Visit Angular NES Home Page
Angular 11
Comprehensive release notes and changelog for Angular 11, including security patches, bug fixes, and feature updates across all supported versions.
19 Patched Vulnerabilities
VEX Statements
Angular
v11.2.27 - August 20, 2026
Notes
- Full package name(s) and version(s):
@neverendingsupport/angular-animations@11.2.14-angular-11.2.27@neverendingsupport/angular-bazel@11.2.14-angular-11.2.27@neverendingsupport/angular-common@11.2.14-angular-11.2.27@neverendingsupport/angular-compiler@11.2.14-angular-11.2.27@neverendingsupport/angular-compiler-cli@11.2.14-angular-11.2.27@neverendingsupport/angular-core@11.2.14-angular-11.2.27@neverendingsupport/angular-elements@11.2.14-angular-11.2.27@neverendingsupport/angular-forms@11.2.14-angular-11.2.27@neverendingsupport/angular-language-service@11.2.14-angular-11.2.27@neverendingsupport/angular-localize@11.2.14-angular-11.2.27@neverendingsupport/angular-platform-browser@11.2.14-angular-11.2.27@neverendingsupport/angular-platform-browser-dynamic@11.2.14-angular-11.2.27@neverendingsupport/angular-platform-server@11.2.14-angular-11.2.27@neverendingsupport/angular-router@11.2.14-angular-11.2.27@neverendingsupport/angular-service-worker@11.2.14-angular-11.2.27@neverendingsupport/angular-upgrade@11.2.14-angular-11.2.27
Security Fixes
- common:
- Add upper bounds for
digitsInfoto preventroundNumberfrom allocating a large array.- This fixes a high-severity Denial of Service (DoS) vulnerability (CVE-2026-50171).
- Limit date format string length to 256 characters.
- This fixes a high-severity Denial of Service (DoS) vulnerability (CVE-2026-54268).
- Add upper bounds for
- compiler:
- Disallow i18n event attributes.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69151).
- Restrict possible event handler check to property names longer than 2 characters.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69151).
- Reject i18n translation of event-handler attributes on the View Engine path.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69151).
- Disallow i18n event attributes.
- platform-browser:
- Harden
TransferStaterestoration against DOM clobbering.- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-54267).
- Harden
- platform-server:
- Escape matching closing tags correctly when raw-text content contains astral characters.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50555).
- Escape
<noscript>text content when serializing server-rendered output.- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50556).
- Escape text in fallback raw-content elements (
<iframe>,<noembed>,<noframes>,<noscript>) when serializing server-rendered output.- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69149).
- Escape matching closing tags correctly when raw-text content contains astral characters.
v11.2.26 - July 23, 2026
Notes
- Full package name(s) and version(s):
@neverendingsupport/angular-animations@11.2.14-angular-11.2.26@neverendingsupport/angular-bazel@11.2.14-angular-11.2.26@neverendingsupport/angular-common@11.2.14-angular-11.2.26@neverendingsupport/angular-compiler@11.2.14-angular-11.2.26@neverendingsupport/angular-compiler-cli@11.2.14-angular-11.2.26@neverendingsupport/angular-core@11.2.14-angular-11.2.26@neverendingsupport/angular-elements@11.2.14-angular-11.2.26@neverendingsupport/angular-forms@11.2.14-angular-11.2.26@neverendingsupport/angular-language-service@11.2.14-angular-11.2.26@neverendingsupport/angular-localize@11.2.14-angular-11.2.26@neverendingsupport/angular-platform-browser@11.2.14-angular-11.2.26@neverendingsupport/angular-platform-browser-dynamic@11.2.14-angular-11.2.26@neverendingsupport/angular-platform-server@11.2.14-angular-11.2.26@neverendingsupport/angular-router@11.2.14-angular-11.2.26@neverendingsupport/angular-service-worker@11.2.14-angular-11.2.26@neverendingsupport/angular-upgrade@11.2.14-angular-11.2.26
Security Fixes
- platform-server:
- Reject untrusted request URLs that bypass the
allowedHostsallowlist.- This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-50168).
- Reject untrusted request URLs that bypass the
- service-worker:
- Preserve redirect policy on reconstructed asset requests.
- This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50169).
- Preserve explicit
credentials: 'omit'in asset requests.- This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50184).
- Preserve HTTP cache mode in asset group requests.
- This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50184).
- Preserve redirect policy on reconstructed asset requests.
v11.2.25 - June 18, 2026
Notes
- Full package name(s) and version(s):
@neverendingsupport/angular-animations@11.2.14-angular-11.2.25@neverendingsupport/angular-bazel@11.2.14-angular-11.2.25@neverendingsupport/angular-common@11.2.14-angular-11.2.25@neverendingsupport/angular-compiler@11.2.14-angular-11.2.25@neverendingsupport/angular-compiler-cli@11.2.14-angular-11.2.25@neverendingsupport/angular-core@11.2.14-angular-11.2.25@neverendingsupport/angular-elements@11.2.14-angular-11.2.25@neverendingsupport/angular-forms@11.2.14-angular-11.2.25@neverendingsupport/angular-language-service@11.2.14-angular-11.2.25@neverendingsupport/angular-localize@11.2.14-angular-11.2.25@neverendingsupport/angular-platform-browser@11.2.14-angular-11.2.25@neverendingsupport/angular-platform-browser-dynamic@11.2.14-angular-11.2.25@neverendingsupport/angular-platform-server@11.2.14-angular-11.2.25@neverendingsupport/angular-router@11.2.14-angular-11.2.25@neverendingsupport/angular-service-worker@11.2.14-angular-11.2.25@neverendingsupport/angular-upgrade@11.2.14-angular-11.2.25
Security Fixes
- core:
- Validate security-sensitive attributes in i18n bindings.
- Disallow event attribute bindings in host bindings unconditionally.
- platform-server:
- Add
allowedHostsoption torenderModuleandrenderModuleFactory.- This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-46417).
- Add
Breaking Changes
platform-server
- Add
allowedHostsoption torenderModuleandrenderModuleFactory:
Whenurlis an absolute URL, its hostname is now validated against the newallowedHostsoption, mitigating Server-Side Request Forgery (SSRF) and Host Header Injection attacks. This validation applies to both rendering entry points (renderModuleandrenderModuleFactory). BecauseallowedHostsdefaults to an empty allow-list, any absolute URL now throws at bootstrap unlessallowedHostsis configured. Relative URLs (e.g./path) are unaffected.
To pass validation, configureallowedHostswith the hostnames you serve (exact hostnames,*.example.comwildcards, or*to allow all).
v11.2.24 - March 10, 2026
Notes
- Full package name(s) and version(s):
@neverendingsupport/angular-animations@11.2.14-angular-11.2.24@neverendingsupport/angular-bazel@11.2.14-angular-11.2.24@neverendingsupport/angular-common@11.2.14-angular-11.2.24@neverendingsupport/angular-compiler@11.2.14-angular-11.2.24@neverendingsupport/angular-compiler-cli@11.2.14-angular-11.2.24@neverendingsupport/angular-core@11.2.14-angular-11.2.24@neverendingsupport/angular-elements@11.2.14-angular-11.2.24@neverendingsupport/angular-forms@11.2.14-angular-11.2.24@neverendingsupport/angular-language-service@11.2.14-angular-11.2.24@neverendingsupport/angular-localize@11.2.14-angular-11.2.24@neverendingsupport/angular-platform-browser@11.2.14-angular-11.2.24@neverendingsupport/angular-platform-browser-dynamic@11.2.14-angular-11.2.24@neverendingsupport/angular-platform-server@11.2.14-angular-11.2.24@neverendingsupport/angular-router@11.2.14-angular-11.2.24@neverendingsupport/angular-service-worker@11.2.14-angular-11.2.24@neverendingsupport/angular-upgrade@11.2.14-angular-11.2.24
Security Fixes
- core:
- Block creation of sensitive URI attributes from ICU messages.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-27970).
- Block creation of sensitive URI attributes from ICU messages.
Breaking Changes
core
- Block creation of sensitive URI attributes from ICU messages:
Translators can no longer introduce URI attributes—attribute values are blocked to avoid malicious links, and sanitization now relies on an allowlist of known attributes (still sanitizing URI ones). Translated ICU content keeps only recognized attributes and drops everything else.
v11.2.23 - February 24, 2026
Notes
- Full package name(s) and version(s):
@neverendingsupport/angular-animations@11.2.14-angular-11.2.23@neverendingsupport/angular-bazel@11.2.14-angular-11.2.23@neverendingsupport/angular-common@11.2.14-angular-11.2.23@neverendingsupport/angular-compiler@11.2.14-angular-11.2.23@neverendingsupport/angular-compiler-cli@11.2.14-angular-11.2.23@neverendingsupport/angular-core@11.2.14-angular-11.2.23@neverendingsupport/angular-elements@11.2.14-angular-11.2.23@neverendingsupport/angular-forms@11.2.14-angular-11.2.23@neverendingsupport/angular-language-service@11.2.14-angular-11.2.23@neverendingsupport/angular-localize@11.2.14-angular-11.2.23@neverendingsupport/angular-platform-browser@11.2.14-angular-11.2.23@neverendingsupport/angular-platform-browser-dynamic@11.2.14-angular-11.2.23@neverendingsupport/angular-platform-server@11.2.14-angular-11.2.23@neverendingsupport/angular-router@11.2.14-angular-11.2.23@neverendingsupport/angular-service-worker@11.2.14-angular-11.2.23@neverendingsupport/angular-upgrade@11.2.14-angular-11.2.23
Security Fixes
- core:
- Sanitize sensitive attributes on SVG script elements.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-22610).
- Sanitize sensitive attributes on SVG script elements.
v11.2.22 - December 18, 2025
Notes
- Full package name(s) and version(s):
@neverendingsupport/angular-animations@11.2.14-angular-11.2.22@neverendingsupport/angular-bazel@11.2.14-angular-11.2.22@neverendingsupport/angular-common@11.2.14-angular-11.2.22@neverendingsupport/angular-compiler@11.2.14-angular-11.2.22@neverendingsupport/angular-compiler-cli@11.2.14-angular-11.2.22@neverendingsupport/angular-core@11.2.14-angular-11.2.22@neverendingsupport/angular-elements@11.2.14-angular-11.2.22@neverendingsupport/angular-forms@11.2.14-angular-11.2.22@neverendingsupport/angular-language-service@11.2.14-angular-11.2.22@neverendingsupport/angular-localize@11.2.14-angular-11.2.22@neverendingsupport/angular-platform-browser@11.2.14-angular-11.2.22@neverendingsupport/angular-platform-browser-dynamic@11.2.14-angular-11.2.22@neverendingsupport/angular-platform-server@11.2.14-angular-11.2.22@neverendingsupport/angular-router@11.2.14-angular-11.2.22@neverendingsupport/angular-service-worker@11.2.14-angular-11.2.22@neverendingsupport/angular-upgrade@11.2.14-angular-11.2.22
Security Fixes
- compiler:
- Prevent stored XSS via SVG animation
attributeNameand MathML/SVG URLs.- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2025-66412).
- Prevent stored XSS via SVG animation
v11.2.21 - December 4, 2025
Notes
- Full package name(s) and version(s):
@neverendingsupport/angular-animations@11.2.14-angular-11.2.21@neverendingsupport/angular-bazel@11.2.14-angular-11.2.21@neverendingsupport/angular-common@11.2.14-angular-11.2.21@neverendingsupport/angular-compiler@11.2.14-angular-11.2.21@neverendingsupport/angular-compiler-cli@11.2.14-angular-11.2.21@neverendingsupport/angular-core@11.2.14-angular-11.2.21@neverendingsupport/angular-elements@11.2.14-angular-11.2.21@neverendingsupport/angular-forms@11.2.14-angular-11.2.21@neverendingsupport/angular-language-service@11.2.14-angular-11.2.21@neverendingsupport/angular-localize@11.2.14-angular-11.2.21@neverendingsupport/angular-platform-browser@11.2.14-angular-11.2.21@neverendingsupport/angular-platform-browser-dynamic@11.2.14-angular-11.2.21@neverendingsupport/angular-platform-server@11.2.14-angular-11.2.21@neverendingsupport/angular-router@11.2.14-angular-11.2.21@neverendingsupport/angular-service-worker@11.2.14-angular-11.2.21@neverendingsupport/angular-upgrade@11.2.14-angular-11.2.21
Security Fixes
- common:
- Prevent Cross-Site Request Forgery (XSRF) token leakage to protocol-relative URLs.
- This fixes a high-severity Information Exposure vulnerability (CVE-2025-66035).
- Prevent Cross-Site Request Forgery (XSRF) token leakage to protocol-relative URLs.
v11.2.20 - June 16, 2025
Notes
- This release contains no functional changes from NES v11.2.19.
- This release implements a new package naming scheme for the Angular packages. More information about the change can be found in the NES Decoupled Namespace Specification.
- Full package name(s) and version(s):
@neverendingsupport/angular-animations@11.2.14-angular-11.2.20@neverendingsupport/angular-bazel@11.2.14-angular-11.2.20@neverendingsupport/angular-common@11.2.14-angular-11.2.20@neverendingsupport/angular-compiler@11.2.14-angular-11.2.20@neverendingsupport/angular-compiler-cli@11.2.14-angular-11.2.20@neverendingsupport/angular-core@11.2.14-angular-11.2.20@neverendingsupport/angular-elements@11.2.14-angular-11.2.20@neverendingsupport/angular-forms@11.2.14-angular-11.2.20@neverendingsupport/angular-language-service@11.2.14-angular-11.2.20@neverendingsupport/angular-localize@11.2.14-angular-11.2.20@neverendingsupport/angular-platform-browser@11.2.14-angular-11.2.20@neverendingsupport/angular-platform-browser-dynamic@11.2.14-angular-11.2.20@neverendingsupport/angular-platform-server@11.2.14-angular-11.2.20@neverendingsupport/angular-router@11.2.14-angular-11.2.20@neverendingsupport/angular-service-worker@11.2.14-angular-11.2.20@neverendingsupport/angular-upgrade@11.2.14-angular-11.2.20
v11.2.19 - February 6, 2025
Notes
- This release contains no functional changes from NES v11.2.17.
- This release contains only metadata fixes and improvements: Updated licensing information.
- Full Version:
11.2.14-{PACKAGE_NAME}-11.2.19
v11.2.18 - February 6, 2025
Notes
- This release contains no functional changes from NES v11.2.17.
- This release contains only metadata fixes and improvements: Updated
package.jsonfiles. - Full Version:
11.2.14-{PACKAGE_NAME}-11.2.18
v11.2.17 - January 29, 2025
Notes
- This release contains no functional changes from NES v11.2.16.
- This release contains only metadata fixes and improvements: Updated peer dependency versions.
- Full Version:
11.2.14-{PACKAGE_NAME}-11.2.17
v11.2.16 - January 29, 2025
Notes
- This release contains no functional changes from NES v11.2.15.
- This release contains only metadata fixes and improvements: Updated peer dependency versions.
- Full Version:
11.2.16-{PACKAGE_NAME}
v11.2.15 - February 8, 2024
Notes
- Full Version:
11.2.15-{PACKAGE_NAME}
Security Fixes
- compiler:
- Do not unquote CSS values.
- core:
- Do not use
Functionconstructors in development mode to avoid CSP violations. - Set style property value to empty string instead of an invalid value.
- Harden attribute and property binding rules for
iframeelements.
- Do not use
Angular CLI
11.2.23 (NES) - September 2025
Notes
- Full package name(s) and version(s):
@neverendingsupport/angular-cli@11.2.19-angular-cli-11.2.23@neverendingsupport/angular-pwa@0.1102.19-angular-cli-11.2.23@neverendingsupport/angular-devkit-architect@0.1102.19-angular-cli-11.2.23@neverendingsupport/angular-devkit-architect-cli@0.1102.19-angular-cli-11.2.23@neverendingsupport/angular-devkit-build-angular@0.1102.19-angular-cli-11.2.23@neverendingsupport/angular-devkit-build-optimizer@0.1102.19-angular-cli-11.2.23@neverendingsupport/angular-devkit-build-webpack@0.1102.19-angular-cli-11.2.23@neverendingsupport/angular-devkit-core@11.2.19-angular-cli-11.2.23@neverendingsupport/angular-devkit-schematics@11.2.19-angular-cli-11.2.23@neverendingsupport/angular-devkit-schematics-cli@0.1102.19-angular-cli-11.2.23@neverendingsupport/ngtools-webpack@11.2.19-angular-cli-11.2.23
Bug Fixes
- Fixed build issues: updated peer dependency version numbers
11.2.22 (NES) - June 5, 2025
Notes
- This release contains no functional changes from 11.2.21.
- Full package name(s) and version(s):
@neverendingsupport/angular-cli@11.2.19-angular-cli-11.2.22@neverendingsupport/angular-pwa@0.1102.19-angular-cli-11.2.22@neverendingsupport/angular-devkit-architect@0.1102.19-angular-cli-11.2.22@neverendingsupport/angular-devkit-architect-cli@0.1102.19-angular-cli-11.2.22@neverendingsupport/angular-devkit-build-angular@0.1102.19-angular-cli-11.2.22@neverendingsupport/angular-devkit-build-optimizer@0.1102.19-angular-cli-11.2.22@neverendingsupport/angular-devkit-build-webpack@0.1102.19-angular-cli-11.2.22@neverendingsupport/angular-devkit-core@11.2.19-angular-cli-11.2.22@neverendingsupport/angular-devkit-schematics@11.2.19-angular-cli-11.2.22@neverendingsupport/angular-devkit-schematics-cli@0.1102.19-angular-cli-11.2.22@neverendingsupport/ngtools-webpack@11.2.19-angular-cli-11.2.22
11.2.21 (NES) - February 28, 2025
Security
- Bumped
loader-utilsto v2.0.4 to address CVE-2022-37601.
11.2.20 (NES) - February 26, 2025
Notes
- This is the initial release of the NES Angular CLI 11.2.x series.