chore(deps): update dependency @angular/platform-server to v20.3.33 [security] by renovate[bot] · Pull Request #2484 · ngxs/store

renovate · 2026-08-26T11:35:53Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@angular/platform-server (source)	`20.3.25` → `20.3.33`

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

CVE-2026-69149 / GHSA-vpx6-8pjr-4g3v

More information

Details

A Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>).

When rendering dynamic text content inside fallback raw-content elements via template bindings, the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning these elements are treated as raw-text elements.

However, domino's serializer previously did not escape text nodes within fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>) during DOM serialization. As a result, any occurrence of closing tags in the bound dynamic text was not escaped.

The unescaped closing tag could be serialized directly into the output HTML. When parsed by a browser or re-parsed during SSR post-processing without preserving raw-content parser state, an injected closing tag closes the element early, allowing an injected script block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS).

Impact

This vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>). This can lead to session hijacking, credentials theft, unauthorized actions on behalf of users, and defacement.

Patched Versions

22.0.7
21.2.19
20.3.27

Workarounds

If you cannot immediately update your dependencies, you can mitigate this issue using any of the following approaches:

Disable critical CSS inlining: Critical CSS inlining in Angular SSR post-processes the rendered HTML using domino. Disabling this step prevents domino from re-parsing and re-serializing the HTML during server-side rendering.

In angular.json, set inlineCritical to false under style optimization options:

{
  "projects": {
    "my-app": {
      "architect": {
        "build": {
          "builder": "@angular/build:application",
          "options": {
            "optimization": {
              "styles": {
                "inlineCritical": false
              }
            }
          }
        }
      }
    }
  }
}

When rendering programmatically with CommonEngine, set inlineCriticalCss: false in your render options.

Avoid binding user-controlled values inside fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>).
Sanitize user input placed inside these elements to explicitly strip or escape closing tags before passing it to the template.

Severity

CVSS Score: 8.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

CVE-2026-88056 / GHSA-f6mr-pjwc-34m4

More information

Details

Summary

A discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery (SSRF), potentially leaking sensitive server-side credentials.

Technical Description

When applications validate incoming URLs using the WHATWG URL standard (new URL(input, trustedOrigin)), Unicode whitespace characters (such as NO-BREAK SPACE U+00A0 or ZERO WIDTH NO-BREAK SPACE U+FEFF) are not stripped and are evaluated as part of a same-origin relative path (e.g. http://trusted-origin/%C2%A0//attacker.example/collect). Consequently, these URLs successfully pass application-level same-origin checks.

However, @angular/platform-server's URL resolution utility (resolveUrl / parseUrl) previously executed String.prototype.trim(). Because JavaScript's String.prototype.trim() strips all Unicode whitespace (including U+00A0), the leading non-breaking space was removed, converting the string into a cross-origin protocol-relative URL (//attacker.example/collect). When resolved during server-side rendering (such as in relativeUrlsTransformerInterceptorFn), this caused the HTTP request to be dispatched to the attacker-controlled origin (http://attacker.example/collect), leaking any credentials (such as Authorization headers) attached by the application for the intended same-origin request.

Impact & Reachability

Reachability: The vulnerability affects Angular Server-Side Rendering (SSR) applications where user-controlled input influences resource or request URLs processed by Angular's HttpClient, an application-level same-origin check is performed before dispatching, and sensitive server-side credentials (such as API keys or Bearer tokens) are attached to approved requests.
Impact: Successful exploitation allows attackers to bypass same-origin validation, triggering Server-Side Request Forgery (SSRF) and leaking sensitive server-side credentials attached to the request.

Proof of Concept:

// Interceptor performing same-origin validation
const trustedOrigin = new URL('http://localhost:4000/');
const target = new URL(req.urlWithParams, trustedOrigin);

if (target.origin !== trustedOrigin.origin) {
  throw new Error('Cross-origin request blocked');
}

// Request passes validation, server attaches sensitive credential:
const authenticatedReq = req.clone({
  headers: req.headers.set('Authorization', 'Bearer SERVER-SECRET-TOKEN'),
});

// @angular/platform-server previously trimmed the URL, converting it into
// //attacker.example/collect and routing the credential to the attacker.

