Frontend framework
Angular: supported versions and open vulnerabilities today
Angular 22, 21 and 20 are supported (20 until Nov 28, 2026); 19 reached end of life on May 19, 2026; the latest release is 22.2.3. 5 high or critical advisories for Angular were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against endoflife.date, npm, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 22.2.3
- npm downloads last week
- 6.2M
- GitHub stars
- 101k
- Licence
- MIT
- OpenSSF Scorecard
- 8.3 / 10
Supported versions
Security advisories
8 advisories published in the last 12 months, 5 of them high or critical. 9 in total since records began. Checked packages: @angular/core.
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Fixed in 20.3.27, 21.2.19 and 22.0.1.
EPSS: top 76%Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
Fixed in 20.3.25, 21.2.17 and 22.0.1.
EPSS: top 78%Angular vulnerable to XSS in i18n attribute bindings
Fixed in 19.2.20, 20.3.18 and 21.2.4.
EPSS: top 59%Angular i18n vulnerable to Cross-Site Scripting
Fixed in 19.2.19, 20.3.17, 21.1.6 and 21.2.0.
EPSS: top 62%Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
Fixed in 19.2.18, 20.3.16 and 21.0.7.
EPSS: top 64%
Maintenance and supply chain
OpenSSF Scorecard 8.3 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 12 issue updates found in the last 90 days.
Weakest checks
- No static analysis (SAST 0/10)
- No OpenSSF best-practices badge (CII-Best-Practices 2/10)
- No branch protection (Branch-Protection 3/10)
Docs and release notes
Check Angular in your own stack
This page checks Angular in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.