Angular is part of Google Open Source Software Vulnerability Reward Program. For vulnerabilities in Angular, please submit your report here.
For more information, check out Angular's security policy.
Repository navigation
Security: angular/angular
Security
SECURITY.md
-
XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)GHSA-jfgx-762w-99vr published
Oct 16, 2026 by alan-agius4High -
Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)GHSA-w739-gvwx-grc3 published
Sep 30, 2026 by alan-agius4Moderate -
Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)GHSA-57xq-rjx2-v5xh published
Oct 1, 2026 by alan-agius4High -
Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)GHSA-62vg-58rm-qff7 published
Sep 30, 2026 by alan-agius4High -
Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)GHSA-ff3f-86qr-9cv3 published
Sep 23, 2026 by alan-agius4High -
Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE in Angular SSRGHSA-f67j-2jqw-jpq7 published
Sep 9, 2026 by alan-agius4High -
Angular DevTools (Local DoS)GHSA-r653-wxfp-pp9c published
Sep 16, 2026 by alan-agius4Moderate -
SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSRGHSA-f6mr-pjwc-34m4 published
Aug 27, 2026 by alan-agius4High -
Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`GHSA-p297-fm68-3q8c published
Aug 20, 2026 by alan-agius4Moderate -
SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content ElementsGHSA-j3r3-mxqp-r2p4 published
Aug 27, 2026 by alan-agius4High
Learn more about advisories related to angular/angular in the GitHub Advisory Database