Workarounds

Validate and sanitize input URLs to disallow leading Unicode whitespace characters (such as \u00A0) before performing origin checks or passing them to HttpClient.
Avoid relying solely on new URL(input, trustedOrigin).origin for authorization if the input string may be trimmed or processed by utilities that normalize whitespace differently from the WHATWG URL standard.

Severity

CVSS Score: 8.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Angular: SSR XSS via Unescaped Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

CVE-2026-88060 / GHSA-v3p8-whq6-r5jg

More information

Details

Summary

An XSS vulnerability exists in @angular/platform-server during server-side rendering (SSR) HTML serialization when traversing ancestor tags across <template> element boundaries. When an application renders untrusted user input within raw-text tags (<xmp>, <style>, <script>), comments, or text nodes inside a <template> that is nested within a fallback raw-content element (<noscript>, <iframe>, <noembed>, <noframes>), matching closing tags (e.g., </noscript>) are not escaped during HTML serialization. When rendered in a browser, this unescaped closing tag prematurely terminates the fallback container and executes trailing markup as active DOM elements.

Technical Description

In HTML5 parsing, fallback raw-content elements (<noscript>, <iframe>, <noembed>, <noframes>) place the browser's tokenizer into RAWTEXT mode. In this mode, inner content is parsed as literal text until an end tag matching the container tag name (e.g., </noscript>) is encountered.

To prevent XSS breakout vectors during SSR serialization, the DOM serializer inspects a node's ancestors to escape any matching fallback closing tags (</tag -> </tag). However:

Per DOM specifications, the children of a <template> element reside in a separate DocumentFragment (template.content), whose own parentNode is null.
The serializer's ancestor traversal previously only inspected element nodes. When traversing upward from a node inside template.content, traversal terminated immediately at the DocumentFragment boundary.
Because traversal stopped before reaching the outer document tree, enclosing fallback raw-content ancestors (such as <noscript> or <iframe>) were not discovered. As a result, closing sequences like </noscript> within <template> content were emitted unescaped.

Impact & Reachability

Framework Guarantee Bypass: Angular guarantees that standard text interpolation (`` bound as element text content) is safe by default without manual sanitization. This vulnerability bypasses that guarantee during SSR HTML serialization when untrusted input is interpolated inside template content within fallback containers.
Template Authoring: Writing literal <xmp> or <style> directly inside a component's <template> markup requires relaxed template schema checks (CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA). However, standard HTML comments and text nodes inside <template> within <noscript> are reachable without relaxed schemas.
Imperative DOM Construction: Components or directives that construct DOM structures imperatively via Renderer2 bypass template compiler schema checks entirely and are unconditionally affected.

Proof of Concept (Minimal Reproduction)

import { Component } from '@angular/core';

@Component({
  selector: 'app-root',
  standalone: true,
  template: `
    <noscript>
      <template>
        <xmp></xmp>
      </template>
    </noscript>
  `
})
export class AppComponent {
  // Attacker-controlled input bound via standard text interpolation
  payload = '</noscript><img src=x onerror=alert("SSR_TEMPLATE_XSS")>';
}

Vulnerable SSR Output:

<noscript><template><xmp></noscript><img src=x onerror=alert("SSR_TEMPLATE_XSS")></xmp></template></noscript>

Workarounds

Avoid rendering untrusted user input inside <template> elements nested within <noscript>, <iframe>, <noembed>, or <noframes> in server-rendered templates.
Avoid programmatic DOM assembly of <template> elements inside fallback containers when handling untrusted data.

Severity

CVSS Score: 8.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Angular SSR: XSS via Unescaped Processing Instruction () Nodes in Fallback Raw-Content Elements

CVE-2026-88058 / GHSA-j3r3-mxqp-r2p4

More information

Details

Summary

An XSS vulnerability exists in @angular/platform-server during server-side rendering (SSR) HTML serialization of ProcessingInstruction DOM nodes (<?target data?>, nodeType === 7) when nested inside fallback raw-content elements (<noscript>, <iframe>, <noembed>, <noframes>). While processing instruction data escaped > to >, it did not check for or escape matching closing tags of ancestor fallback elements (e.g., </noscript>). When rendered in a browser with scripting enabled, an unescaped closing tag sequence in a processing instruction prematurely closes the fallback raw-content tag and causes subsequent sibling elements to execute as live HTML.

