What Angular versions does NES support?

NES for Angular supports various versions from v4 to v19. HeroDevs provides ongoing support and patches to keep your applications secure and operational.

Does NES for Angular help with compliance?

NES for Angular helps maintain compliance by providing security patches and updates, even for older versions. The enterprise-grade SLA supports HIPAA, SOC-2, PCI DSS, and other standards. HeroDevs addresses CVEs that may affect older Angular versions.

How does licensing work for NES for Angular?

When you purchase Never-Ending Support, you acquire a commercial license for the support services. The pricing model is based on the number of users committing code to the project repo. Users are unnamed and transferable across team members.

Does HeroDevs have an SLA for NES for Angular?

Yes. Turn-around times vary based on the severity of the issues found or reported. Security-related issues and data corruption issues are top priority and will be resolved immediately (same day if possible). HeroDevs can provide the SLA for your team to review upon request.

Which browsers does NES for Angular support?

NES for Angular offers browser compatibility for Chrome, Firefox, Safari, and Edge.

Why do I need NES for Angular?

Using an unsupported version of Angular exposes your applications to security vulnerabilities, incompatibilities, and client SLA violations. Never-Ending Support (NES) for Angular means you can stay on your current version without migration and remain supported until you are ready to move on.

Keep your Angular apps
‍secure after end-of-life
— without migrating.

Drop-in security patches for Angular v4 through v19. No code changes, no forced migrations — keep shipping while we keep you secure.

Get Pricing

View Docs

Browse CVEs

TRUSTED BY ENTERPRISE

Angular Support Status

v4-v17

Google Support

NES Available

v18

Google Support

NES Available

v19

Google Support

NES Available

v20

EOL Nov 2026

v21

EOL May 2027

20+

CVEs Remediated in EOL Angular

Updated as new vulnerabilities are disclosed

What you get from Never-Ending Support (NES) for Angular

Security Patches

A new NES release every time we find, validate, and fix a CVE that affects your Angular version.

CVE fixes across all severity levels

Patched on EOL Angular versions the Angular project no longer maintains.

The deepest CVE track record

HeroDevs has found and fixed more Angular and AngularJS CVEs than any other organization.

On-Demand EOL Risk Assessment

81,000+ packages have known CVEs and zero fix path. Your SCA flags the vulnerabilities, but our EOL Dataset (EOL DS) tells you which software is dead.

Try it Now →

Drop-In Compatibility

Npm package replacement. No application code changes, works with your existing build and CI/CD.

Versions 4 through 19

Continuous coverage that works the same today as it did yesterday.

Works with your existing build and CI/CD

Installed as a same-name npm package replacement, so there is nothing to find and replace.

See How It Works →

Full Angular ecosystem covered too

Essentials and Essentials Plus extend protection to Angular-dependent packages like NgRx, Angular Material, RxJS, and more.

Support Commitment

Engineered with the contractual and compliance commitments enterprise procurement teams require.

SLA Compliance

Our patch delivery SLA guarantees that your organization will be compliant with regulations like SOC 2, NIS2, PCI DSS, HIPAA, DORA, and CRA.
‍
Learn More →

Commercial Contract Assurances

OSS NES is not only secure and compatible, but is offered with industry-standard commercial assurances for the use of HeroDevs Services.

Learn More →

One command. Your existing setup. Minutes to install.

package.json

"dependencies": {

"@angular/core": "npm:@neverendingsupport/angular-core@19.2.21-angular-19.2.22",

"@angular/compiler": "npm:@neverendingsupport/angular-compiler@19.2.21-angular-19.2.22",

"@angular/router": "npm:@neverendingsupport/angular-router@19.2.21-angular-19.2.22"

}

↳ Same APIs. Same versions. Just patched.

View Documentation →

Update package.json to point at @neverendingsupport/angular-*
add your token to .npmrc
run npm install

Works with Artifactory, Nexus, and your existing CI.

Works with

NPM

Angular CLI

GitHub Actions

Artifactory

Nexus

+25 CVEs Remediated

Switch to NES for Angular in minutes to fix these vulnerabilities immediately.

