Is @angular/core 22.0 vulnerable?
npm · 9 releases from 22.0.0 to 22.0.8 · latest @angular/core is 22.2.4 · checked 1 Nov 2026
Yes: 1 known advisory
Yes. @angular/core 22.0.8, the last 22.0 release, is affected by 1 known security advisory (1 medium), including CVE-2026-88057. 2 more affect earlier 22.0.x releases. Upgrade to 22.1.0 or later to fix all of them.
npm install @angular/core@22.1.0Advisories affecting @angular/core 22.0.8
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
- Affected
- >=22.0.0 <22.1.0 · >=21.0.0 <21.2.20 · >=20.0.0 <20.3.28 · <=19.2.25
- Fixed in
- 20.3.28, 21.2.20, 22.1.0
Fixed within 22.0.x, affecting earlier releases
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
- Affected
- >=22.0.0-next.0 <22.0.1 · >=21.0.0-next.0 <21.2.19 · >=20.0.0-next.0 <20.3.27 · <=19.2.25
- Fixed in
- 20.3.27, 21.2.19, 22.0.1
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
- Affected
- >=22.0.0-next.0 <22.0.1 · >=21.0.0-next.0 <21.2.17 · >=20.0.0-next.0 <20.3.25 · <=19.2.25
- Fixed in
- 20.3.25, 21.2.17, 22.0.1
Which of your client projects are still on @angular/core 22.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact @angular/core version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other @angular/core versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.