Is @angular/common 21.1 vulnerable?
npm · 7 releases from 21.1.0 to 21.1.6 · latest @angular/common is 22.2.4 · checked 1 Nov 2026
Yes: 6 known advisories
Yes. @angular/common 21.1.6, the last 21.1 release, is affected by 6 known security advisories (5 high, 1 medium), including CVE-2026-68945, CVE-2026-54268, CVE-2026-54266. Upgrade to 21.2.20 or later to fix all of them.
npm install @angular/common@21.2.20Advisories affecting @angular/common 21.1.6
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
- Affected
- >=22.0.0 <22.1.1 · >=21.0.0 <21.2.20 · >=20.0.0 <20.3.28 · <=19.2.25
- Fixed in
- 20.3.28, 21.2.20, 22.1.1
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
- Affected
- >=22.0.0-next.0 <22.0.2 · >=21.0.0-next.0 <21.2.19 · >=20.0.0-next.0 <20.3.27 · <=19.2.25
- Fixed in
- 20.3.27, 21.2.19, 22.0.2
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
- Affected
- >=22.0.0-next.0 <22.0.1 · >=21.0.0-next.0 <21.2.17 · >=20.0.0-next.0 <20.3.25 · <=19.2.25
- Fixed in
- 20.3.25, 21.2.17, 22.0.1
@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
- Affected
- >=22.0.0-next.0 <22.0.1 · >=21.0.0-next.0 <21.2.17 · >=20.0.0-next.0 <20.3.25 · <=19.2.25
- Fixed in
- 20.3.25, 21.2.17, 22.0.1
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
- Affected
- >=22.0.0-next.0 <22.0.0-rc.2 · >=20.0.0-next.0 <20.3.22 · >=19.0.0-next.0 <19.2.23 · <=18.2.14 · >=21.0.0-next.0 <21.2.15
- Fixed in
- 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
- Affected
- >=22.0.0-next.0 <22.0.0-rc.2 · >=20.0.0-next.0 <20.3.22 · >=19.0.0-next.0 <19.2.23 · <=18.2.14 · >=21.0.0-next.0 <21.2.15
- Fixed in
- 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2
Which of your client projects are still on @angular/common 21.1?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact @angular/common version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other @angular/common versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.