Severity

CVE

Category

Version(s) Affected

Published Date

Medium

CVE-2026-48934

Improper Certificate Validation

<=21.7.3 >=22.0.0 <22.23.0 >=23.0.0 <=23.11.1 >=24.0.0 <24.17.0 >=25.0.0 <=25.9.0 >=26.0.0 <26.3.1

Oct 13, 2026

High

CVE-2026-48933

Integer Overflow or Wraparound

>=15.0.0 <=21.7.3 >=22.0.0 <22.23.0 >=23.0.0 <=23.11.1 >=24.0.0 <24.17.0 >=25.0.0 <=25.9.0 >=26.0.0 <26.3.1

Oct 13, 2026

Critical

CVE-2026-48930

Improper Input Validation (4.16)

<=21.7.3 >=22.0.0 <22.23.0 >=23.0.0 <=23.11.1 >=24.0.0 <24.17.0 >=25.0.0 <=25.9.0 >=26.0.0 <26.3.1

Oct 13, 2026

Medium

CVE-2026-21714

Uncontrolled Resource Consumption

>=8.4.0 <=19.9.0 >=20.0.0 <20.20.2 >=21.0.0 <=21.7.3 >=22.0.0 <22.22.2 >=23.0.0 <=23.11.1 >=24.0.0 <24.14.1 >=25.0.0 <25.8.2

Oct 13, 2026

Medium

CVE-2026-21713

Signature Forgery

>=15.0.0 <=15.14.0 >=16.0.0 <=16.20.2 >=17.0.0 <=17.9.1 >=18.0.0 <=18.20.8 >=19.0.0 <=19.9.0 >=20.0.0 <20.20.2 >=21.0.0 <=21.7.3 >=22.0.0 <22.22.2 >=23.0.0 <=23.11.1 >=24.0.0 <24.14.1 >=25.0.0 <25.8.2

Oct 13, 2026

High

CVE-2026-21710

Denial of Service

>=16.17.0 <=16.20.2 >=18.3.0 <=18.20.8 >=19.0.0 <=19.9.0 >=20.0.0 <20.20.2 >=21.0.0 <=21.7.3 >=22.0.0 <22.22.2 >=23.0.0 <=23.11.1 >=24.0.0 <24.14.1 >=25.0.0 <25.8.2

Oct 13, 2026

Medium

CVE-2025-22150

Cryptographic Weakness

>=16.15.0 <=16.20.2 >=17.5.0 <=17.9.1 >=18.0.0 <18.20.6 >=19.0.0 <=19.9.0 >=20.0.0 <20.18.2 >=21.0.0 <=21.7.3 >=22.0.0 <22.13.1 >=23.0.0 <23.6.1

Oct 13, 2026

Low

CVE-2024-30261

Insufficient Verification of Data Authenticity

>=16.18.0 <=16.20.2 >=18.9.0 <18.20.1 >=19.0.0 <=19.9.0 >=20.0.0 <20.12.1 >=21.0.0 <21.7.2

Oct 13, 2026

Medium

CVE-2024-24758

Information Exposure

>=16.15.0 <=16.20.2 >=17.5.0 <=17.9.1 >=18.0.0 <18.19.1 >=19.0.0 <=19.9.0 >=20.0.0 <20.11.1 >=21.0.0 <21.6.2

Oct 13, 2026

Medium

CVE-2024-13176

Information Exposure

<=17.9.1 >=18.0.0 <18.20.8 >=19.0.0 <=19.9.0 >=20.0.0 <20.19.5 >=21.0.0 <=21.7.3 >=22.0.0 <22.15.0 >=23.0.0 <23.10.0

Oct 13, 2026

Medium

CVE-2024-9143

Buffer Over-read

<=17.9.1 >=18.0.0 <18.20.8 >=19.0.0 <=19.9.0 >=20.0.0 <20.19.5 >=21.0.0 <=21.7.3 >=22.0.0 <22.15.0 >=23.0.0 <23.10.0

Oct 13, 2026

Critical

CVE-2024-4947

Access of Resource Using Incompatible Type ('Type Confusion')

>=18.0.0 <=18.20.8 >=19.0.0 <=19.9.0 >=20.0.0 <=20.20.2 >=21.0.0 <=21.7.3 >=22.0.0 <22.3.0

Oct 13, 2026

High

CVE-2024-4761

Heap-based Buffer Overflow

>=16.0.0 <=16.20.2 >=17.0.0 <=17.9.1 >=18.0.0 <=18.20.8 >=19.0.0 <=19.9.0 >=20.0.0 <=20.20.2 >=21.0.0 <=21.7.3 >=22.0.0 <22.3.0

Oct 13, 2026

Medium

CVE-2024-0727

Denial of Service

<=16.20.2 >=17.0.0 <=17.9.1 >=18.0.0 <18.19.1 >=19.0.0 <=19.9.0 >=20.0.0 <20.11.1 >=21.0.0 <21.6.2

Oct 13, 2026

High

CVE-2023-45853

Integer Overflow or Wraparound

<=16.20.2 >=17.0.0 <=17.9.1 >=18.0.0 <18.19.0 >=19.0.0 <=19.9.0 >=20.0.0 <20.7.0

Oct 13, 2026

High

CVE-2023-44487

Uncontrolled Resource Consumption

>=8.4.0 <=8.17.0 >=9.0.0 <=9.11.2 >=10.0.0 <=10.24.1 >=11.0.0 <=11.15.0 >=12.0.0 <=12.22.12 >=13.0.0 <=13.14.0 >=14.0.0 <=14.21.3 >=15.0.0 <=15.14.0 >=16.0.0 <=16.20.2 >=17.0.0 <=17.9.1 >=18.0.0 <18.18.2 >=19.0.0 <=19.9.0 >=20.0.0 <20.8.1