Technical Description

In HTML5 parsing, fallback raw-content elements (<noscript>, <iframe>, <noembed>, <noframes>) place the browser's HTML tokenizer into RAWTEXT mode. In RAWTEXT mode, processing instruction tokens (<?...?>) are treated as literal raw text rather than bogus comments, and the parser ignores > or ?>. The only token sequence that terminates the container is an end tag matching the container tag name (</noscript, </iframe, etc.).

During server-side HTML serialization, processing instruction nodes previously only replaced > with > (preventing bogus comment breakouts in normal HTML data states) but left < untouched. Crucially, processing instruction serialization never inspected ancestor fallback raw-content tags. As a result, if a ProcessingInstruction node inside <noscript> contained </noscript in its data payload, it was emitted unescaped as <?x </noscript ?>.

Impact & Reachability

Reachability: Processing instruction nodes cannot be authored directly through standard Angular template syntax (which parses <?...> into comment nodes in DOM position). Reaching this vulnerability requires application or library code calling inject(DOCUMENT).createProcessingInstruction(target, data) or Renderer2 DOM insertion methods with untrusted user input passed to data inside a fallback raw-content container.
Impact: In applications that programmatically construct processing instruction nodes inside fallback elements during server-side rendering, an attacker controlling the processing instruction data can break out of the container and execute arbitrary JavaScript in victims' browsers.

Proof of Concept (Minimal Reproduction)

import { Component, ElementRef, Renderer2, inject, DOCUMENT, AfterViewInit } from '@angular/core';

@Component({
  selector: 'app-root',
  standalone: true,
  template: `<noscript id="host"></noscript>`
})
export class AppComponent implements AfterViewInit {
  private r = inject(Renderer2);
  private el = inject(ElementRef);
  private doc = inject(DOCUMENT);

  ngAfterViewInit() {
    const host = this.el.nativeElement.querySelector('#host');
    
    // Attacker-controlled input passed as Processing Instruction data
    const pi = this.doc.createProcessingInstruction('x', '</noscript ');
    this.r.appendChild(host, pi);
    
    // Sibling markup that should remain inert inside <noscript>
    const img = this.r.createElement('img');
    this.r.setAttribute(img, 'src', 'x');
    this.r.setAttribute(img, 'onerror', 'alert("SSR_PI_XSS")');
    this.r.appendChild(host, img);
  }
}

Vulnerable SSR Output:

<noscript><?x </noscript ?><img src="x" onerror="alert('SSR_PI_XSS')"></noscript>

Workarounds

Avoid passing untrusted user input into document.createProcessingInstruction(target, data) when the node is inserted into <noscript>, <iframe>, <noembed>, or <noframes> during server-side rendering.
Manually sanitize or replace < with < in any untrusted data passed to processing instruction nodes on the server.

Severity

CVSS Score: 8.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

CVE-2026-111754 / GHSA-w739-gvwx-grc3

More information

Details

An open redirect vulnerability was identified in @angular/platform-server when Server-Side Rendering (SSR) is enabled.

When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by ServerPlatformLocation using resolveUrl (or parseUrl in v20). While resolveUrl rejected protocol-relative URLs whose raw string directly started with //, this check ran prior to WHATWG URL normalization.

When a request URL includes a popping dot-segment followed by multiple slashes (such as /.//evil.test or serialized from router route shapes like /.;/(//evil.test)), the input bypassed the initial urlStr.startsWith('//') check. Subsequent WHATWG URL parsing resolved the dot-segments and resulted in a pathname starting with // (//evil.test).

Consequently, ServerPlatformLocation stored pathname = '//evil.test'. When @angular/ssr detected a mismatch between the rendered URL and the router's final location state, it emitted the unnormalized pathname into the HTTP Location response header, producing an HTTP 302 redirect with Location: //evil.test, which browsers resolve as a protocol-relative navigation off-origin.

