Angular vulnerabilities

Angular before 20.3.30, 21.2.22, and 22.1.4 has a server-side rendering (SSR) vulnerability in @angular/platform-server. The resolveUrl and parseUrl utilities call String.prototype.trim(), which removes leading Unicode whitespace after a same-origin check, converting a relative path into an attacker-controlled protocol-relative URL, leading to SSRF and credential disclosure.

Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected.

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.

Angular before 20.3.30, 21.2.22, and 22.1.4 has a server-side rendering (SSR) vulnerability in @angular/platform-server. Serialization of untrusted input inside fallback raw-content elements (noscript, iframe, noembed, noframes) fails to escape matching closing tags, enabling arbitrary JavaScript execution.

In Angular prior to 20.3.28, 21.2.20, and 22.1.1, @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user's sensitive response data.

Angular before 20.3.30, 21.2.22, and 22.1.4 has a server-side rendering (SSR) vulnerability in @angular/platform-server. Serialization of ProcessingInstruction DOM nodes inside fallback raw-content elements fails to escape matching ancestor closing tags, allowing premature container termination and arbitrary JavaScript execution.

In Angular prior to 20.3.28, 21.2.20, and 22.1.0, the compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context.

Angular prior to versions 20.3.27, 21.2.19, and 22.0.1 contains a vulnerability in the Angular compiler i18n pipeline that permits i18n-onerror and other i18n-on event-handler attributes. This allows a lower-trust translation file to replace a static handler with executable JavaScript.

Angular prior to versions 20.3.27, 21.2.19, and 22.0.7 contains a Cross-Site Scripting (XSS) vulnerability in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>).

Angular prior to versions 20.3.27, 21.2.19, and 22.0.2 contains a vulnerability in HttpTransferCache that comma-joins repeated request parameters. This allows semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response.

A Cross-Site Scripting (XSS) vulnerability exists in Angular's @angular/platform-server component when serializing <noscript> elements during SSR. The domino library fails to escape </noscript> in dynamic content, allowing injection of malicious scripts.

A Cross-Site Scripting (XSS) vulnerability exists in Angular's @angular/platform-server DOM emulation dependency (domino) when serializing raw-text elements like <script>, <style>, and <iframe>. A Unicode index alignment bug causes dynamic text with astral characters (e.g., emojis) before a closing tag to be improperly escaped, allowing JavaScript injection. The flaw is fixed in versions 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.

A DOM Clobbering vulnerability in Angular allows an attacker to replace the SSR state container (ng-state) by injecting an HTML element with the same ID. During client hydration, Angular reads data from the fake element, potentially leading to code execution or data theft.

A vulnerability in Angular prior to versions 22.0.1, 21.2.17, and 20.3.25 allows an attacker to overwrite HTTP responses in the TransferState cache during Server-Side Rendering (SSR). The weak 32-bit DJB2 hash used for cache key generation enables hash collisions, causing sensitive endpoint responses to be replaced with responses from other requests.

A vulnerability in Angular's @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization via namespace workarounds. An attacker can inject a malicious template with custom namespaces, leading to client-side Cross-Site Scripting (XSS).

An XSS vulnerability in the Angular i18n pipeline allows arbitrary JavaScript execution if an attacker compromises the translation file. Affects versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 due to unsanitized HTML in ICU messages.

This vulnerability affects angular package versions from 1.3.0 and angularjs package versions from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to catastrophic backtracking, leading to super-linear runtime. With large crafted input, this can cause a denial of service (DoS). The package is End-of-Life (EOL) and will not receive fixes.