View all Blog Posts
Security
Oct 23, 2026

7 New Angular CVEs: No Fix for Angular 19 and Earlier

Seven Angular CVEs, including a one-request SSR denial of service, leave every end-of-life Angular line exposed. See fix versions and who is affected.

Give me the TL;DR
7 New Angular CVEs: No Fix for Angular 19 and Earlier

Between September 10 and October 14, 2026, the HeroDevs Angular team published seven new fixed CVEs. Four are rated High: CVE-2026-101895 (8.7, a denial of service in @angular/platform-server), CVE-2026-88056 (8.6, SSRF and credential disclosure in SSR), and two SSR cross-site scripting bugs, CVE-2026-88058 and CVE-2026-88060 (8.6 each). Three are rated Medium: CVE-2026-104871 (6.3, path traversal in @angular/ssr on Windows), CVE-2026-88057 (5.3, a host-binding sanitization bypass in @angular/core and @angular/compiler), and CVE-2026-88059 (4.0, authenticated responses leaking through HttpTransferCache). None require privileges (PR:N on every vector).

Upstream fixes shipped in Angular 20.3.x, 21.2.x, and 22.1.x. Angular 19 reached end of life on May 19, 2026, and every line from Angular 5 through 19 carries at least four of these seven CVEs with no OSS fix available. All seven are remediated in NES for Angular (HeroDevs Never-Ending Support).

‍Is your Angular version affected and unsupported? See NES for Angular.

TL;DR: Which Angular versions need action

If you are on Angular 21 or 22, update the framework packages to 21.2.23 or 22.1.6 or later, and @angular/ssr to 21.2.23 or 22.1.7 or later. Any 22.2.x release already includes all seven fixes.

If you are on Angular 20, the same fixes exist in 20.3.31 and @angular/ssr 20.3.36, but Angular 20 itself reaches end of life on November 28, 2026. Treat the patch as a stopgap and plan the move to Angular 21 or 22.

If you are on Angular 19 or earlier, Angular will not ship a fix. The exact count depends on your major version: Angular 16 through 19 are exposed to all seven, Angular 8 through 15 to at least five, and Angular 5 through 7 to at least four.

One triage shortcut before anything else: six of the seven only matter if you run server-side rendering. If your application is a pure client-side build with no @angular/platform-server or @angular/ssr in the deployed path, there's only low severity impact. CVE-2026-88057 is the one with a larger impact.

The seven Angular CVEs at a glance

Severity is the GitHub CNA rating, which matches each HeroDevs Vulnerability Directory entry. Affected ranges are from the directory, which adds the version where each bug was introduced. The upstream records mark everything at or below 19.2.25 as affected but list no fix for it.