Oct 9, 2026

High

CVE-2023-35945

Uncontrolled Resource Consumption

Oct 8, 2026

Medium

CVE-2023-23920

Privilege Escalation

>=4.0.0 <=4.9.1 >=5.0.0 <=5.12.0 >=6.0.0 <=6.17.1 >=7.0.0 <=7.10.1 >=8.0.0 <=8.17.0 >=9.0.0 <=9.11.2 >=10.0.0 <=10.24.1 >=11.0.0 <=11.15.0 >=12.0.0 <=12.22.12 >=13.0.0 <=13.14.0 >=14.0.0 <14.21.3 >=15.0.0 <=15.14.0 >=16.0.0 <16.19.1 >=17.0.0 <=17.9.1 >=18.0.0 <18.14.1 >=19.0.0 <19.6.1

Oct 8, 2026

Medium

CVE-2023-6129

Denial of Service

>=17.0.0 <=17.9.1 >=18.0.0 <18.19.1 >=19.0.0 <=19.9.0 >=20.0.0 <20.11.1 >=21.0.0 <21.6.2

Oct 8, 2026

Medium

CVE-2023-5678

Unchecked Input for Loop Condition

>=4.0.0 <=4.9.1 >=5.0.0 <=5.12.0 >=6.0.0 <=6.17.1 >=7.0.0 <=7.10.1 >=8.0.0 <=8.17.0 >=9.0.0 <=9.11.2 >=10.16.0 <=10.24.1 >=11.9.0 <=11.15.0 >=12.0.0 <=12.22.12 >=13.0.0 <=13.14.0 >=14.0.0 <=14.21.3 >=15.0.0 <=15.14.0 >=16.0.0 <=16.20.2 >=17.0.0 <=17.9.1 >=18.0.0 <18.19.1 >=19.0.0 <=19.9.0 >=20.0.0 <20.11.1 >=21.0.0 <21.6.2

Oct 8, 2026

Medium

CVE-2023-3817

Unchecked Input for Loop Condition

>=4.0.0 <=4.9.1 >=5.0.0 <=5.12.0 >=6.0.0 <=6.17.1 >=7.0.0 <=7.10.1 >=8.0.0 <=8.17.0 >=9.0.0 <=9.11.2 >=10.16.0 <=10.24.1 >=11.9.0 <=11.15.0 >=12.0.0 <=12.22.12 >=13.0.0 <=13.14.0 >=14.0.0 <=14.21.3 >=15.0.0 <=15.14.0 >=16.0.0 <16.20.2 >=17.0.0 <=17.9.1 >=18.0.0 <18.17.1 >=19.0.0 <=19.9.0 >=20.0.0 <20.5.1

Oct 8, 2026

Medium

CVE-2023-2975

Cryptographic Weakness

>=17.0.0 <=17.9.1 >=18.0.0 <18.17.1 >=19.0.0 <=19.9.0 >=20.0.0 <20.5.1

Oct 8, 2026

Medium

CVE-2023-2650

Inefficient Algorithmic Complexity

>=4.0.0 <=4.9.1 >=5.0.0 <=5.12.0 >=6.0.0 <=6.17.1 >=7.0.0 <=7.10.1 >=8.0.0 <=8.17.0 >=9.0.0 <=9.11.2 >=10.16.0 <=10.24.1 >=11.9.0 <=11.15.0 >=12.0.0 <=12.22.12 >=13.0.0 <=13.14.0 >=14.0.0 <=14.21.3 >=15.0.0 <=15.14.0 >=16.0.0 <16.20.1 >=17.0.0 <=17.9.1 >=18.0.0 <18.16.1 >=19.0.0 <=19.9.0 >=20.0.0 <20.3.1

Oct 8, 2026

Medium

CVE-2023-1255

Buffer Over-read

>=17.0.0 <=17.9.1 >=18.0.0 <18.16.1 >=19.0.0 <=19.9.0 >=20.0.0 <20.3.1

Oct 8, 2026

High

CVE-2023-0464

Inefficient Algorithmic Complexity

>=4.0.0 <=4.9.1 >=5.0.0 <=5.12.0 >=6.0.0 <=6.17.1 >=7.0.0 <=7.10.1 >=8.0.0 <=8.17.0 >=9.0.0 <=9.11.2 >=10.16.0 <=10.24.1 >=11.9.0 <=11.15.0 >=12.0.0 <=12.22.12 >=13.0.0 <=13.14.0 >=14.0.0 <=14.21.3 >=15.0.0 <=15.14.0 >=16.0.0 <16.20.1 >=17.0.0 <=17.9.1 >=18.0.0 <18.16.1 >=19.0.0 <=19.9.0 >=20.0.0 <20.3.1

