HeroDevs
Visit Angular NES Home Page

Angular 19

Comprehensive release notes and changelog for Angular 19, including security patches, bug fixes, and feature updates across all supported versions.

30 Patched Vulnerabilities
VEX Statements

Angular

v19.2.30 - September 16, 2026

Notes

Security Fixes

  • common:
    • Run root interceptors in the terminal request chain.
      • This fixes a medium-severity Information Exposure vulnerability (CVE-2026-88059).
  • platform-server:
    • Avoid stripping Unicode whitespace during URL resolution.
      • This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-88056).
    • Escape fallback raw-content ancestor tags in comments and nested raw-text elements when serializing server-rendered output.
    • Escape fallback raw-content ancestor tags across SVG and MathML foreign content when serializing server-rendered output.
    • Escape processing instruction nodes in fallback raw-content elements when serializing server-rendered output.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-88058).
    • Escape <template> content across DocumentFragment boundaries in fallback raw-content elements when serializing server-rendered output.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-88060).
    • Escape comment content that abruptly closes the comment when serializing server-rendered output.
    • Avoid an infinite loop when parsing a malformed DOCTYPE during server-side rendering.

v19.2.29 - August 20, 2026

Notes

Security Fixes

  • common:
    • Use cryptographically secure SHA-256 for transfer cache key generation.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-54266).
    • Distinguish repeated transfer cache parameters.
      • This fixes a high-severity Cache Poisoning vulnerability (CVE-2026-68945).
  • compiler:
    • Apply schema-derived sanitizer resolution to two-way property bindings.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-54265).
    • Disallow i18n event attributes.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69151).
    • Restrict possible event handler check to property names longer than 2 characters.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69151).
  • platform-server:
    • Escape text in fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>) when serializing server-rendered output.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69149).

v19.2.28 - August 7, 2026

Notes

Security Fixes

  • common:
    • Limit date format string length to 256 characters.
      • This fixes a high-severity Denial of Service (DoS) vulnerability (CVE-2026-54268).
  • core:
    • Harden TransferState restoration against DOM clobbering.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-54267).

v19.2.27 - July 8, 2026

Notes

Security Fixes

  • service-worker:
    • Strip sensitive headers on cross-origin redirects.
      • This fixes a high-severity Information Exposure vulnerability (CVE-2026-54264).

v19.2.26 - June 15, 2026

Notes

Security Fixes

  • common:
    • Skip the HTTP TransferCache for cookie-bearing requests by default, and exclude withCredentials requests from the transfer cache.
      • This fixes a high-severity Information Exposure vulnerability (CVE-2026-50170).
    • Add upper bounds for digitsInfo to prevent roundNumber from allocating a large array.
      • This fixes a high-severity Denial of Service (DoS) vulnerability (CVE-2026-50171).
  • compiler:
    • Strip namespaced SVG script elements during template compilation.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
  • core:
    • Reject script element as a dynamic component host.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-52725).
    • Strip namespaced SVG script elements during template compilation.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
  • platform-server:
    • Update the domino dependency to fix closing-tag escaping bugs in its server-side rendering serializer.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50555).
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50556).
    • Reject untrusted request URLs that bypass the allowedHosts allowlist.
      • This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-50168).
  • service-worker:
    • Preserve redirect policy on reconstructed asset requests.
      • This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50169).
    • Preserve explicit credentials: 'omit' and HTTP cache mode in asset group requests.
      • This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50184).

v19.2.23 - June 3, 2026

Notes

Security Fixes

  • platform-server:
    • Add allowedHosts option to renderModule and renderApplication.
      • This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-46417).

v19.2.22 - April 21, 2026

Notes

Security Fixes

  • platform-server:
    • Prevent SSRF bypasses via protocol-relative and backslash URLs.
      • This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-41423).

v19.2.21 - March 27, 2026

Notes

Security Fixes

  • core:
    • Sanitize translated form attributes and attribute bindings with interpolations.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-32635).
  • compiler:
    • Disallow translations of src attributes in iframes.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-32635).

v19.2.20 - March 13, 2026

Notes

Security Fixes

  • core:
    • Block creation of sensitive URI attributes from ICU messages.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-27970).

Breaking Changes

core
  • Block creation of sensitive URI attributes from ICU messages:
    Translators can no longer introduce URI attributes—attribute values are blocked to avoid malicious links, and sanitization now relies on an allowlist of known attributes (still sanitizing URI ones). Translated ICU content keeps only recognized attributes and drops everything else.

v19.2.19 - January 27, 2026

Notes

Angular CLI

v19.2.29 - June 24, 2026

Notes

v19.2.28 - June 16, 2026

Notes

Compatibility Fixes

  • ssr:
    • Add support for configuring trusted proxy headers via environment variable to align with upstream Angular v19.2.26 proxy header handling changes.

v19.2.27 - June 3, 2026

Notes

Compatibility Fixes

  • ssr:
    • Allow all hosts in common engine rendering options to prevent validation errors caused by upstream Angular v19.2.23 host validation changes.

v19.2.26 - May 8, 2026

Notes

Security Fixes

  • ssr:
    • Introduce trustProxyHeaders option to safely validate and sanitize proxy headers.
      • This fixes a medium-severity Open Redirect vulnerability (CVE-2026-44437).

v19.2.25 - April 22, 2026

Notes

Security Fixes

  • picomatch:
    • Every instance of picomatch was updated to v4.0.4 to address CVE-2026-33671.

v19.2.23 - March 27, 2026

Notes

Security Fixes

  • ssr:
    • Prevent open redirect via X-Forwarded-Prefix header.
      • This fixes a medium-severity Open Redirect vulnerability (CVE-2026-27738).
  • ssr:
    • Validate host headers to prevent header-based SSRF.
      • This fixes a critical-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-27739).

v19.2.20 - January 29, 2026

Notes