CVE-2026-88058: Angular SSR XSS Vulnerability in @angular/platform-server
Summary
CVE-2026-88058: Angular SSR: XSS via Unescaped Processing Instruction () Nodes in Fallback Raw-Content Elements. Affects @angular/platform-server across 4 version ranges.
< 19.2.25
>= 20.0.0, < 20.3.30
>= 21.0.0, < 21.2.22
>= 22.0.0, < 22.1.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @angular/platform-server package is a core part of the Angular framework, enabling server-side rendering (SSR) of Angular applications. This functionality allows developers to render applications on the server, improving performance and SEO. However, a critical vulnerability has been identified that affects the security of applications using this package, particularly when handling ProcessingInstruction DOM nodes within fallback raw-content elements.
Vulnerability Detail
An XSS vulnerability exists in @angular/platform-server during server-side rendering (SSR) HTML serialization of ProcessingInstruction DOM nodes when nested inside fallback raw-content elements like <noscript>, <iframe>, <noembed>, and <noframes>. The vulnerability arises because the serialization process does not escape certain characters properly, allowing an attacker to inject malicious scripts into the rendered HTML. Specifically, if an attacker can control the data passed to a ProcessingInstruction node, they can break out of the fallback container and execute arbitrary JavaScript in the victim's browser, leading to potential data theft or unauthorized actions.
How To Fix
Latest published version: 22.2.3 as of 22 Oct 2026
npm install @angular/platform-server@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 19.2.2519.2.25npm install @angular/platform-server@19.2.25 -
>= 20.0.0, < 20.3.3020.3.30npm install @angular/platform-server@20.3.30 -
>= 21.0.0, < 21.2.2221.2.22npm install @angular/platform-server@21.2.22 -
>= 22.0.0, < 22.1.422.1.4npm install @angular/platform-server@22.1.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Avoid passing untrusted user input into document.createProcessingInstruction(target, data) when the node is inserted into <noscript>, <iframe>, <noembed>, or <noframes> during server-side rendering. Additionally, manually sanitize or replace < with < in any untrusted data passed to processing instruction nodes on the server.
Conclusion
The CVE-2026-88058 vulnerability in the @angular/platform-server package poses a significant risk to applications using server-side rendering. By understanding the nature of the vulnerability and applying the necessary updates or workarounds, developers can protect their applications from potential XSS attacks.
See every vulnerability recorded for @angular/platform-server →
FAQ
CVE-2026-88058 is a vulnerability in the @angular/platform-server package that allows for cross-site scripting (XSS) attacks through improperly handled ProcessingInstruction nodes during server-side rendering.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to analyze your package-lock.json.
Fallback raw-content elements are HTML elements like <noscript>, <iframe>, <noembed>, and <noframes> that change how the browser parses the content within them, potentially affecting how scripts are executed.
The CVSS score of this vulnerability is 8.6, indicating a high severity level that requires immediate attention.
If immediate updates are not possible, implement the suggested workarounds to sanitize user input and avoid using untrusted data in ProcessingInstruction nodes.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/platform-server.
