Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@angular/router

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release
22.2.5 (Nov 6, 2026): no advisory affects it
Newest unaffected release
22.2.5 (Nov 6, 2026), the latest release
Advisories
2 · 2 high
Weekly downloads
7.3M
Dependents
211
Releases
500+ since 12.2.17 (Nov 22, 2022)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-111751
    Affects 21.2.0 to 21.2.24 (21.2.25 is outside it); 22.0.0 to 22.2.0 (22.2.1 is outside it)
  • CVE-2026-101896
    Affects 12.2.17 to 19.2.25 (20.0.0-next.0 is outside it); 20.0.0 to 20.3.31 (20.3.32 is outside it); 21.0.0 to 21.2.23 (21.2.24 is outside it); 22.0.0 to 22.2.0-rc.0 (22.2.0 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 2

  • Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

    Affected: from 22.0.0, fixed in 22.2.1; from 21.2.0, fixed in 21.2.25.

    Fixed in 21.2.25 (released Sep 30, 2026, 34 days before disclosure) and 22.2.1 (released Sep 30, 2026, 34 days before disclosure).

    The latest release, 22.2.5, is not affected.

    18% of @angular/router downloads last week were affected versions (1.5M).

  • Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)

    Affected: from 22.0.0, fixed in 22.2.0; from 21.0.0, fixed in 21.2.24; from 20.0.0, fixed in 20.3.32; through 19.2.25.

    Fixed in 20.3.32 (released Sep 23, 2026, 21 days before disclosure), 21.2.24 (released Sep 23, 2026, 21 days before disclosure) and 22.2.0 (released Sep 23, 2026, 21 days before disclosure).

    The latest release, 22.2.5, is not affected.

    58% of @angular/router downloads last week were affected versions (5M).