CVE-2026-54267: Google Angular DOM Clobbering in Client Hydration

CVE-2026-54267 · Severity: high · CVSS 3.1 · Published 2026-06-22

Angular, a popular web development framework, contains a vulnerability in how it handles data during the 'hydration' process (the transition from a server-rendered page to an interactive app). An attacker can trick the application into using malicious data instead of legitimate server responses by manipulating page elements. This could allow an attacker to steal user information, escalate their privileges within the app, or perform unauthorized actions on behalf of a user.

Technologies: @angular/core (npm). Vendors: npm.

Quick answers

Is CVE-2026-54267 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54267 being exploited in the wild.
How severe is CVE-2026-54267?
High severity, with a CVSS score of 3.1, published 22 June 2026.
Which products and versions are affected?
@angular/core (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.1.
Is there a fix for CVE-2026-54267?
Yes. @angular/core (npm): upgrade to 22.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54267 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54267?
Check whether you run @angular/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/core (npm): upgrade to 22.0.1 or later
    npm install @angular/core@22.0.1

Technical details

A DOM Clobbering vulnerability exists in Angular's hydration logic when using provideClientHydration(). During client-side bootstrap, Angular retrieves its serialized state from the DOM using a predictable ID (defaulting to 'ng-state'). If an application renders untrusted user input or CMS content that allows setting element IDs (e.g., <a id='ng-state'>) before the legitimate state script tag, the browser's document.getElementById call returns the attacker-controlled element. This allows an attacker to inject a malicious JSON payload into the TransferState cache. By poisoning the HTTP Transfer Cache, an attacker can spoof API responses, leading to DOM-based XSS, privilege escalation, or UI hijacking. The fix involves hardening the restoration process to ensure only legitimate script elements are processed.

Affected products

  • Google Angular >= 22.0.0-next.0 < 22.0.1, >= 21.0.0-next.0 < 21.2.17, >= 20.0.0-next.0 < 20.3.25, <= 19.2.25

Identifiers

  • CVE-2026-54267
  • GHSA-rgjc-h3x7-9mwg

Timeline

  • 2026-06-01: other: Fix pull request submitted
  • 2026-06-10: advisory: GitHub Security Advisory published
  • 2026-06-22: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.