Uh oh!
There was an error while loading. Please reload this page.
Update dependency @angular/common to v19.2.23 [SECURITY] - #764
Open
renovate[bot] wants to merge 1 commit into
Open
Update dependency @angular/common to v19.2.23 [SECURITY]#764renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovateBotforce-pushed
the
renovate/npm-angular-common-vulnerability
branch
2 times, most recently
from
March 30, 2026 17:56
71e96db to
bfbe2d4ComparerenovateBotforce-pushed
the
renovate/npm-angular-common-vulnerability
branch
from
April 27, 2026 22:27
bfbe2d4 to
b983f41ComparerenovateBotforce-pushed
the
renovate/npm-angular-common-vulnerability
branch
from
June 15, 2026 22:15
b983f41 to
6940e14Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
19.1.7→19.2.23Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client
CVE-2025-66035 / GHSA-58c5-g7wp-6w37
More information
Details
The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain.
Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (
http://orhttps://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to theX-XSRF-TOKENheader.Impact
The token leakage completely bypasses Angular's built-in CSRF protection, allowing an attacker to capture the user's valid XSRF token. Once the token is obtained, the attacker can perform arbitrary Cross-Site Request Forgery (CSRF) attacks against the victim user's session.
Attack Preconditions
POST) to a protocol-relative URL (e.g.,//attacker.com) that they control.Patches
Workarounds
Developers should avoid using protocol-relative URLs (URLs starting with
//) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single/) or fully qualified, trusted absolute URLs.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
CVE-2026-50170 / GHSA-q6f4-qqrg-jv6x
More information
Details
A vulnerability was discovered in
@angular/commonwhen Server-Side Rendering (SSR) and hydration are enabled. TheHttpTransferCacheutility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application viaTransferState.However, the caching mechanism fails to inspect the
withCredentialsflag or theCookieheader of outgoing requests. As a result, credentialed, user-specific responses may be cached by default in the sharedTransferStatepayload. When these responses are serialized into the HTML, any caching layer (such as a CDN, reverse proxy, or shared server cache) that caches the SSR-rendered HTML page could inadvertently cache and leak one user's private data to other users, leading to a high-severity information disclosure vulnerability.Impact
Successful exploitation allows an unauthenticated attacker to obtain sensitive, user-specific information of other authenticated users. This occurs when:
Attack Preconditions
provideClientHydration()).withCredentials: true) during the initial server-side render.Patches
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
CVE-2026-50171 / GHSA-p3vc-36g9-x9gr
More information
Details
A Denial of Service (DoS) vulnerability exists in the
@angular/commonpackage of Angular. TheformatNumberfunction, which is also utilized byDecimalPipe,PercentPipe, andCurrencyPipe, does not properly validate the upper bounds of thedigitsInfoparameter. Specifically, the minimum and maximum fraction digits parsed from thedigitsInfostring (e.g.,1.2-4) are converted to integers and used without limits.When parsing a maliciously crafted
digitsInfostring with excessively large fraction digit values (e.g.,1.200000000-200000000), the internalroundNumberfunction attempts to pad the digits array to match the requested fraction size. This results in an unbounded loop that repeatedly pushes elements into an array.Impact
Successful exploitation of this vulnerability allows an attacker to trigger resource exhaustion, leading to a Denial of Service (DoS):
@angular/ssr), an attacker can crash the Node.js server process due to aJavaScript heap out of memoryerror. This affects the availability of the application for all users.Attack Preconditions
For this vulnerability to be exploitable, the following conditions must be met:
formatNumberfunction directly, or via template pipes (DecimalPipe,PercentPipe,CurrencyPipe).digitsInfoparameter passed to these utilities must be customizable or directly controlled by untrusted user input (e.g., parsed from query parameters, user preference settings, or API responses that accept user-defined formatting options). IfdigitsInfois trusted or limited to a known, defined range for its value, the vulnerability is not exploitable by external attackers.Patches
Credits
This vulnerability was discovered and reported by CodeMender from Google DeepMind.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
angular/angular (@angular/common)
v19.2.23Compare Source
common
compiler
core
http
platform-server
service-worker
v19.2.22Compare Source
core
platform-server
allowedHostsoption torenderModuleandrenderApplicationv19.2.21Compare Source
platform-server
v19.2.20Compare Source
compiler
core
v19.2.19Compare Source
Breaking Changes
core
Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.
(cherry picked from commit
03da204)core
v19.2.18Compare Source
core
v19.2.17Compare Source
compiler
attributeNameand MathML/SVG URLsv19.2.16Compare Source
http
v19.2.15Compare Source
Breaking Changes
core
The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
Before:
After:
A schematic is provided to automatically update
main.server.tsfiles to pass theBootstrapContextto thebootstrapApplicationcall.In addition,
getPlatform()anddestroyPlatform()will now returnnulland be a no-op respectively when running in a server environment.core
BootstrapContextfor improved server bootstrapping (#63639)v19.2.14Compare Source
compiler
migrations
v19.2.13Compare Source
common
service-worker
v19.2.12Compare Source
common
compiler
compiler-cli
core
rxResourceabort listener (#58306)withEventReplay()is invoked (#61352)onDestroyintoSignal. (#61514)platform-server
v19.2.11Compare Source
v19.2.10Compare Source
common
updateLatestValueif view is destroyed before promise resolves (#61064)core
platform-server
v19.2.9Compare Source
core
v19.2.8Compare Source
forms
v19.2.7Compare Source
common
NgOptimizedImageexceeds the preload limit (#60883)core
http
httpResource(#60802)v19.2.6Compare Source
compiler
compiler-cli
core
language-service
v19.2.5Compare Source
animations
@angular/common(#60660)compiler
compiler-cli
rootDir(#60555)core
language-service
migrations
router
service-worker
v19.2.4Compare Source
core
localize
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.