Impact

Successful exploitation allows an unauthenticated remote attacker to craft URLs that trick Angular SSR into redirecting users to an arbitrary external domain.

Bypasses Application-Level Guards: Common application-level validation routines (such as checking !returnUrl.startsWith('//') before invoking router.navigateByUrl) accept /.//evil.test or /.;/(//evil.test) as a safe relative path, allowing attackers to bypass redirect allowlists.
Client-side SPAs Unaffected: Pure client-side Angular applications (Single Page Applications without SSR) are not vulnerable, as ServerPlatformLocation is only utilized in server-side execution environments.

Attack Preconditions & Vulnerable Configurations

An application is affected if the following conditions are met:

SSR Enabled: The application runs in a Server-Side Rendering environment using @angular/platform-server and @angular/ssr.
Parameter Route Shapes: The router contains parameter routes with wildcard or child segments (e.g. /:tenant matching . and serializing secondary outlet groups (//evil.test) to /.//evil.test), or passes user-provided navigation targets (e.g. returnUrl).
Reverse Proxy Passthrough: Upstream reverse proxies (Nginx, Cloudflare, ALB) pass semicolons (;) or dot-segments without stripping or normalizing them.

Exploit Payload Example

An attacker sends a request targeting a route with parameters and child segments:

GET /.;/(//evil.test) HTTP/1.1
Host: example.com

Response:

HTTP/1.1 302 Found
Location: //evil.test

The client browser resolves //evil.test protocol-relatively and redirects the user away from example.com to evil.test.

Patches

The issue is resolved by updating resolveUrl (and parseUrl in v20) in @angular/platform-server to verify that the normalized URL pathname does not start with // when allowProtocolRelative is false.

22.2.1
21.2.25
20.3.33

Workarounds & Mitigations

If you cannot immediately upgrade to a patched version, apply one of the following mitigations at your edge reverse proxy or WAF:

Reject Paths with Dot-Segments Followed by Slashes:
Configure your reverse proxy (e.g., Nginx, Cloudflare, AWS WAF) to block requests containing /.//, /..//, or /.;/:
```
# Nginx example: reject suspicious path normalization sequences
if ($request_uri ~* "(\n/\.\/|\/\.\;)") {
    return 400;
}
```
Sanitize Redirect Headers:
Ensure edge proxies or API gateways rewrite or disallow protocol-relative (//) Location response headers originating from the SSR upstream.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

angular/angular (@angular/platform-server)

`v20.3.33`

Compare Source

platform-server

Commit	Type	Description
83944fc8c5	fix	reject protocol-relative paths in resolveUrl

router

Commit	Type	Description
142f187b3c	fix	do not copy URL-sized objects into every route snapshot
cd8efcb924	fix	reject duplicate outlets in production builds
b0d2ba0f54	fix	require outlets to match a route before processing child segments

`v20.3.32`

Compare Source

router

Commit	Type	Description
ddfe21072b	fix	avoid dense elements allocation for numeric URL keys

`v20.3.31`

Compare Source

platform-server

Commit	Type	Description
3db26e2544	fix	update domino to latest version

`v20.3.30`

Compare Source

platform-server

Commit	Type	Description
9339a7a2de	fix	avoid stripping unicode whitespace during url resolution
89b20568df	fix	update domino to latest version

`v20.3.29`

Compare Source

platform-browser

Commit	Type	Description
7538744c10	fix	disallow event handler attributes in Meta

`v20.3.28`

Compare Source

core

Commit	Type	Description
2f96c8020f	fix	sanitize host bindings on concrete hosts

http

Commit	Type	Description
969133d426	fix	match header values exactly when deleting
29dd26bd71	fix	preserve immutability of materialized clones
e4c416c20a	fix	run root interceptors in the terminal request chain

