npmPackage

@angular/platform-server

11 known vulnerabilities (11 high), with the versions each affects and the releases that fix them.

Latest release: 22.2.5 (Nov 6, 2026): no advisory affects it
Newest unaffected release: 22.2.5 (Nov 6, 2026), the latest release
Advisories: 11 · 11 high

Weekly downloads: 1M
Dependents: 17
Releases: 500+ since 12.2.17 (Nov 22, 2022)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-101895
Affects 12.2.17 to 19.2.25 (20.0.0-next.0 is outside it); 20.0.0 to 20.3.30 (20.3.31 is outside it); 21.0.0 to 21.2.22 (21.2.23 is outside it); 22.0.0 to 22.1.5 (22.1.6 is outside it)
CVE-2026-88060
Affects 12.2.17 to 19.2.25 (20.0.0-next.0 is outside it); 20.0.0 to 20.3.29 (20.3.30 is outside it); 21.0.0 to 21.2.21 (21.2.22 is outside it); 22.0.0 to 22.1.3 (22.1.4 is outside it)
CVE-2026-88058
Affects 12.2.17 to 19.2.25 (20.0.0-next.0 is outside it); 20.0.0 to 20.3.29 (20.3.30 is outside it); 21.0.0 to 21.2.21 (21.2.22 is outside it); 22.0.0 to 22.1.3 (22.1.4 is outside it)
CVE-2026-88056
Affects 12.2.17 to 19.2.25 (20.0.0-next.0 is outside it); 20.0.0 to 20.3.29 (20.3.30 is outside it); 21.0.0 to 21.2.21 (21.2.22 is outside it); 22.0.0 to 22.1.3 (22.1.4 is outside it)
CVE-2026-69149
Affects 12.2.17 to 20.3.26 (20.3.27 is outside it); 21.0.0-next.0 to 21.2.18 (21.2.19 is outside it); 22.0.0-next.0 to 22.0.6 (22.0.7 is outside it)
CVE-2026-46417
Affects 12.2.17 to 19.2.21 (19.2.22 is outside it); 20.0.0-next.0 to 20.3.20 (20.3.21 is outside it); 21.0.0-next.0 to 21.2.12 (21.2.13 is outside it); 22.0.0-next.0 to 22.0.0-next.11 (22.0.0-next.12 is outside it)
CVE-2026-50168
Affects 12.2.17 to 19.2.22 (19.2.23 is outside it); 20.0.0-next.0 to 20.3.21 (20.3.22 is outside it); 21.0.0-next.0 to 21.2.14 (21.2.15 is outside it); 22.0.0-next.0 to 22.0.0-rc.1 (22.0.0-rc.2 is outside it)
CVE-2026-50556
Affects 12.2.17 to 19.2.24 (19.2.25 is outside it); 20.0.0-next.0 to 20.3.23 (20.3.24 is outside it); 21.0.0-next.0 to 21.2.15 (21.2.16 is outside it); 22.0.0-next.0 to 22.0.0-rc.1 (22.0.0-rc.2 is outside it)
CVE-2026-50555
Affects 12.2.17 to 19.2.24 (19.2.25 is outside it); 20.0.0-next.0 to 20.3.23 (20.3.24 is outside it); 21.0.0-next.0 to 21.2.15 (21.2.16 is outside it); 22.0.0-next.0 to 22.0.0-rc.1 (22.0.0-rc.2 is outside it)
CVE-2026-41423
Affects 12.2.17 to 19.2.20 (19.2.21 is outside it); 20.0.0-next.0 to 20.3.18 (20.3.19 is outside it); 21.0.0-next.0 to 21.2.8 (21.2.9 is outside it); 22.0.0-next.0 to 22.0.0-next.7 (22.0.0-next.8 is outside it)
CVE-2025-59052
Affects 16.0.0-next.0 to 18.2.13 (18.2.14 is outside it); 19.0.0-next.0 to 19.2.14 (19.2.15 is outside it); 20.0.0-next.0 to 20.3.0-rc.0 (20.3.0 is outside it); 21.0.0-next.0 to 21.0.0-next.2 (21.0.0-next.3 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 11