Oct 8, 2026

High

CVE-2023-0286

Access of Resource Using Incompatible Type ('Type Confusion')

>=4.0.0 <=4.9.1 >=5.0.0 <=5.12.0 >=6.0.0 <=6.17.1 >=7.0.0 <=7.10.1 >=8.0.0 <=8.17.0 >=9.0.0 <=9.11.2 >=10.16.0 <=10.24.1 >=11.9.0 <=11.15.0 >=12.0.0 <=12.22.12 >=13.0.0 <=13.14.0 >=14.0.0 <14.21.3 >=15.0.0 <=15.14.0 >=16.0.0 <16.19.1 >=17.0.0 <=17.9.1 >=18.0.0 <18.14.1 >=19.0.0 <19.6.1

Oct 8, 2026

High

CVE-2023-0401

Denial of Service

>=17.0.0 <=17.9.1 >=18.0.0 <18.14.1 >=19.0.0 <19.6.1

Oct 8, 2026

High

CVE-2023-0216

Denial of Service

>=17.0.0 <=17.9.1 >=18.0.0 <18.14.1 >=19.0.0 <19.6.1

Oct 8, 2026

High

CVE-2023-0215

Use After Free

>=4.0.0 <=4.9.1 >=5.0.0 <=5.12.0 >=6.0.0 <=6.17.1 >=7.0.0 <=7.10.1 >=8.0.0 <=8.17.0 >=9.0.0 <=9.11.2 >=10.16.0 <=10.24.1 >=11.9.0 <=11.15.0 >=12.0.0 <=12.22.12 >=13.0.0 <=13.14.0 >=14.0.0 <14.21.3 >=15.0.0 <=15.14.0 >=16.0.0 <16.19.1 >=17.0.0 <=17.9.1 >=18.0.0 <18.14.1 >=19.0.0 <19.6.1

Oct 8, 2026

High

CVE-2022-43548

Remote Code Execution

>=4.0.0 <=4.9.1 >=5.0.0 <=5.12.0 >=6.0.0 <=6.17.1 >=7.0.0 <=7.10.1 >=8.0.0 <=8.17.0 >=9.0.0 <=9.11.2 >=10.0.0 <=10.24.1 >=11.0.0 <=11.15.0 >=12.0.0 <=12.22.12 >=13.0.0 <=13.14.0 >=14.0.0 <14.21.1 >=15.0.0 <=15.14.0 >=16.0.0 <16.18.1 >=17.0.0 <=17.9.1 >=18.0.0 <18.12.1 >=19.0.0 <19.0.1

Oct 8, 2026

High

CVE-2023-5363

Cryptographic Weakness

>=17.0.0 <=17.9.1 >=18.0.0 <18.19.0 >=19.0.0 <=19.9.0 >=20.0.0 <20.10.0 >=21.0.0 <21.2.0

Oct 8, 2026

Medium

CVE-2022-4450

Denial of Service

>=10.16.0 <=10.24.1 >=11.9.0 <=11.15.0 >=12.0.0 <=12.22.12 >=13.0.0 <=13.14.0 >=14.0.0 <14.21.3 >=15.0.0 <=15.14.0 >=16.0.0 <16.19.1 >=17.0.0 <=17.9.1 >=18.0.0 <18.14.1 >=19.0.0 <19.6.1

Oct 7, 2026

Low

CVE-2022-4904

Stack-based Buffer Overflow

>=4.0.0 <=4.9.1 >=5.0.0 <=5.12.0 >=6.0.0 <=6.17.1 >=7.0.0 <=7.10.1 >=8.0.0 <=8.17.0 >=9.0.0 <=9.11.2 >=10.0.0 <=10.24.1 >=11.0.0 <=11.15.0 >=12.0.0 <=12.22.12 >=13.0.0 <=13.14.0 >=14.0.0 <=14.21.3 >=15.0.0 <=15.14.0 >=16.0.0 <16.20.1 >=17.0.0 <=17.9.1 >=18.0.0 <18.16.0 >=19.0.0 <19.7.0

