npm package
@angular/core vulnerabilities by version
The latest release, 22.2.3 (Oct 14, 2026), has no known vulnerabilities. 54% of last week’s 6.2M downloads went to versions with known vulnerabilities. OSV.dev lists 9 advisories for @angular/core; the newest was published on Sep 10, 2026.
npm (opens in a new tab) describes it as “Angular - the core framework”
- Latest release
- 22.2.3
- Oct 14, 2026, no known vulnerabilities
- Downloads last week
- 6.2M
- All versions, from npm
- Advisories on OSV.dev
- 9
- Newest Sep 10, 2026
- Licence
- MIT
Most-downloaded versions last week
From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.
Who is still on a vulnerable @angular/core
54% of last week’s 6.2M @angular/core downloads went to versions with known vulnerabilities.
From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover 98% of downloads.
Release lines
Support dates from endoflife.date (opens in a new tab). A line past its end date gets no more security fixes.
Newest advisories
The 5 most recently published, with the versions each one affects.
WarningCVE-2026-88057 on OSV.dev (opens in a new tab)GHSA-hh8m-fm6v-7cvg
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
Affects >= 22.0.0, < 22.1.0; >= 21.0.0, < 21.2.20; >= 20.0.0, < 20.3.28; <= 19.2.25. Published Sep 10, 2026.
CriticalCVE-2026-69151 on OSV.dev (opens in a new tab)GHSA-jj27-h5hq-8x99
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Affects >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25. Published Aug 3, 2026.
WarningCVE-2026-50557 on OSV.dev (opens in a new tab)GHSA-f3m7-gqxr-g87x
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
Affects >= 21.0.0-next.0, < 21.2.15; >= 22.0.0-next.0, < 22.0.0-rc.2; >= 20.0.0-next.0, < 20.3.22; >= 19.0.0-next.0, < 19.2.22; <= 18.2.14. Published Jun 15, 2026.
WarningCVE-2026-52725 on OSV.dev (opens in a new tab)GHSA-692r-grfm-v8x7
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
Affects >= 21.0.0-next.0, < 21.2.15; >= 22.0.0-next.0, < 22.0.0-rc.2; >= 19.0.0-next.0, < 19.2.23; <= 18.2.14; >= 20.0.0-next.0, < 20.3.22. Published Jun 15, 2026.
CriticalCVE-2026-54267 on OSV.dev (opens in a new tab)GHSA-rgjc-h3x7-9mwg
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
Affects >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.17; >= 20.0.0-next.0, < 20.3.25; <= 19.2.25. Published Jun 15, 2026.
All 9 advisories are on OSV.dev (opens in a new tab).
Which @angular/core do you have?
Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.
How this page is checked
StackPrism reads every OSV.dev advisory for @angular/core, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm, support dates from endoflife.date. No AI writes this page: every sentence comes from that data, refreshed every few hours.
Last checked against OSV.dev, CISA KEV, npm, deps.dev and endoflife.date.