Is @angular/common 22.0 vulnerable?
npm · 9 releases from 22.0.0 to 22.0.8 · latest @angular/common is 22.2.4 · checked 1 Nov 2026
Yes: 1 known advisory
Yes. @angular/common 22.0.8, the last 22.0 release, is affected by 1 known security advisory (1 medium), including CVE-2026-88059. 3 more affect earlier 22.0.x releases. Upgrade to 22.1.1 or later to fix all of them.
npm install @angular/common@22.1.1Advisories affecting @angular/common 22.0.8
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
- Affected
- >=22.0.0 <22.1.1 · >=21.0.0 <21.2.20 · >=20.0.0 <20.3.28 · <=19.2.25
- Fixed in
- 20.3.28, 21.2.20, 22.1.1
Fixed within 22.0.x, affecting earlier releases
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
- Affected
- >=22.0.0-next.0 <22.0.2 · >=21.0.0-next.0 <21.2.19 · >=20.0.0-next.0 <20.3.27 · <=19.2.25
- Fixed in
- 20.3.27, 21.2.19, 22.0.2
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
- Affected
- >=22.0.0-next.0 <22.0.1 · >=21.0.0-next.0 <21.2.17 · >=20.0.0-next.0 <20.3.25 · <=19.2.25
- Fixed in
- 20.3.25, 21.2.17, 22.0.1
@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
- Affected
- >=22.0.0-next.0 <22.0.1 · >=21.0.0-next.0 <21.2.17 · >=20.0.0-next.0 <20.3.25 · <=19.2.25
- Fixed in
- 20.3.25, 21.2.17, 22.0.1
Which of your client projects are still on @angular/common 22.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact @angular/common version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other @angular/common versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.