Oct 7, 2026

Medium

CVE-2022-4304

Information Exposure

>=4.0.0 <=4.9.1 >=5.0.0 <=5.12.0 >=6.0.0 <=6.17.1 >=7.0.0 <=7.10.1 >=8.0.0 <=8.17.0 >=9.0.0 <=9.11.2 >=10.16.0 <=10.24.1 >=11.9.0 <=11.15.0 >=12.0.0 <=12.22.12 >=13.0.0 <=13.14.0 >=14.0.0 <14.21.3 >=15.0.0 <=15.14.0 >=16.0.0 <16.19.1 >=17.0.0 <=17.9.1 >=18.0.0 <18.14.1 >=19.0.0 <19.6.1

Oct 2, 2026

Medium

CVE-2022-4203

Buffer Over-read

>=17.0.0 <=17.9.1; >=18.0.0 <18.14.1; >=19.0.0 <19.6.1

Oct 2, 2026

Medium

CVE-2022-2097

Cryptographic Weakness

>=10.16.0 <=10.24.1; >=11.9.0 <=11.15.0; >=12.0.0 <=12.22.12; >=13.0.0 <=13.14.0; >=14.0.0 <14.20.0; >=15.0.0 <=15.14.0; >=16.0.0 <16.16.0; >=17.0.0 <=17.9.1; >=18.0.0 <18.5.0

Oct 2, 2026

High

CVE-2022-2068

Command Injection

>=4.0.0 <=4.9.1 >=5.0.0 <=5.12.0 >=6.0.0 <=6.17.1 >=7.0.0 <=7.10.1 >=8.0.0 <=8.17.0 >=9.0.0 <=9.11.2 >=10.16.0 <=10.24.1 >=11.9.0 <=11.15.0 >=12.0.0 <=12.22.12 >=13.0.0 <=13.14.0 >=14.0.0 <14.20.0 >=15.0.0 <=15.14.0 >=16.0.0 <16.16.0 >=17.0.0 <=17.9.1 >=18.0.0 <18.5.0

Oct 2, 2026

High

CVE-2022-1473

Uncontrolled Resource Consumption

>=17.0.0 <17.9.1 >=18.0.0 <18.2.0

Oct 1, 2026

Medium

CVE-2022-1434

Cryptographic Weakness

>=17.0.0 <17.9.1 >=18.0.0 <18.2.0

Oct 1, 2026

High

CVE-2022-1292

Command Injection

>=4.0.0 <=4.9.1 >=5.0.0 <=5.12.0 >=6.0.0 <=6.17.1 >=7.0.0 <=7.10.1 >=8.0.0 <=8.17.0 >=9.0.0 <=9.11.2 >=10.16.0 <=10.24.1 >=11.9.0 <=11.15.0 >=12.0.0 <=12.22.12 >=13.0.0 <=13.14.0 >=14.0.0 <14.19.3 >=15.0.0 <=15.14.0 >=16.0.0 <16.15.1 >=17.0.0 <17.9.1 >=18.0.0 <18.2.0

Oct 1, 2026

High

CVE-2022-0778

Denial of Service

>=4.0.0 <=4.9.1 >=5.0.0 <=5.12.0 >=6.0.0 <=6.17.1 >=7.0.0 <=7.10.1 >=8.0.0 <=8.17.0 >=9.0.0 <=9.11.2 >=10.0.0 <=10.24.1 >=11.0.0 <=11.15.0 >=12.0.0 <12.22.11 >=13.0.0 <=13.14.0 >=14.0.0 <14.19.1 >=15.0.0 <=15.14.0 >=16.0.0 <16.14.2 >=17.0.0 <17.7.2

Oct 1, 2026

High

CVE-2021-39135

Improper Link Resolution Before File Access ('Link Following')

>=12.0.0 <12.22.6 >=14.0.0 <14.17.6 >=15.0.0 <=15.14.0 >=16.0.0 <16.8.0

Oct 1, 2026

High

CVE-2021-39134

Improper Link Resolution Before File Access ('Link Following')

>=12.0.0 <12.22.6 >=14.0.0 <14.17.6 >=15.0.0 <=15.14.0 >=16.0.0 <16.8.0

Oct 1, 2026

Medium

CVE-2021-4160

Cryptographic Weakness

>=10.16.0 <=10.24.1 >=11.9.0 <=11.15.0 >=12.0.0 <12.22.8 >=13.0.0 <=13.14.0 >=14.0.0 <14.19.0 >=15.0.0 <=15.14.0 >=16.0.0 <16.14.0 >=17.0.0 <17.3.0

Oct 1, 2026

Medium

CVE-2026-58040

Improper Certificate Validation

<=26.5.0; <=24.18.0; <=22.23.1 (active lines); and the End-of-Life Node.js 12.x, 14.x, 16.x, 18.x, and 20.x lines (all versions, addressed via Node.js NES)

Sep 12, 2026

Medium

CVE-2026-48937

Uncontrolled Resource Consumption

<=22.22.3; <=24.16.0

Sep 11, 2026

Medium

CVE-2026-48928

Incorrect Authorization

Node.js 22.x <=22.22.3; 24.x <=24.16.0; 26.x <=26.3.0

Sep 11, 2026

Medium

CVE-2026-48619

Denial of Service

<=22.22.3; <=24.16.0; <=26.3.0

Sep 11, 2026

Low

CVE-2026-48617

Incorrect Authorization

<=22.22.3; <=24.16.0; <=26.3.0 (per upstream advisory/NVD/CNA scope; the Permission Model was introduced in Node.js 20 and remains present in the also-affected, now-EOL Node.js 20.x line, which upstream advisory does not separately name since Node.js no longer supports that line)

Sep 11, 2026

Medium

CVE-2026-48618

No items found.