CVE-2026-101895High 8.7
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
Affected: from 22.0.0, fixed in 22.1.6; from 21.0.0, fixed in 21.2.23; from 20.0.0, fixed in 20.3.31; through 19.2.25.
Fixed in 20.3.31 (released Sep 9, 2026, 35 days before disclosure), 21.2.23 (released Sep 9, 2026, 35 days before disclosure) and 22.1.6 (released Sep 9, 2026, 35 days before disclosure).
The latest release, 22.2.5, is not affected.
56% of @angular/platform-server downloads last week were affected versions (694.3K).
CVE-2026-88060High 8.6
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
Affected: from 22.0.0, fixed in 22.1.4; from 21.0.0, fixed in 21.2.22; from 20.0.0, fixed in 20.3.30; through 19.2.25.
Fixed in 20.3.30 (released Aug 26, 2026, 15 days before disclosure), 21.2.22 (released Aug 26, 2026, 15 days before disclosure) and 22.1.4 (released Aug 27, 2026, 14 days before disclosure).
The latest release, 22.2.5, is not affected.
53% of @angular/platform-server downloads last week were affected versions (657.9K).
CVE-2026-88058High 8.6
Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
Affected: from 22.0.0, fixed in 22.1.4; from 21.0.0, fixed in 21.2.22; from 20.0.0, fixed in 20.3.30; through 19.2.25.
Fixed in 20.3.30 (released Aug 26, 2026, 15 days before disclosure), 21.2.22 (released Aug 26, 2026, 15 days before disclosure) and 22.1.4 (released Aug 27, 2026, 14 days before disclosure).
The latest release, 22.2.5, is not affected.
53% of @angular/platform-server downloads last week were affected versions (657.9K).
CVE-2026-88056High 8.6
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
Affected: from 22.0.0, fixed in 22.1.4; from 21.0.0, fixed in 21.2.22; from 20.0.0, fixed in 20.3.30; through 19.2.25.
Fixed in 20.3.30 (released Aug 26, 2026, 15 days before disclosure), 21.2.22 (released Aug 26, 2026, 15 days before disclosure) and 22.1.4 (released Aug 27, 2026, 14 days before disclosure).
The latest release, 22.2.5, is not affected.
53% of @angular/platform-server downloads last week were affected versions (657.9K).
CVE-2026-69149High 8.6
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
Affected: from 22.0.0-next.0, fixed in 22.0.7; from 21.0.0-next.0, fixed in 21.2.19; from 20.0.0-next.0, fixed in 20.3.27; through 19.2.25.
Fixed in 20.3.27 (released Jul 29, 2026, 5 days before disclosure), 21.2.19 (released Jul 29, 2026, 5 days before disclosure) and 22.0.7 (released Jul 16, 2026, 18 days before disclosure).
The latest release, 22.2.5, is not affected.
49% of @angular/platform-server downloads last week were affected versions (612.6K).
CVE-2026-46417High 8.8
Angular: SSRF via Hostname Hijacking in @angular/platform-server
Affected: from 22.0.0-next.0, fixed in 22.0.0-next.12; from 21.0.0-next.0, fixed in 21.2.13; from 20.0.0-next.0, fixed in 20.3.21; from 19.0.0-next.0, fixed in 19.2.22; through 18.2.14.
Fixed in 19.2.22 (released May 12, 2026, 41 days before disclosure), 20.3.21 (released May 12, 2026, 41 days before disclosure), 21.2.13 (released May 13, 2026, 40 days before disclosure) and 1 other version.
The latest release, 22.2.5, is not affected.
40% of @angular/platform-server downloads last week were affected versions (501K).
CVE-2026-50168High 8.8
Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass
Affected: from 22.0.0-next.0, fixed in 22.0.0-rc.2; from 20.0.0-next.0, fixed in 20.3.22; from 19.0.0-next.0, fixed in 19.2.23; through 18.2.14; from 21.0.0-next.0, fixed in 21.2.15.
Fixed in 19.2.23 (released May 27, 2026, 26 days before disclosure), 20.3.22 (released May 27, 2026, 26 days before disclosure), 21.2.15 (released May 28, 2026, 25 days before disclosure) and 1 other version.
The latest release, 22.2.5, is not affected.
42% of @angular/platform-server downloads last week were affected versions (517.3K).
CVE-2026-50556High 8.6
Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR
Affected: from 22.0.0-next.0, fixed in 22.0.0-rc.2; from 21.0.0-next.0, fixed in 21.2.16; from 20.0.0-next.0, fixed in 20.3.24; from 19.0.0-next.0, fixed in 19.2.25; through 18.2.14.
Fixed in 19.2.25 (released Jun 2, 2026, 20 days before disclosure), 20.3.24 (released Jun 2, 2026, 20 days before disclosure), 21.2.16 (released Jun 3, 2026, 19 days before disclosure) and 1 other version.
The latest release, 22.2.5, is not affected.
42% of @angular/platform-server downloads last week were affected versions (526.7K).
CVE-2026-50555High 8.6
Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-server
Affected: from 22.0.0-next.0, fixed in 22.0.0-rc.2; from 21.0.0-next.0, fixed in 21.2.16; from 20.0.0-next.0, fixed in 20.3.24; from 19.0.0-next.0, fixed in 19.2.25; through 18.2.14.
Fixed in 19.2.25 (released Jun 2, 2026, 20 days before disclosure), 20.3.24 (released Jun 2, 2026, 20 days before disclosure), 21.2.16 (released Jun 3, 2026, 19 days before disclosure) and 1 other version.
The latest release, 22.2.5, is not affected.
42% of @angular/platform-server downloads last week were affected versions (526.7K).
CVE-2026-41423High 8.7
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
Affected: from 22.0.0-next.0, fixed in 22.0.0-next.8; from 21.0.0-next.0, fixed in 21.2.9; from 20.0.0-next.0, fixed in 20.3.19; from 19.0.0-next.0, fixed in 19.2.21; through 18.2.14.
Fixed in 19.2.21 (released Apr 15, 2026, 23 days before disclosure), 20.3.19 (released Apr 15, 2026, 23 days before disclosure), 21.2.9 (released Apr 15, 2026, 23 days before disclosure) and 1 other version.
The latest release, 22.2.5, is not affected.
38% of @angular/platform-server downloads last week were affected versions (468.5K).
CVE-2025-59052High 7.1
Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage
Affected: from 16.0.0-next.0, fixed in 18.2.14; from 20.0.0-next.0, fixed in 20.3.0; from 19.0.0-next.0, fixed in 19.2.15; from 21.0.0-next.0, fixed in 21.0.0-next.3.
Fixed in 18.2.14 (released Sep 10, 2025, the day of disclosure), 19.2.15 (released Sep 10, 2025, the day of disclosure), 20.3.0 (released Sep 10, 2025, the day of disclosure) and 1 other version.
The latest release, 22.2.5, is not affected.
14% of @angular/platform-server downloads last week were affected versions (174.8K).