Is @angular/common 14.2 vulnerable?
npm · 13 releases from 14.2.0 to 14.2.12 · latest @angular/common is 22.2.4 · checked 2 Nov 2026
Yes: 8 known advisories
Yes. @angular/common 14.2.12, the last 14.2 release, is affected by 8 known security advisories (6 high, 2 medium), including CVE-2026-68945, CVE-2026-54268, CVE-2026-54266. Upgrade to 20.3.34 or later to fix all of them.
npm install @angular/common@20.3.34Advisories affecting @angular/common 14.2.12
@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
- Affected
- >=21.0.0 <21.0.3 · >=20.0.0 <20.3.34 · <=19.2.25
- Fixed in
- 20.3.34, 21.0.3
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
- Affected
- >=22.0.0 <22.1.1 · >=21.0.0 <21.2.20 · >=20.0.0 <20.3.28 · <=19.2.25
- Fixed in
- 20.3.28, 21.2.20, 22.1.1
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
- Affected
- >=22.0.0-next.0 <22.0.2 · >=21.0.0-next.0 <21.2.19 · >=20.0.0-next.0 <20.3.27 · <=19.2.25
- Fixed in
- 20.3.27, 21.2.19, 22.0.2
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
- Affected
- >=22.0.0-next.0 <22.0.1 · >=21.0.0-next.0 <21.2.17 · >=20.0.0-next.0 <20.3.25 · <=19.2.25
- Fixed in
- 20.3.25, 21.2.17, 22.0.1
@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
- Affected
- >=22.0.0-next.0 <22.0.1 · >=21.0.0-next.0 <21.2.17 · >=20.0.0-next.0 <20.3.25 · <=19.2.25
- Fixed in
- 20.3.25, 21.2.17, 22.0.1
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
- Affected
- >=22.0.0-next.0 <22.0.0-rc.2 · >=20.0.0-next.0 <20.3.22 · >=19.0.0-next.0 <19.2.23 · <=18.2.14 · >=21.0.0-next.0 <21.2.15
- Fixed in
- 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
- Affected
- >=22.0.0-next.0 <22.0.0-rc.2 · >=20.0.0-next.0 <20.3.22 · >=19.0.0-next.0 <19.2.23 · <=18.2.14 · >=21.0.0-next.0 <21.2.15
- Fixed in
- 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2
Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client
- Affected
- >=21.0.0-next.0 <21.0.1 · >=20.0.0-next.0 <20.3.14 · <19.2.16
- Fixed in
- 19.2.16, 20.3.14, 21.0.1
Which of your client projects are still on @angular/common 14.2?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact @angular/common version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other @angular/common versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.