@angular/platform-server

22.2.3 · 14 Oct 2026MIT444.2k / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for @angular/platform-server. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	22.2.3	Safe from 22.2.1
	21.2.25	Safe from 21.2.25
	20.3.34	Safe from 20.3.33
	19.2.25	6 open advisories, worst high
	18.2.14	178 open advisories, worst high · last release Sep 2025, no longer updated

Your version

High
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPEGHSA-f67j-2jqw-jpq7 · 28 Sep 2026
- 22.x22.0.0 – 22.1.5Fixed in 22.1.6
- 21.x21.0.0 – 21.2.22Fixed in 21.2.23
- 20.x20.0.0 – 20.3.30Fixed in 20.3.31
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.31
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.31
High
Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content ElementsGHSA-j3r3-mxqp-r2p4 · 28 Sep 2026
- 22.x22.0.0 – 22.1.3Fixed in 22.1.4
- 21.x21.0.0 – 21.2.21Fixed in 21.2.22
- 20.x20.0.0 – 20.3.29Fixed in 20.3.30
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.30
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.30
High
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content ElementsGHSA-v3p8-whq6-r5jg · 10 Sep 2026
- 22.x22.0.0 – 22.1.3Fixed in 22.1.4
- 21.x21.0.0 – 21.2.21Fixed in 21.2.22
- 20.x20.0.0 – 20.3.29Fixed in 20.3.30
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.30
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.30
High
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSRGHSA-f6mr-pjwc-34m4 · 10 Sep 2026
- 22.x22.0.0 – 22.1.3Fixed in 22.1.4
- 21.x21.0.0 – 21.2.21Fixed in 21.2.22
- 20.x20.0.0 – 20.3.29Fixed in 20.3.30
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.30
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.30
High
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)GHSA-vpx6-8pjr-4g3v · 3 Aug 2026
- 22.x22.0.0 – 22.0.6Fixed in 22.0.7
- 21.x21.0.0 – 21.2.18Fixed in 21.2.19
- 20.x20.0.0 – 20.3.26Fixed in 20.3.27
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.27
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.27
High
@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSRGHSA-gxx4-3xcv-f8qx · 15 Jun 2026
- 21.x21.0.0 – 21.2.15Fixed in 21.2.16
- 20.x20.0.0 – 20.3.23Fixed in 20.3.24
- 19.x19.0.0 – 19.2.24Fixed in 19.2.25
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 19.2.25
High
@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')GHSA-hqr9-c56f-3x7f · 15 Jun 2026
- 21.x21.0.0 – 21.2.15Fixed in 21.2.16
- 20.x20.0.0 – 20.3.23Fixed in 20.3.24
- 19.x19.0.0 – 19.2.24Fixed in 19.2.25
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 19.2.25
High
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist BypassGHSA-xrxm-cp7j-8xf6 · 15 Jun 2026
- 21.x21.0.0 – 21.2.14Fixed in 21.2.15
- 20.x20.0.0 – 20.3.21Fixed in 20.3.22
- 19.x19.0.0 – 19.2.22Fixed in 19.2.23
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 19.2.23
High
@angular/platform-server: SSRF via Hostname HijackingGHSA-rfh7-fxqc-q52v · 19 May 2026
- 21.x21.0.0 – 21.2.12Fixed in 21.2.13
- 20.x20.0.0 – 20.3.20Fixed in 20.3.21
- 19.x19.0.0 – 19.2.21Fixed in 19.2.22
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 19.2.22
High
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-ServerGHSA-45q2-gjvg-7973 · 16 Apr 2026
- 21.x21.0.0 – 21.2.8Fixed in 21.2.9
- 20.x20.0.0 – 20.3.18Fixed in 20.3.19
- 19.x19.0.0 – 19.2.20Fixed in 19.2.21
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 19.2.21
High
Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data LeakageGHSA-68x2-mx4q-78m7 · 10 Sep 2025
- 20.x20.0.0 – 20.2.4Fixed in 20.3.0
- 19.x19.0.0 – 19.2.14Fixed in 19.2.15
- 18.x18.0.0 – 18.2.13Fixed in 18.2.14
- 17.x and older16.0.0 – 17.3.12No fix, no longer updated · move to 18.2.14
Moderate
@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)GHSA-w739-gvwx-grc3 · 20 Oct 2026
- 22.x22.0.0 – 22.2.0Fixed in 22.2.1
- 21.x21.0.0 – 21.2.24Fixed in 21.2.25
- 20.x20.0.0 – 20.3.32Fixed in 20.3.33
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.33
- 18.x and older2.0.0 – 18.2.14No fix, no longer updated · move to 20.3.33

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.