`v20.3.27`

Compare Source

compiler

Commit	Type	Description
5dbcd0ee16	fix	disallow i18n event attributes
db0d4a1a39	fix	restrict possible event handler check to property names longer than 2 characters

http

Commit	Type	Description
a64e2883e9	fix	distinguish repeated transfer cache params

platform-server

Commit	Type	Description
6f80cca0b8	fix	update domino to latest version

`v20.3.26`

Compare Source

compiler-cli

Commit	Type	Description
406aaa31e6	fix	update babel dependencies to latest v7

core

Commit	Type	Description
26831d0cbd	fix	avoid caching missing locale data
8eb7aea08b	fix	reject dynamic script host elements

http

Commit	Type	Description
b963f61028	fix	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Type	Description
1fdf234168	fix	preserve referrer in asset requests
baa093ba68	fix	preserve referrer policy in asset requests

Configuration

📅 Schedule: (in timezone UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

nx-cloud · 2026-08-26T11:39:05Z

View your CI Pipeline Execution ↗ for commit d82a958

Command	Status	Duration	Result
`nx run-many --target=test --all --configuration...`	✅ Succeeded	1m 3s	View ↗
`nx run-many --target=lint --all --configuration...`	✅ Succeeded	10s	View ↗
`nx lint-types store`	✅ Succeeded	<1s	View ↗
`nx run-many --target=build --all`	✅ Succeeded	1m 9s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

☁️ Nx Cloud last updated this comment at 2026-10-20 20:23:15 UTC

pkg-pr-new · 2026-08-26T11:39:19Z

Open in StackBlitz

@ngxs/devtools-plugin

npm i https://pkg.pr.new/@ngxs/devtools-plugin@2484

@ngxs/form-plugin

npm i https://pkg.pr.new/@ngxs/form-plugin@2484

@ngxs/hmr-plugin

npm i https://pkg.pr.new/@ngxs/hmr-plugin@2484

@ngxs/router-plugin

npm i https://pkg.pr.new/@ngxs/router-plugin@2484

@ngxs/storage-plugin

npm i https://pkg.pr.new/@ngxs/storage-plugin@2484

@ngxs/store

npm i https://pkg.pr.new/@ngxs/store@2484

@ngxs/websocket-plugin

npm i https://pkg.pr.new/@ngxs/websocket-plugin@2484

commit: d82a958

bundlemon · 2026-08-26T11:43:49Z

BundleMon

Unchanged files (6)

Status	Path	Size	Limits
❌	fesm2022/ngxs-store.mjs	131.38KB	118KB / +0.5%
❌	fesm2022/ngxs-store-operators.mjs	16.81KB	16KB / +0.5%
✅	fesm2022/ngxs-store-internals.mjs	14.85KB	15KB / +0.5%
✅	fesm2022/ngxs-store-internals-testing.mjs	10.33KB	13KB / +0.5%
❌	fesm2022/ngxs-store-plugins.mjs	5.39KB	3KB / +0.5%
✅	fesm2022/ngxs-store-experimental.mjs	574B	2KB / +0.5%

No change in files bundle size

Unchanged groups (1)

Status	Path	Size	Limits
✅	@ngxs/store(fesm2022)[gzip] _{./fesm2022/*.mjs}	45.92KB	+1%

Final result: ❌

View report in BundleMon website ➡️

Current branch size history | Target branch size history

bundlemon · 2026-08-26T11:43:52Z

BundleMon (NGXS Plugins)

Unchanged files (9)

Status	Path	Size	Limits
✅	Plugins(fesm2022)[gzip] _{storage-plugin/fesm2022/ngxs-storage-plugin.m js}	6.1KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{router-plugin/fesm2022/ngxs-router-plugin.mjs}	4.5KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{hmr-plugin/fesm2022/ngxs-hmr-plugin.mjs}	2.78KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{websocket-plugin/fesm2022/ngxs-websocket-plug in.mjs}	2.61KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{form-plugin/fesm2022/ngxs-form-plugin.mjs}	2.51KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{devtools-plugin/fesm2022/ngxs-devtools-plugin .mjs}	2.26KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{logger-plugin/fesm2022/ngxs-logger-plugin.mjs}	2.07KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{storage-plugin/fesm2022/ngxs-storage-plugin-i nternals.mjs}	1.21KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{router-plugin/fesm2022/ngxs-router-plugin-int ernals.mjs}	453B	+0.5%

