# Angular vulnerabilities Source: https://junglewise.ai/threats/vendors/angular Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/angular.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in Angular: 0 in the last 7 days and 6 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-111753, was published on 5 November 2026. 6 vulnerabilities in the last four weeks, up from none in the four before. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 6 - Last 90 days: 6 - All time: 14 (0 critical, 0 exploited in the wild) ## About Angular A development platform, built on TypeScript, for building scalable web applications. ## Latest Angular vulnerabilities - [CVE-2026-111753: Angular common XSRF token leakage via URL parsing discrepancy](https://junglewise.ai/threats/cve-2026-111753-angular-common-xsrf-token-leakage-via-url-parsing-discrepancy-in) (medium, CVSS 4, published 5 Nov 2026) - [CVE-2026-111754: Angular platform-server open redirect via protocol-relative URLs in SSR](https://junglewise.ai/threats/cve-2026-111754-angular-platform-server-open-redirect-via-protocol-relative-urls) (medium, CVSS 4, published 3 Nov 2026) - [CVE-2026-111752: Angular router denial of service via unmatched empty-path outlet matching in SSR](https://junglewise.ai/threats/cve-2026-111752-angular-router-denial-of-service-via-unmatched-empty-path-outlet) (high, CVSS 4, published 3 Nov 2026) - [CVE-2026-111751: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…](https://junglewise.ai/threats/cve-2026-111751-angular-router-denial-of-service-via-routerlink-query-parameter) (high, CVSS 4, published 3 Nov 2026) - [CVE-2026-101897: Angular DevTools extension message validation bypass](https://junglewise.ai/threats/cve-2026-101897-angular-is-a-development-platform-for-building-mobile-and) (info, published 14 Oct 2026) - [CVE-2026-101895: Angular platform-server denial of service via malformed DOCTYPE](https://junglewise.ai/threats/cve-2026-101895-angular-ssr-denial-of-service-dos-via-infinite-loop-on-malformed) (high, CVSS 4, published 14 Oct 2026) - [CVE-2026-69149: Angular SSR XSS in fallback raw-content elements](https://junglewise.ai/threats/cve-2026-69149-angular-ssr-xss-in-fallback-raw-content-elements) (high, CVSS 4, published 3 Aug 2026) - [CVE-2026-50184: Angular Service Worker credential and cache policy stripping](https://junglewise.ai/threats/cve-2026-50184-angular-service-worker-credential-and-cache-policy-stripping) (medium, CVSS 3.1, published 22 Jun 2026) - [CVE-2026-50178: Angular Language Service VS Code Extension command injection in JSDoc tooltips](https://junglewise.ai/threats/cve-2026-50178-angular-language-service-vs-code-extension-command-injection-in) (info, CVSS 8.7, published 22 Jun 2026) - [CVE-2026-49241: Angular Language Service VS Code Extension RCE via Insecure SDK Path Loading](https://junglewise.ai/threats/cve-2026-49241-angular-language-service-vs-code-extension-rce-via-insecure-sdk) (info, CVSS 9.3, published 22 Jun 2026) - [CVE-2026-41423: Google Angular SSRF in @angular/platform-server via URL normalization](https://junglewise.ai/threats/cve-2026-41423-angular-ssrf-via-protocol-relative-and-backslash-urls-in-angular) (high, CVSS 5.3, published 8 May 2026) - [CVE-2024-21490: AngularJS regular expression denial of service in ng-srcset](https://junglewise.ai/threats/cve-2024-21490-angularjs-regular-expression-denial-of-service-in-ng-srcset) (low, CVSS 3.1, published 10 Feb 2024) - [CVE-2022-25844: Angular regular expression denial of service in locale formatting](https://junglewise.ai/threats/cve-2022-25844-angular-regular-expression-denial-of-service-in-locale-formatting) (low, CVSS 3.1, published 3 May 2022) - [AngularJS Cross-Site Scripting via JSONP in $http service](https://junglewise.ai/threats/angularjs-cross-site-scripting-via-jsonp-in-http-service-b4f3ec02) (info, CVSS 6.1, published 27 Jun 2019) ## Most severe Angular vulnerabilities - [CVE-2026-41423: Google Angular SSRF in @angular/platform-server via URL normalization](https://junglewise.ai/threats/cve-2026-41423-angular-ssrf-via-protocol-relative-and-backslash-urls-in-angular) (high, CVSS 5.3, published 8 May 2026) - [CVE-2026-101895: Angular platform-server denial of service via malformed DOCTYPE](https://junglewise.ai/threats/cve-2026-101895-angular-ssr-denial-of-service-dos-via-infinite-loop-on-malformed) (high, CVSS 4, published 14 Oct 2026) - [CVE-2026-69149: Angular SSR XSS in fallback raw-content elements](https://junglewise.ai/threats/cve-2026-69149-angular-ssr-xss-in-fallback-raw-content-elements) (high, CVSS 4, published 3 Aug 2026) - [CVE-2026-111752: Angular router denial of service via unmatched empty-path outlet matching in SSR](https://junglewise.ai/threats/cve-2026-111752-angular-router-denial-of-service-via-unmatched-empty-path-outlet) (high, CVSS 4, published 3 Nov 2026) - [CVE-2026-111751: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…](https://junglewise.ai/threats/cve-2026-111751-angular-router-denial-of-service-via-routerlink-query-parameter) (high, CVSS 4, published 3 Nov 2026) - [CVE-2026-111753: Angular common XSRF token leakage via URL parsing discrepancy](https://junglewise.ai/threats/cve-2026-111753-angular-common-xsrf-token-leakage-via-url-parsing-discrepancy-in) (medium, CVSS 4, published 5 Nov 2026) - [CVE-2026-111754: Angular platform-server open redirect via protocol-relative URLs in SSR](https://junglewise.ai/threats/cve-2026-111754-angular-platform-server-open-redirect-via-protocol-relative-urls) (medium, CVSS 4, published 3 Nov 2026) - [CVE-2026-50184: Angular Service Worker credential and cache policy stripping](https://junglewise.ai/threats/cve-2026-50184-angular-service-worker-credential-and-cache-policy-stripping) (medium, CVSS 3.1, published 22 Jun 2026) - [CVE-2022-25844: Angular regular expression denial of service in locale formatting](https://junglewise.ai/threats/cve-2022-25844-angular-regular-expression-denial-of-service-in-locale-formatting) (low, CVSS 3.1, published 3 May 2022) - [CVE-2024-21490: AngularJS regular expression denial of service in ng-srcset](https://junglewise.ai/threats/cve-2024-21490-angularjs-regular-expression-denial-of-service-in-ng-srcset) (low, CVSS 3.1, published 10 Feb 2024) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 4 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Angular technologies - [Angular Platform-Server](https://junglewise.ai/threats/technologies/angular-platform-server-1): 4 vulnerabilities - [AngularJS](https://junglewise.ai/threats/technologies/angularjs): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Angular vulnerabilities", https://junglewise.ai/threats/vendors/angular, 13 November 2026.