Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@angular/common

7 known vulnerabilities (6 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 6 high, 1 medium
Weekly downloads
8M
Dependents
380
Registry
npm

Advisories 7

  • CVE-2026-88059Medium 4.0

    Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

    Affected: from 22.0.0, fixed in 22.1.1; from 21.0.0, fixed in 21.2.20; from 20.0.0, fixed in 20.3.28; through 19.2.25.

  • Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

    Affected: from 22.0.0-next.0, fixed in 22.0.2; from 21.0.0-next.0, fixed in 21.2.19; from 20.0.0-next.0, fixed in 20.3.27; through 19.2.25.

  • Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

    Affected: from 22.0.0-next.0, fixed in 22.0.0-rc.2; from 20.0.0-next.0, fixed in 20.3.22; from 19.0.0-next.0, fixed in 19.2.23; through 18.2.14; from 21.0.0-next.0, fixed in 21.2.15.

  • Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

    Affected: from 22.0.0-next.0, fixed in 22.0.0-rc.2; from 20.0.0-next.0, fixed in 20.3.22; from 19.0.0-next.0, fixed in 19.2.23; through 18.2.14; from 21.0.0-next.0, fixed in 21.2.15.

  • Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

    Affected: from 22.0.0-next.0, fixed in 22.0.1; from 21.0.0-next.0, fixed in 21.2.17; from 20.0.0-next.0, fixed in 20.3.25; through 19.2.25.

  • Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

    Affected: from 22.0.0-next.0, fixed in 22.0.1; from 21.0.0-next.0, fixed in 21.2.17; from 20.0.0-next.0, fixed in 20.3.25; through 19.2.25.

  • Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs

    Affected: from 21.0.0-next.0, fixed in 21.0.1; from 20.0.0-next.0, fixed in 20.3.14; fixed in 19.2.16.