Skip to content

fix(sec): Upgrade Angular to 21.2.19 to resolve 5 CVEs - #65

Open
petr-pokorny-absa wants to merge 1 commit into
masterfrom
fix/upgrade-angular-security-cves
Open

fix(sec): Upgrade Angular to 21.2.19 to resolve 5 CVEs#65
petr-pokorny-absa wants to merge 1 commit into
masterfrom
fix/upgrade-angular-security-cves

Conversation

@petr-pokorny-absa

@petr-pokorny-absa petr-pokorny-absa commented Aug 11, 2026

Copy link
Copy Markdown
Collaborator

Summary

Upgrades all @angular/* packages (runtime and CLI/build tooling) from 21.2.7 to 21.2.19, which is above the fixed versions for the following security advisories:

  • CVE-2026-54267 — Angular Client Hydration DOM Clobbering & Response-Cache Poisoning (fixed in 22.0.1 / 21.2.17 / 20.3.25)
  • CVE-2026-54268 — @angular/common DoS via crafted date format string (fixed in 22.0.1 / 21.2.17 / 20.3.25)
  • CVE-2026-54266 — Weak 32-bit cache key hashing in HttpTransferCache (fixed in 22.0.1 / 21.2.17 / 20.3.25)
  • CVE-2026-50171 — @angular/common DoS via malformed digitsInfo parameter (fixed in 22.0.0-rc.2 / 21.2.15 / 20.3.22 / 19.2.23)
  • CVE-2026-50170 — Info leak via default caching of credentialed requests in HttpTransferCache (fixed in 22.0.0-rc.2 / 21.2.15 / 20.3.22 / 19.2.23)

Changes

  • Bumped @angular/animations, @angular/common, @angular/compiler, @angular/core, @angular/forms, @angular/platform-browser, @angular/platform-browser-dynamic, @angular/router, @angular/build, @angular/cli, and @angular/compiler-cli to ^21.2.19 in ui/package.json
  • Regenerated ui/package-lock.json

Validation

  • npm install — resolves cleanly
  • npm run build — production build succeeds
  • Unit tests (Jest) — verified passing

Closes

Closes #55
Closes #54
Closes #53
Closes #52
Closes #51
Closes #50
Closes #49
Closes #48
Closes #47
Closes #46

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment