chore(deps): update dependency @angular/common to v21.2.17 [security] by renovate[bot] · Pull Request #230 · TanStack/pacer

renovate · 2026-06-16T03:50:05Z

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/common (source)	`21.2.15` → `21.2.17`

@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

CVE-2026-54268 / GHSA-48r7-hpm6-gfxm

More information

Details

A Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter.

When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS).

Impact

1. Server-Side Rendering (SSR)

In Angular applications that leverage Server-Side Rendering, an attacker can supply a malicious payload with an excessively long date format string. Processing this on the server causes high CPU usage and triggers a JavaScript heap out of memory crash, rendering the application unavailable to all users.

2. Client-Side Rendering (CSR)

In standard client-side applications, executing the vulnerable function with an excessively long format string blocks the browser's main thread, causing the browser tab to freeze and become completely unresponsive.

Patched Versions

22.0.1
21.2.17
20.3.25

Attack Preconditions

For this vulnerability to be exploitable, both of the following conditions must be met:

Vulnerable Component Usage: The application must format dates using the formatDate utility or the DatePipe.
Attacker-Controlled Parameter: The date format string passed to these utilities must be customizable or directly controlled by untrusted user input (e.g., parsed from query parameters, user preferences, or API responses).

If the date format is hardcoded (e.g., 'mediumDate', 'shortTime', or static strings) or properly validated to be within a reasonable length limit, the application is not vulnerable.

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

CVE-2026-54266 / GHSA-39pv-4j6c-2g6v

More information

Details

Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration. This avoids repeating the same HTTP requests on the client. The cached responses are stored in TransferState using a cache key generated by hashing request properties (method, response type, mapped URL, serialized body, and sorted query parameters).

The cache keys are generated using a weak 32-bit DJB2-like polynomial rolling hash. The 32-bit hash space is extremely small, allowing attackers to find hash collisions.

An attacker can easily find a query parameter string (e.g., q=aaCAZMMM for a search request) that produces the exact same 32-bit hash as a sensitive endpoint (e.g., /api/user/profile). When a victim visits a crafted link containing the colliding parameter, the SSR process executes both the search request and the profile request. Due to the hash collision, the search response overwrites the profile response in the TransferState cache.

Impact

When the application attempts to retrieve the cached response for the sensitive endpoint (such as the user's profile), it receives the attacker-controlled response instead. This results in:

State Poisoning: The application runs with attacker-forged data, which can lead to bypassing client-side security controls or DOM-based Cross-Site Scripting (XSS) if the data is rendered unsafely.
Information Leakage: If the sensitive response is mistakenly associated with the attacker's search results and rendered on the page, the victim's sensitive data may be disclosed to the attacker.

Patched Versions

22.0.1
21.2.17
20.3.25

Framework-Level Fix

The logic has been updated to use a cryptographically secure SHA-256 hash algorithm for generating TransferState cache keys in HttpTransferCache. The cache keys are now 256-bit hexadecimal strings.

Workarounds

If you cannot upgrade immediately, configure your HttpClient requests to skip transfer caching for sensitive endpoints:

this.http.get('/api/user/profile', {
  transferCache: false
});

Alternatively, disable the HTTP transfer cache globally in your application bootstrap config:

import { provideClientHydration, withNoHttpTransferCache } from '@&#8203;angular/platform-browser';

export const appConfig = {
  providers: [
    provideClientHydration(
      withNoHttpTransferCache()
    )
  ]
};

Credits

This vulnerability was discovered and reported by CodeMender from Google DeepMind.

Severity

CVSS Score: 8.8 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

angular/angular (@angular/common)

`v21.2.17`

Compare Source

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit	Type	Description
86a56dc279	fix	Limits date format string length
d846326b07	fix	skip transfer cache for uncacheable HTTP traffic
bc55749698	fix	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Type	Description
dc9c99636d	fix	sanitize two-way properties

core

Commit	Type	Description
1523061137	fix	harden TransferState restoration against DOM clobbering
88832c84f8	fix	validate lowercase SVG animation attribute names (#69269)

http

Commit	Type	Description
bcb1b7ea25	fix	preserve empty referrer option in HttpRequest
a810a319d1	fix	Rejects non-HTTP(S) URLs in JSONP requests
e245d40c4d	fix	skip transfer cache for fetch credentialed requests

platform-server

Commit	Type	Description
35510746b7	fix	harden platform location origin validation during SSR
13fb0afe93	refactor	deprecate ServerXhr (#69255)

service-worker

Commit	Type	Description
b9d29381bb	fix	Strips sensitive headers on cross-origin redirects