No change in files bundle size

Unchanged groups (1)

Status	Path	Size	Limits
✅	All Plugins(fesm2022)[gzip] _{./-plugin/fesm2022/.mjs}	24.48KB	+0.5%

Final result: ✅

View report in BundleMon website ➡️

Current branch size history | Target branch size history

bundlemon · 2026-08-26T11:43:55Z

BundleMon (Integration Projects)

Unchanged files (1)

Status	Path	Size	Limits
✅	Main bundles(Gzip) _{hello-world-ng22/dist-integration/browser/mai n-(hash).js}	69.48KB	+1%

No change in files bundle size

Final result: ✅

View report in BundleMon website ➡️

Current branch size history | Target branch size history

…security]

renovate Bot requested review from Carniatto, arturovt, joaqcid, kuncevic, markwhitfeld and poloagustin as code owners August 26, 2026 11:35

renovate Bot enabled auto-merge (squash) August 26, 2026 11:35

renovate Bot requested a review from splincode as a code owner August 26, 2026 11:35

renovate Bot force-pushed the renovate/npm-angular-platform-server-vulnerability branch 17 times, most recently from 5632a14 to 3e5c4e6 Compare August 30, 2026 21:22

renovate Bot force-pushed the renovate/npm-angular-platform-server-vulnerability branch 8 times, most recently from 065e988 to 59903b5 Compare September 2, 2026 15:40

renovate Bot force-pushed the renovate/npm-angular-platform-server-vulnerability branch from 59903b5 to 40ceac7 Compare September 11, 2026 12:07

renovate Bot changed the title ~~chore(deps): update dependency @angular/platform-server to v20.3.27 [security]~~ chore(deps): update dependency @angular/platform-server to v20.3.30 [security] Sep 11, 2026

chore(deps): update dependency @angular/platform-server to v20.3.33 […

d82a958

…security]

renovate Bot force-pushed the renovate/npm-angular-platform-server-vulnerability branch from 40ceac7 to d82a958 Compare October 20, 2026 20:15

renovate Bot changed the title ~~chore(deps): update dependency @angular/platform-server to v20.3.30 [security]~~ chore(deps): update dependency @angular/platform-server to v20.3.33 [security] Oct 20, 2026

Navigation Menu

Repository navigation

chore(deps): update dependency @angular/platform-server to v20.3.33 [security] - #2484

chore(deps): update dependency @angular/platform-server to v20.3.33 [security]#2484
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-angular-platform-server-vulnerability

renovate Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

nx-cloud Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

bundlemon Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

bundlemon Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

bundlemon Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Details

Impact

Patched Versions

Workarounds

Severity

References

Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Details

Summary

Technical Description

Impact & Reachability

Workarounds

Severity

References

Details

Summary

Technical Description

Impact & Reachability

Proof of Concept (Minimal Reproduction)

Workarounds

Severity

References

Angular SSR: XSS via Unescaped Processing Instruction () Nodes in Fallback Raw-Content Elements

Details

Summary

Technical Description

Impact & Reachability

Proof of Concept (Minimal Reproduction)

Workarounds

Severity

References

@​angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

Details

Impact

Attack Preconditions & Vulnerable Configurations

Exploit Payload Example

Patches

Workarounds & Mitigations

Severity

References

Release Notes

platform-server

router

router

platform-server

platform-server

platform-browser

core

http

compiler

http

platform-server

compiler-cli

core

http

service-worker

Configuration

Uh oh!

nx-cloud Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bundlemon Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

BundleMon

Uh oh!

bundlemon Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

BundleMon (NGXS Plugins)

Uh oh!

bundlemon Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

BundleMon (Integration Projects)

Uh oh!

renovate Bot commented Aug 26, 2026 •

edited

Loading

@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

nx-cloud Bot commented Aug 26, 2026 •

edited

Loading

pkg-pr-new Bot commented Aug 26, 2026 •

edited

Loading

bundlemon Bot commented Aug 26, 2026 •

edited

Loading

bundlemon Bot commented Aug 26, 2026 •

edited

Loading

bundlemon Bot commented Aug 26, 2026 •

edited

Loading