CVE-2026-54267: Angular Core DOM Clobbering and Response-Cache Poisoning Vulnerability
Summary
CVE-2026-54267: Angular Client Hydration DOM Clobbering & Response-Cache Poisoning. Affects @angular/core across 4 version ranges.
< 19.2.25
>= 20.0.0-next.0, < 20.3.25
>= 21.0.0-next.0, < 21.2.17
>= 22.0.0-next.0, < 22.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Angular is a popular open-source web application framework maintained by Google, designed for building dynamic single-page applications. It provides a robust set of tools for developers, including a powerful templating engine, dependency injection, and support for server-side rendering (SSR). However, a recent vulnerability has been identified in its hydration process, which can lead to serious security issues if not addressed.
Vulnerability Detail
The vulnerability arises from Angular's hydration process during server-side rendering, where it serializes application state into a predictable DOM element with the ID 'ng-state'. If an attacker can manipulate the DOM to create an element with the same ID before Angular parses the genuine script tag, they can inject malicious JSON payloads. This can lead to various attacks, including DOM-based Cross-Site Scripting (XSS), privilege escalation, and UI hijacking, as Angular's HttpClient may return forged responses from the poisoned cache instead of genuine API data.
How To Fix
Latest published version: 22.2.3 as of 23 Oct 2026
npm install @angular/core@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 19.2.2519.2.25npm install @angular/core@19.2.25 -
>= 20.0.0-next.0, < 20.3.2520.3.25npm install @angular/core@20.3.25 -
>= 21.0.0-next.0, < 21.2.1721.2.17npm install @angular/core@21.2.17 -
>= 22.0.0-next.0, < 22.0.122.0.1npm install @angular/core@22.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, consider implementing the following workarounds: A. Avoid Dynamic/User-Controlled IDs: Do not bind raw user-supplied values directly to element IDs. Instead, prepend a static safe prefix. Example: <div [id]="'safe-prefix-' + userControlledInput">...</div>. B. Configure a Custom Application ID: Change the default APP_ID to a unique value to alter the state element ID. Example: import { APP_ID } from '@angular/core'; import { provideClientHydration } from '@angular/platform-browser'; export
const appConfig = { providers: [{ provide: APP_ID, useValue: 'unique-obfuscated-app-id' }, provideClientHydration()] };
Conclusion
The CVE-2026-54267 vulnerability in Angular Core poses significant risks to applications using affected versions. It is crucial to update to the patched versions or implement the recommended workarounds to mitigate potential attacks. Regular monitoring using tools like Vulert can help maintain application security.
See every vulnerability recorded for @angular/core →
FAQ
It is a vulnerability in Angular Core that allows for DOM clobbering and response-cache poisoning, potentially leading to serious security issues.
If exploited, this vulnerability can lead to XSS attacks, privilege escalation, and UI hijacking, compromising user data and application integrity.
Versions 22.0.0 to 22.0.0-next.0, 21.0.0 to 21.2.16, and 20.0.0 to 20.3.24 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 8.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/core.