<=22.22.3; <=24.16.0; <=26.3.0 (per upstream advisory/NVD/CNA scope; HeroDevs NES additionally covers the Node.js 12, 14, 16, 18, and 20 End-of-Life lines as deliberate EOL security coverage)

Sep 11, 2026

Low

CVE-2026-48935

Incorrectly Configured Access Control

>=22.0.0 <22.23.0; >=24.0.0 <24.17.0; >=26.0.0 <26.3.1

Sep 11, 2026

High

CVE-2025-59466

Denial of Service

>=8.0.0 <19.0.0; >=20.0.0 <20.20.0; >=22.0.0 <22.22.0; >=24.0.0 <24.13.0; >=25.0.0 <25.3.0

Sep 11, 2026

Low

CVE-2023-45143

Information Exposure

>=16.15.0 <16.20.3; >=18.0.0 <18.18.2; >=19.0.0 <20.8.1

Sep 11, 2026

High

CVE-2025-55131

Information Exposure

20.x ≤ 20.19.6; 22.x ≤ 22.21.1; 24.x ≤ 24.12.0; 25.x ≤ 25.2.1; 4.x–18.x (EOL, all versions)

Sep 11, 2026

High

CVE-2026-21637

Denial of Service

Per the Node.js security blog (March 24, 2026 release, SNICallback gap): >=20.0.0 <20.20.2; >=22.0.0 <22.22.2; >=24.0.0 <24.14.1; >=25.0.0 <25.8.2. Per NVD's own record (published January 20, 2026, pskCallback/ALPNCallback only): >=4.0.0 <20.20.0; >=22.0.0 <22.22.0; >=24.0.0 <24.13.0; >=25.0.0 <25.3.0.

Sep 11, 2026

High

CVE-2023-32067

Denial of Service

>=12.0.0 <=12.22.12; >=14.0.0 <=14.21.3; >=16.0.0 <16.20.1; >=18.0.0 <18.16.1; >=20.0.0 <20.3.1

Sep 11, 2026

Medium

CVE-2023-31147

Cryptographic Weakness

>=12.0.0 <=12.22.12; >=14.0.0 <=14.21.3; >=16.0.0 <16.20.1; >=18.0.0 <18.16.1; >=20.0.0 <20.3.1

Sep 11, 2026

Medium

CVE-2023-31130

Buffer Over-read

>=12.0.0 <=12.22.12; >=14.0.0 <=14.21.3; >=16.0.0 <16.20.1; >=18.0.0 <18.16.1; >=20.0.0 <20.3.1

Sep 11, 2026

Low

CVE-2023-31124

Cryptographic Weakness

>=12.0.0 <=12.22.12; >=14.0.0 <=14.21.3; >=16.0.0 <16.20.1; >=18.0.0 <18.16.1; >=20.0.0 <20.3.1

Sep 11, 2026

High

CVE-2023-4807

Cryptographic Weakness

>=12.0.0 <=12.22.12; >=14.0.0 <=14.21.3; >=16.0.0 <=16.20.2; >=17.0.0 <=17.9.1; >=18.0.0 <18.19.0; >=19.0.0 <=19.9.0; >=20.0.0 <20.10.0

Sep 11, 2026

Medium

CVE-2023-0466

Improper Certificate Validation

>=12.0.0 <=12.22.12; >=14.0.0 <=14.21.3; >=16.0.0 <16.20.1; >=17.0.0 <=17.9.1; >=18.0.0 <18.16.1; >=19.0.0 <=19.9.0; >=20.0.0 <20.3.1

Sep 11, 2026

High

CVE-2022-3786

Stack-based Buffer Overflow

>=18.0.0 <18.12.1; >=19.0.0 <19.0.1

Sep 11, 2026

High

CVE-2022-3602

Stack-based Buffer Overflow

>=18.0.0 <18.12.1; >=19.0.0 <19.0.1

Sep 11, 2026

High

CVE-2022-3358

Cryptographic Weakness

>=17.0.0 <=17.9.1; >=18.0.0 <18.12.1; >=19.0.0 <19.0.1

Sep 11, 2026

High

CVE-2022-3996

Denial of Service

17.x (<=17.9.1); 18.x (<18.14.1); 19.x (<19.6.1)

