@angular/router
22.2.3 · 14 Oct 2026MIT3M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @angular/router. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 22.2.3 | Safe from 22.2.1 | |
| 21.2.25 | Safe from 21.2.25 | |
| 20.3.34 | Safe from 20.3.33 | |
| 19.2.25 | 2 open advisories, worst high | |
| 18.2.14 | 38 open advisories, worst high · last release Sep 2025, no longer updated |
- High@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)GHSA-57xq-rjx2-v5xh · 20 Oct 2026
- 22.x22.0.0 – 22.2.0Fixed in 22.2.1
- 21.x21.2.0 – 21.2.24Fixed in 21.2.25
- High@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)GHSA-62vg-58rm-qff7 · 20 Oct 2026
- 22.x22.0.0 – 22.2.0Fixed in 22.2.1
- 21.x21.0.0 – 21.2.24Fixed in 21.2.25
- 20.x20.0.0 – 20.3.32Fixed in 20.3.33
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.33
- 18.x and older0.0.0 – 18.2.14No fix, no longer updated · move to 20.3.33
- HighAngular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix ParametersGHSA-ff3f-86qr-9cv3 · 30 Sep 2026
- 22.x22.0.0 – 22.1.8Fixed in 22.2.0
- 21.x21.0.0 – 21.2.23Fixed in 21.2.24
- 20.x20.0.0 – 20.3.31Fixed in 20.3.32
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.32
- 18.x and older0.0.0 – 18.2.14No fix, no longer updated · move to 20.3.32
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.