HeroDevs
Visit Angular NES Home Page

Angular 12

Comprehensive release notes and changelog for Angular 12, including security patches, bug fixes, and feature updates across all supported versions.

22 Patched Vulnerabilities
VEX Statements

Angular

v12.3.11 - September 16, 2026

Notes

Security Fixes

  • platform-server:
    • Avoid stripping Unicode whitespace during URL resolution.
      • This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-88056).
    • Escape fallback raw-content ancestor tags in comments and nested raw-text elements when serializing server-rendered output.
    • Escape fallback raw-content ancestor tags across SVG and MathML foreign content when serializing server-rendered output.
    • Escape processing instruction nodes in fallback raw-content elements when serializing server-rendered output.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-88058).
    • Escape <template> content across DocumentFragment boundaries in fallback raw-content elements when serializing server-rendered output.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-88060).
    • Escape comment content that abruptly closes the comment when serializing server-rendered output.
    • Avoid an infinite loop when parsing a malformed DOCTYPE during server-side rendering.

v12.3.10 - September 14, 2026

Notes

Security Fixes

  • compiler:
    • Strip namespaced SVG script elements during template compilation.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
    • Sanitize dynamic href and xlink:href bindings on SVG elements.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
    • Normalize tag names with custom namespaces in DomElementSchemaRegistry.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
  • core:
    • Support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation.
    • Normalize tag names in runtime i18n attribute security context lookup.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
    • Synchronize core sanitization schema with compiler.
    • Reject script element as a dynamic component host.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-52725).
    • Validate lowercase SVG animation attribute names.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-52725).

v12.3.9 - August 20, 2026

Notes

Security Fixes

  • common:
    • Add upper bounds for digitsInfo to prevent roundNumber from allocating a large array.
      • This fixes a high-severity Denial of Service (DoS) vulnerability (CVE-2026-50171).
    • Limit date format string length to 256 characters.
      • This fixes a high-severity Denial of Service (DoS) vulnerability (CVE-2026-54268).
  • compiler:
    • Disallow i18n event attributes.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69151).
    • Restrict possible event handler check to property names longer than 2 characters.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69151).
    • Reject i18n translation of event-handler attributes on the View Engine path.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69151).
  • platofrm-browser:
    • Harden TransferState restoration against DOM clobbering.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-54267).
  • platform-server:
    • Escape matching closing tags correctly when raw-text content contains astral characters.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50555).
    • Escape <noscript> text content when serializing server-rendered output.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50556).
    • Escape text in fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>) when serializing server-rendered output.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69149).

v12.3.8 - July 23, 2026

Notes

Security Fixes

  • platform-server:
    • Reject untrusted request URLs that bypass the allowedHosts allowlist.
      • This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-50168).
  • service-worker:
    • Preserve redirect policy on reconstructed asset requests.
      • This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50169).
    • Preserve explicit credentials: 'omit' in asset requests.
      • This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50184).
    • Preserve HTTP cache mode in asset group requests.
      • This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50184).

v12.3.7 - June 18, 2026

Notes

Security Fixes

  • core:
    • Validate security-sensitive attributes in i18n bindings.
    • Disallow event attribute bindings in host bindings unconditionally.
  • platform-server:
    • Add allowedHosts option to renderModule and renderModuleFactory.
      • This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-46417).

Breaking Changes

platform-server
  • Add allowedHosts option to renderModule and renderModuleFactory:
    When url is an absolute URL, its hostname is now validated against the new allowedHosts option, mitigating Server-Side Request Forgery (SSRF) and Host Header Injection attacks. This validation applies to both rendering entry points (renderModule and renderModuleFactory). Because allowedHosts defaults to an empty allow-list, any absolute URL now throws at bootstrap unless allowedHosts is configured. Relative URLs (e.g. /path) are unaffected.
    To pass validation, configure allowedHosts with the hostnames you serve (exact hostnames, *.example.com wildcards, or * to allow all).

v12.3.6 - March 10, 2026

Notes

Security Fixes

  • core:
    • Block creation of sensitive URI attributes from ICU messages.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-27970).

Breaking Changes

core
  • Block creation of sensitive URI attributes from ICU messages:
    Translators can no longer introduce URI attributes—attribute values are blocked to avoid malicious links, and sanitization now relies on an allowlist of known attributes (still sanitizing URI ones). Translated ICU content keeps only recognized attributes and drops everything else.

v12.3.5 - February 24, 2026

Notes

Security Fixes

  • core:
    • Sanitize sensitive attributes on SVG script elements.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-22610).

v12.3.4 - December 18, 2025

Notes

Security Fixes

  • compiler:
    • Prevent stored XSS via SVG animation attributeName and MathML/SVG URLs.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2025-66412).

v12.3.3 - December 4, 2025

Notes

Security Fixes

  • common:
    • Prevent Cross-Site Request Forgery (XSRF) token leakage to protocol-relative URLs.
      • This fixes a high-severity Information Exposure vulnerability (CVE-2025-66035).

v12.3.2 - June 16, 2025

Notes

v12.3.1 - January 30, 2025

Notes

  • Full Version: 12.2.17-{PACKAGE_NAME}-12.3.1

Security Fixes

  • upgrade:
    • Address Trusted Types violations in @angular/upgrade.

v12.2.20 - January 30, 2025

Notes

  • This release contains no functional changes from NES v12.2.19.
  • This release contains only metadata fixes and improvements: Updated peer dependency versions.
  • Full Version: 12.2.17-{PACKAGE_NAME}-12.2.20

v12.2.19 - January 30, 2025

Notes

  • This release contains no functional changes from NES v12.2.18.
  • This release contains only metadata fixes and improvements: Updated peer dependency versions.
  • Full Version: 12.2.19-{PACKAGE_NAME}

v12.2.18 - February 8, 2024

Notes

  • Full Version: 12.2.18-{PACKAGE_NAME}

Security Fixes

  • compiler:
    • Do not unquote CSS values.
  • core:
    • Do not use Function constructors in development mode to avoid CSP violations.
    • Set style property value to empty string instead of an invalid value.

Angular CLI

12.2.22 (NES) - September 2025

Notes

Bug Fixes

  • Fixed build issues: updated peer dependency version numbers

12.2.21 (NES) - June 5, 2025

Notes

12.2.20 (NES) - February 28, 2025

Security

12.2.19 (NES) - February 26, 2025

Notes

  • This is the initial release of the NES Angular CLI 12.2.x series.