# @angular/platform-server (npm) vulnerabilities 11 known vulnerabilities (11 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 22.2.5 (Nov 6, 2026): no advisory affects it - Newest unaffected release: 22.2.5 (Nov 6, 2026), the latest release - Weekly downloads: 1M - Dependents: 17 - Releases: 500+ since 12.2.17 (Nov 22, 2022) - Registry: https://www.npmjs.com/package/@angular/platform-server - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-101895: 12.2.17 to 19.2.25 (20.0.0-next.0 is outside it); 20.0.0 to 20.3.30 (20.3.31 is outside it); 21.0.0 to 21.2.22 (21.2.23 is outside it); 22.0.0 to 22.1.5 (22.1.6 is outside it) - CVE-2026-88060: 12.2.17 to 19.2.25 (20.0.0-next.0 is outside it); 20.0.0 to 20.3.29 (20.3.30 is outside it); 21.0.0 to 21.2.21 (21.2.22 is outside it); 22.0.0 to 22.1.3 (22.1.4 is outside it) - CVE-2026-88058: 12.2.17 to 19.2.25 (20.0.0-next.0 is outside it); 20.0.0 to 20.3.29 (20.3.30 is outside it); 21.0.0 to 21.2.21 (21.2.22 is outside it); 22.0.0 to 22.1.3 (22.1.4 is outside it) - CVE-2026-88056: 12.2.17 to 19.2.25 (20.0.0-next.0 is outside it); 20.0.0 to 20.3.29 (20.3.30 is outside it); 21.0.0 to 21.2.21 (21.2.22 is outside it); 22.0.0 to 22.1.3 (22.1.4 is outside it) - CVE-2026-69149: 12.2.17 to 20.3.26 (20.3.27 is outside it); 21.0.0-next.0 to 21.2.18 (21.2.19 is outside it); 22.0.0-next.0 to 22.0.6 (22.0.7 is outside it) - CVE-2026-46417: 12.2.17 to 19.2.21 (19.2.22 is outside it); 20.0.0-next.0 to 20.3.20 (20.3.21 is outside it); 21.0.0-next.0 to 21.2.12 (21.2.13 is outside it); 22.0.0-next.0 to 22.0.0-next.11 (22.0.0-next.12 is outside it) - CVE-2026-50168: 12.2.17 to 19.2.22 (19.2.23 is outside it); 20.0.0-next.0 to 20.3.21 (20.3.22 is outside it); 21.0.0-next.0 to 21.2.14 (21.2.15 is outside it); 22.0.0-next.0 to 22.0.0-rc.1 (22.0.0-rc.2 is outside it) - CVE-2026-50556: 12.2.17 to 19.2.24 (19.2.25 is outside it); 20.0.0-next.0 to 20.3.23 (20.3.24 is outside it); 21.0.0-next.0 to 21.2.15 (21.2.16 is outside it); 22.0.0-next.0 to 22.0.0-rc.1 (22.0.0-rc.2 is outside it) - CVE-2026-50555: 12.2.17 to 19.2.24 (19.2.25 is outside it); 20.0.0-next.0 to 20.3.23 (20.3.24 is outside it); 21.0.0-next.0 to 21.2.15 (21.2.16 is outside it); 22.0.0-next.0 to 22.0.0-rc.1 (22.0.0-rc.2 is outside it) - CVE-2026-41423: 12.2.17 to 19.2.20 (19.2.21 is outside it); 20.0.0-next.0 to 20.3.18 (20.3.19 is outside it); 21.0.0-next.0 to 21.2.8 (21.2.9 is outside it); 22.0.0-next.0 to 22.0.0-next.7 (22.0.0-next.8 is outside it) - CVE-2025-59052: 16.0.0-next.0 to 18.2.13 (18.2.14 is outside it); 19.0.0-next.0 to 19.2.14 (19.2.15 is outside it); 20.0.0-next.0 to 20.3.0-rc.0 (20.3.0 is outside it); 21.0.0-next.0 to 21.0.0-next.2 (21.0.0-next.3 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (11) ### [CVE-2026-101895](https://cve.now/CVE-2026-101895): Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE - Severity: High 8.7 - Published: Oct 14, 2026 - Affected: from 22.0.0, fixed in 22.1.6; from 21.0.0, fixed in 21.2.23; from 20.0.0, fixed in 20.3.31; through 19.2.25. - Fixed in 20.3.31 (released Sep 9, 2026, 35 days before disclosure), 21.2.23 (released Sep 9, 2026, 35 days before disclosure) and 22.1.6 (released Sep 9, 2026, 35 days before disclosure). - The latest release, 22.2.5, is not affected. - 56% of @angular/platform-server downloads last week were affected versions (694.3K). ### [CVE-2026-88060](https://cve.now/CVE-2026-88060): Angular: SSR XSS via Unescaped \ Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements - Severity: High 8.6 - Published: Sep 10, 2026 - Affected: from 22.0.0, fixed in 22.1.4; from 21.0.0, fixed in 21.2.22; from 20.0.0, fixed in 20.3.30; through 19.2.25. - Fixed in 20.3.30 (released Aug 26, 2026, 15 days before disclosure), 21.2.22 (released Aug 26, 2026, 15 days before disclosure) and 22.1.4 (released Aug 27, 2026, 14 days before disclosure). - The latest release, 22.2.5, is not affected. - 53% of @angular/platform-server downloads last week were affected versions (657.9K). ### [CVE-2026-88058](https://cve.now/CVE-2026-88058): Angular: SSR XSS via Unescaped Processing Instruction (\) Nodes in Fallback Raw-Content Elements - Severity: High 8.6 - Published: Sep 10, 2026 - Affected: from 22.0.0, fixed in 22.1.4; from 21.0.0, fixed in 21.2.22; from 20.0.0, fixed in 20.3.30; through 19.2.25. - Fixed in 20.3.30 (released Aug 26, 2026, 15 days before disclosure), 21.2.22 (released Aug 26, 2026, 15 days before disclosure) and 22.1.4 (released Aug 27, 2026, 14 days before disclosure). - The latest release, 22.2.5, is not affected. - 53% of @angular/platform-server downloads last week were affected versions (657.9K). ### [CVE-2026-88056](https://cve.now/CVE-2026-88056): Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR - Severity: High 8.6 - Published: Sep 10, 2026 - Affected: from 22.0.0, fixed in 22.1.4; from 21.0.0, fixed in 21.2.22; from 20.0.0, fixed in 20.3.30; through 19.2.25. - Fixed in 20.3.30 (released Aug 26, 2026, 15 days before disclosure), 21.2.22 (released Aug 26, 2026, 15 days before disclosure) and 22.1.4 (released Aug 27, 2026, 14 days before disclosure). - The latest release, 22.2.5, is not affected. - 53% of @angular/platform-server downloads last week were affected versions (657.9K). ### [CVE-2026-69149](https://cve.now/CVE-2026-69149): Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS) - Severity: High 8.6 - Published: Aug 3, 2026 - Affected: from 22.0.0-next.0, fixed in 22.0.7; from 21.0.0-next.0, fixed in 21.2.19; from 20.0.0-next.0, fixed in 20.3.27; through 19.2.25. - Fixed in 20.3.27 (released Jul 29, 2026, 5 days before disclosure), 21.2.19 (released Jul 29, 2026, 5 days before disclosure) and 22.0.7 (released Jul 16, 2026, 18 days before disclosure). - The latest release, 22.2.5, is not affected. - 49% of @angular/platform-server downloads last week were affected versions (612.6K). ### [CVE-2026-46417](https://cve.now/CVE-2026-46417): Angular: SSRF via Hostname Hijacking in @angular/platform-server - Severity: High 8.8 - Published: Jun 22, 2026 - Affected: from 22.0.0-next.0, fixed in 22.0.0-next.12; from 21.0.0-next.0, fixed in 21.2.13; from 20.0.0-next.0, fixed in 20.3.21; from 19.0.0-next.0, fixed in 19.2.22; through 18.2.14. - Fixed in 19.2.22 (released May 12, 2026, 41 days before disclosure), 20.3.21 (released May 12, 2026, 41 days before disclosure), 21.2.13 (released May 13, 2026, 40 days before disclosure) and 1 other version. - The latest release, 22.2.5, is not affected. - 40% of @angular/platform-server downloads last week were affected versions (501K). ### [CVE-2026-50168](https://cve.now/CVE-2026-50168): Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass - Severity: High 8.8 - Published: Jun 22, 2026 - Affected: from 