`v21.2.16`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2026-06-16T03:50:14Z

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: abdc14bb-0f95-4e3e-a8e8-75fb54b40bcf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch renovate/npm-angular-common-vulnerability

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

nx-cloud · 2026-06-16T03:50:59Z

View your CI Pipeline Execution ↗ for commit 3b620b3

Command	Status	Duration	Result
`nx run-many --targets=build --exclude=examples/**`	✅ Succeeded	15s	View ↗

☁️ Nx Cloud last updated this comment at 2026-06-16 03:59:45 UTC

socket-security · 2026-06-16T03:51:44Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@angular/common@21.2.17

View full report

socket-security · 2026-06-16T03:51:45Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

pkg-pr-new · 2026-06-16T03:51:53Z

More templates

@tanstack/angular-pacer

npm i https://pkg.pr.new/@tanstack/angular-pacer@230

@tanstack/pacer

npm i https://pkg.pr.new/@tanstack/pacer@230

@tanstack/pacer-devtools

npm i https://pkg.pr.new/@tanstack/pacer-devtools@230

@tanstack/pacer-lite

npm i https://pkg.pr.new/@tanstack/pacer-lite@230

@tanstack/preact-pacer

npm i https://pkg.pr.new/@tanstack/preact-pacer@230

@tanstack/preact-pacer-devtools

npm i https://pkg.pr.new/@tanstack/preact-pacer-devtools@230

@tanstack/react-pacer

npm i https://pkg.pr.new/@tanstack/react-pacer@230

@tanstack/react-pacer-devtools

npm i https://pkg.pr.new/@tanstack/react-pacer-devtools@230

@tanstack/solid-pacer

npm i https://pkg.pr.new/@tanstack/solid-pacer@230

@tanstack/solid-pacer-devtools

npm i https://pkg.pr.new/@tanstack/solid-pacer-devtools@230

commit: edc1ec9

renovate Bot added the dependencies label Jun 16, 2026

chore(deps): update dependency @angular/common to v21.2.17 [security]

edc1ec9

renovate Bot force-pushed the renovate/npm-angular-common-vulnerability branch from 3b620b3 to edc1ec9 Compare June 16, 2026 03:58

renovate Bot merged commit b70d810 into main Jun 16, 2026
9 checks passed

renovate Bot deleted the renovate/npm-angular-common-vulnerability branch June 16, 2026 04:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update dependency @angular/common to v21.2.17 [security]#230

chore(deps): update dependency @angular/common to v21.2.17 [security]#230
renovate[bot] merged 1 commit into
mainfrom
renovate/npm-angular-common-vulnerability

renovate Bot commented Jun 16, 2026

Uh oh!

coderabbitai Bot commented Jun 16, 2026 •

edited

Loading

Review skipped

Uh oh!

nx-cloud Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jun 16, 2026

@​angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

Details

Impact

1. Server-Side Rendering (SSR)

2. Client-Side Rendering (CSR)

Patched Versions

Attack Preconditions

Severity

References

@​angular/common: Weak 32-Bit Cache Key Hashing in HttpTransferCache Leading to Cross-Request Data Leakage and State Poisoning

Details

Impact

Patched Versions

Framework-Level Fix

Workarounds

Credits

Severity

References

Release Notes

v21.2.17

Deprecations

platform-server

common

compiler

core

http

platform-server

service-worker

v21.2.16

Configuration

Uh oh!

coderabbitai Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

nx-cloud Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

`v21.2.17`

`v21.2.16`

coderabbitai Bot commented Jun 16, 2026 •

edited

Loading

nx-cloud Bot commented Jun 16, 2026 •

edited

Loading

socket-security Bot commented Jun 16, 2026 •

edited

Loading

socket-security Bot commented Jun 16, 2026 •

edited

Loading

pkg-pr-new Bot commented Jun 16, 2026 •

edited

Loading