@angular/service-worker
22.2.3 · 14 Oct 2026MIT441.6k / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @angular/service-worker. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 22.2.3 | Safe from 22.0.1 | |
| 21.2.25 | Safe from 21.2.17 | |
| 20.3.34 | Safe from 20.3.25 | |
| 19.2.25 | 1 open advisory, worst high | |
| 18.2.14 | 69 open advisories, worst high · last release Sep 2025, no longer updated |
- High@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service WorkerGHSA-qxh6-94w6-9r5p · 15 Jun 2026
- 22.x22.0.0Fixed in 22.0.1
- 21.x21.0.0 – 21.2.16Fixed in 21.2.17
- 20.x20.0.0 – 20.3.24Fixed in 20.3.25
- 19.x19.0.0 – 19.2.25No fix on 19.x · move to 20.3.25
- 18.x and older0.0.0 – 18.2.14No fix, no longer updated · move to 20.3.25
- Moderate@angular/service-worker: Request Credential & Cache Policy StrippingGHSA-95qp-cmmw-mgqv · 15 Jun 2026
- 21.x21.0.0 – 21.2.14Fixed in 21.2.15
- 20.x20.0.0 – 20.3.21Fixed in 20.3.22
- 19.x19.0.0 – 19.2.22Fixed in 19.2.23
- 18.x and older0.0.0 – 18.2.14No fix, no longer updated · move to 19.2.23
- ModerateAngular Service Worker Policy-Bypass & Credential-Stripping VulnerabilitiesGHSA-gv2q-mqqv-365m · 15 Jun 2026
- 21.x21.0.0 – 21.2.14Fixed in 21.2.15
- 20.x20.0.0 – 20.3.21Fixed in 20.3.22
- 19.x19.0.0 – 19.2.22Fixed in 19.2.23
- 18.x and older0.0.0 – 18.2.14No fix, no longer updated · move to 19.2.23
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.