0 – 20.3.16Fixed in 20.3.17
- 19.x19.0.0 – 19.2.18Fixed in 19.2.19
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 19.2.19
High
Angular has XSS Vulnerability via Unsanitized SVG Script AttributesGHSA-jrmj-c5cx-3cw6 · 9 Jan 2026
- 21.x21.0.0 – 21.0.6Fixed in 21.0.7
- 20.x20.0.0 – 20.3.15Fixed in 20.3.16
- 19.x19.0.0 – 19.2.17Fixed in 19.2.18
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 19.2.18
Moderate
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compilerGHSA-hh8m-fm6v-7cvg · 10 Sep 2026
- 22.x22.0.0 – 22.0.8Fixed in 22.1.0
- 21.x21.0.0 – 21.2.19Fixed in 21.2.20
- 20.x20.0.0 – 20.3.27Fixed in 20.3.28
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.28
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.28
Moderate
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)GHSA-f3m7-gqxr-g87x · 15 Jun 2026
- 21.x21.0.0 – 21.2.14Fixed in 21.2.15
- 20.x20.0.0 – 20.3.21Fixed in 20.3.22
- 19.x19.0.0 – 19.2.21Fixed in 19.2.22
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 19.2.22
Moderate
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)GHSA-692r-grfm-v8x7 · 15 Jun 2026
- 21.x21.0.0 – 21.2.14Fixed in 21.2.15
- 20.x20.0.0 – 20.3.21Fixed in 20.3.22
- 19.x19.0.0 – 19.2.22Fixed in 19.2.23
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 19.2.23
Moderate
Angular vulnerable to Cross-site ScriptingGHSA-c75v-2vq8-878f · 27 May 2022
- 11.x11.0.0 – 11.0.4Fixed in 11.0.5
- 10.x10.0.0 – 10.2.4Fixed in 10.2.5
- 9.x and older2.0.0 – 9.1.13No fix, no longer updated · move to 10.2.5

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.