22.0.0-next.0, fixed in 22.0.0-rc.2; from 20.0.0-next.0, fixed in 20.3.22; from 19.0.0-next.0, fixed in 19.2.23; through 18.2.14; from 21.0.0-next.0, fixed in 21.2.15. - Fixed in 19.2.23 (released May 27, 2026, 26 days before disclosure), 20.3.22 (released May 27, 2026, 26 days before disclosure), 21.2.15 (released May 28, 2026, 25 days before disclosure) and 1 other version. - The latest release, 22.2.5, is not affected. - 42% of @angular/platform-server downloads last week were affected versions (517.3K). ### [CVE-2026-50556](https://cve.now/CVE-2026-50556): Angular: Missing \`\\` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR - Severity: High 8.6 - Published: Jun 22, 2026 - Affected: from 22.0.0-next.0, fixed in 22.0.0-rc.2; from 21.0.0-next.0, fixed in 21.2.16; from 20.0.0-next.0, fixed in 20.3.24; from 19.0.0-next.0, fixed in 19.2.25; through 18.2.14. - Fixed in 19.2.25 (released Jun 2, 2026, 20 days before disclosure), 20.3.24 (released Jun 2, 2026, 20 days before disclosure), 21.2.16 (released Jun 3, 2026, 19 days before disclosure) and 1 other version. - The latest release, 22.2.5, is not affected. - 42% of @angular/platform-server downloads last week were affected versions (526.7K). ### [CVE-2026-50555](https://cve.now/CVE-2026-50555): Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-server - Severity: High 8.6 - Published: Jun 22, 2026 - Affected: from 22.0.0-next.0, fixed in 22.0.0-rc.2; from 21.0.0-next.0, fixed in 21.2.16; from 20.0.0-next.0, fixed in 20.3.24; from 19.0.0-next.0, fixed in 19.2.25; through 18.2.14. - Fixed in 19.2.25 (released Jun 2, 2026, 20 days before disclosure), 20.3.24 (released Jun 2, 2026, 20 days before disclosure), 21.2.16 (released Jun 3, 2026, 19 days before disclosure) and 1 other version. - The latest release, 22.2.5, is not affected. - 42% of @angular/platform-server downloads last week were affected versions (526.7K). ### [CVE-2026-41423](https://cve.now/CVE-2026-41423): Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server - Severity: High 8.7 - Published: May 8, 2026 - Affected: from 22.0.0-next.0, fixed in 22.0.0-next.8; from 21.0.0-next.0, fixed in 21.2.9; from 20.0.0-next.0, fixed in 20.3.19; from 19.0.0-next.0, fixed in 19.2.21; through 18.2.14. - Fixed in 19.2.21 (released Apr 15, 2026, 23 days before disclosure), 20.3.19 (released Apr 15, 2026, 23 days before disclosure), 21.2.9 (released Apr 15, 2026, 23 days before disclosure) and 1 other version. - The latest release, 22.2.5, is not affected. - 38% of @angular/platform-server downloads last week were affected versions (468.5K). ### [CVE-2025-59052](https://cve.now/CVE-2025-59052): Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage - Severity: High 7.1 - Published: Sep 10, 2025 - Affected: from 16.0.0-next.0, fixed in 18.2.14; from 20.0.0-next.0, fixed in 20.3.0; from 19.0.0-next.0, fixed in 19.2.15; from 21.0.0-next.0, fixed in 21.0.0-next.3. - Fixed in 18.2.14 (released Sep 10, 2025, the day of disclosure), 19.2.15 (released Sep 10, 2025, the day of disclosure), 20.3.0 (released Sep 10, 2025, the day of disclosure) and 1 other version. - The latest release, 22.2.5, is not affected. - 14% of @angular/platform-server downloads last week were affected versions (174.8K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@angular/platform-server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.