Sep 11, 2026

Medium

CVE-2023-0465

Improper Certificate Validation

>=12.0.0 <=12.22.12; >=14.0.0 <=14.21.3; >=16.0.0 <16.20.1; >=17.0.0 <=17.9.1; >=18.0.0 <18.16.1; >=19.0.0 <=19.9.0; >=20.0.0 <20.3.1

Sep 11, 2026

Medium

CVE-2022-1343

Improper Certificate Validation

17.x (<=17.9.0); 18.x (<=18.1.0); Node.js NES 16.x (<16.20.3)

Sep 11, 2026

High

CVE-2021-4044

Denial of Service

>=17.0.0 <17.3.0

Sep 11, 2026

Low

CVE-2026-48931

Concurrent Execution using Shared Resource with Improper Synchronization

Node.js 22.x through v22.22.3; v24.x through v24.16.0; v26.x through v26.3.0

Aug 26, 2026

Low

CVE-2026-58039

Incorrect Authorization

22.x ≤ 22.23.1; 24.x ≤ 24.18.0; 26.x ≤ 26.5.0; 20.x (EOL, all versions)

Aug 26, 2026

Low

CVE-2026-58044

HTTP Request Smuggling

<=26.5.0; <=24.18.0; <=22.23.1; all End-of-Life release lines, including 12.x, 14.x, 16.x, 18.x, and 20.x

Aug 26, 2026

Medium

CVE-2026-58045

Denial of Service

<=22.23.1; >=24.0.0 <=24.18.0; >=26.0.0 <=26.5.0; all End-of-Life release lines, including 12.x, 14.x, 16.x, 18.x, and 20.x

Aug 26, 2026

High

CVE-2026-56846

Denial of Service

<=24.18.0; <=22.23.1; all End-of-Life release lines, including 12.x, 14.x, 16.x, 18.x, and 20.x

Aug 26, 2026

Medium

CVE-2026-58042

Denial of Service

<=26.5.0; <=24.18.0; <=22.23.1; all End-of-Life release lines, including 12.x, 14.x, 16.x, 18.x, and 20.x

Aug 26, 2026

Low

CVE-2026-56847

Authorization Bypass

22.x ≤ 22.23.1; 24.x ≤ 24.18.0; 26.x ≤ 26.5.0; 20.x (EOL, all)

Aug 26, 2026

Medium

CVE-2026-56850

Weak Authentication

<=26.5.0; <=24.18.0; <=22.23.1; all End-of-Life release lines, including 12.x, 14.x, 16.x, 18.x, and 20.x

Aug 26, 2026

High

CVE-2026-58043

Incorrect Authorization

22.x <= 22.23.1; 24.x <= 24.18.0; 26.x <= 26.5.0; 20.x (End-of-Life, all versions)

Aug 13, 2026

High

CVE-2026-56848

Use After Free

22.x <= 22.23.1; 24.x <= 24.18.0; 26.x <= 26.5.0; All End-of-Life release lines, including 16.x, 18.x, and 20.x

Aug 13, 2026

Medium

CVE-2026-55602

Improper Input Validation (4.16)

