Fluid Attacks Database

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, to optimize client-side bootstrap in Server-Side Rendered (SSR) environments, Angular supports Hydration via provideClientHydration(). During SSR, Angular serializes the application's runtime state (such as cached HttpClient responses) and outputs it into the HTML stream as a

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	angular.js	=1.8.2-2 \|\| =1.8.3-1 \|\| =1.8.3-2 \|\| =1.8.3-3	-
debian 12	angular.js	=1.8.3-1 \|\| =1.8.3-1+deb12u1 \|\| =1.8.3-1+deb12u1~deb11u1 \|\| =1.8.3-2 \|\| =1.8.3-3	-
npm	@angular/core	>=22.0.0-next.0 <22.0.1 \|\| >=21.0.0-next.0 <21.2.17 \|\| >=20.0.0-next.0 <20.3.25 \|\| >=0 <=19.2.25	22.0.1, 21.2.17, 20.3.25
debian 13	angular.js	=1.8.3-3	-

Aliases

1. CVE-2026-542672. NVD-2026-542673. OSV-DEBIAN-2026-542674. OSV-2026-542675. GHSA-rgjc-h3x7-9mwg6. GCVE-2026-542677. SECURITY-TRACKER-CVE-2026-54267

References

1. https://github.com/angular/angular/security/advisories/GHSA-rgjc-h3x7-9mwg2. https://github.com/angular/angular/pull/690643. https://github.com/angular/angular/commit/6bde84fa8e6a5770b54040fbbc9bf10d5d0386fa

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.