>=0.16.0 <2.0.10 >=3.0.0 <3.0.6 >=4.0.0 <4.1.0

Jul 14, 2026

Medium

CVE-2026-21717

Denial of Service

<20.20.2 >=22.0.0 <22.22.2 >=24.0.0 <24.14.1 >=25.0.0 <25.8.2

Apr 13, 2026

High

CVE-2025-59465

Uncontrolled Resource Consumption

v4 < v20.20.0, v22 < v22.22.0, v24 < v24.13.0, v25 < v25.3.0

Jan 13, 2026

High

CVE-2025-27210

Path Traversal

4.0 < 20.19.4, 22 < 22.17.1, 24 < 24.4.1

Jul 15, 2025

Medium

CVE-2025-23167

HTTP Request Smuggling

4.0 < 20.19.1

May 14, 2025

High

CVE-2025-23166

Cryptographic Weakness

4.0 < 20.19.1, 22 < 22.15.0, 24 < 24.0.1

May 14, 2025

Medium

CVE-2025-23085

Denial of Service

4.0 < 18.20.6, 20 < 20.18.2

Feb 7, 2025

Medium

CVE-2025-23084

Path Traversal

4.0 < 18.20.6, 20 < 20.18.2

Jan 28, 2025

High

CVE-2024-27980

Command Injection

4.0 <= 18.20.2, 20 < 20.12.2

Jan 9, 2025

High

HD-2024-1407

HTTP Request Smuggling

>=16.0.0 <16.20.1, >=18.0.0 <18.16.1, >=20.0.0 <20.3.1

Oct 16, 2024

Low

HD-2024-1408

Information Exposure

>=16.0.0 <=16.20.2

Oct 15, 2024

Medium

HD-2024-1409

Denial of Service

>=14.0.0 <=14.21.3, >=16.0.0 <=16.20.2

Oct 15, 2024

Medium

CVE-2023-46809

Cryptographic Weakness

4.0 < 18.19.1, 20 < 20.11.1

Sep 7, 2024

High

CVE-2024-36138

Command Injection

4.0 < 18.20.4, 20.0 < 20.15.1, 22.0< 22.4.1

Sep 7, 2024

Medium

CVE-2024-27982

HTTP Request Smuggling

<21.7.2, <20.12.1, <v18.20.1, <= 16.20.2, <=v14.21.3, <= v12.22.12

May 1, 2024

High

CVE-2024-27983

Uncontrolled Resource Consumption

4 <= 18.20.0, 20 <= 20.12.0

Apr 9, 2024

High

CVE-2024-21892

Privilege Escalation

4.0 < 18.19.1, 20 < 20.11.1

Feb 20, 2024

Medium

CVE-2024-22025

Denial of Service

<21.6.2, <20.11.1, <v18.19.1, <= 16.20.2

Feb 14, 2024

High

CVE-2024-22019

Denial of Service

<21.6.2, <20.11.1, <v18.19.1, <= 16.20.2, <=v14.21.3, <= v12.22.12

Feb 14, 2024

Medium

CVE-2023-30590

Cryptographic Weakness

4.0 < 16.20.1, 18 < 18.16.1, 20 < 20.3.1

Nov 28, 2023

Medium

CVE-2023-38552

Insufficient Verification of Data Authenticity

4.0 <= 18.18.1, 20 < 20.8.1

Oct 18, 2023

Medium

CVE-2023-32559

Privilege Escalation

4 <= 16.20.1, 0 <= 18.17.0, 0 <= 20.5.0

Aug 24, 2023

Severity

Built by the people who built Angular

We Partner With Core Contributors

NES for Angular is built and maintained by core team members of Angular to ensure the same excellent quality of support you expect. If your stack extends beyond Angular, HeroDevs also supports adjacent technologies including jQuery, Vue, Node.js, Express, and Bootstrap.

We Give Back to Open Source

Open source maintainers do critical work, but rarely get paid for it.

HeroDevs is putting $20 million toward changing that — funding the creators and projects that keep the ecosystem running, with grants from $2,500 to $250,000.

We’ve written patches for unmaintained codebases, tracked down vulnerabilities where no one else was looking, and kept critical systems running safely without rushed rewrites. This fund builds on that work, so maintainers can keep doing what they do best.

Learn More →

NES for Angular Use Cases

Eliminating the security gap after community EOL

Problem

The Angular team provides a support window. Once a version reaches EOL, new security vulnerabilities are no longer fixed on that version.

How We Solve It

HeroDevs takes over from the community, finding and back-porting CVE fixes to EOL Angular versions.

Frontend supply chain security

Problem

A vulnerability in the Angular framework can compromise every application built on it. Scanners flag EOL versions and unpatched CVEs as "High Risk", creating dashboard warnings that alarm stakeholders.

How We Solve It

NES for Angular is a drop-in replacement with no application code changes. Since Angular is a dependency for many applications, NES with CVE fixes reduces overall risk in the frontend software supply chain, and Essentials extends coverage to more dependent packages.

Avoiding emergency rushed migrations

Problem

The total cost of ownership of an emergency Angular migration is multiples higher than a planned one due to overtime, rushed testing, and potential production outages.

How We Solve It

The cost of a NES for Angular subscription is a fraction of one emergency engineering sprint. It turns a potential catastrophe into a predictable operating expense, freeing budget for new features rather than technical debt.

Resources

View All Articles

Security

October 23, 2026

7 New Angular CVEs: No Fix for Angular 19 and Earlier

Seven Angular CVEs, including a one-request SSR denial of service, leave every end-of-life Angular line exposed. See fix versions and who is affected.

Security

October 15, 2026

CVE-2026-101895: Angular SSR DOCTYPE DoS, No Fix for Angular 5 to 19

How a truncated DOCTYPE declaration traps the SSR HTML parser in an infinite synchronous loop and freezes the Node.js process.

Security

October 15, 2026

CVE-2026-69149, CVE-2026-68945 and CVE-2026-69151: Angular SSR XSS, Transfer Cache Poisoning, and i18n XSS

How unescaped SSR serialization, ambiguous transfer-cache keys, and translatable event-handler attributes let attackers inject script and poison server-rendered responses across three related Angular vulnerabilities