Visit Angular NES Home Page
Angular 16
Comprehensive release notes and changelog for Angular 16, including security patches, bug fixes, and feature updates across all supported versions.
6 Patched Vulnerabilities
VEX Statements
Angular
v16.2.21 - March 9, 2026
Notes
- Full package name(s) and version(s):
@neverendingsupport/angular-animations@16.2.12-angular-16.2.21@neverendingsupport/angular-common@16.2.12-angular-16.2.21@neverendingsupport/angular-compiler@16.2.12-angular-16.2.21@neverendingsupport/angular-compiler-cli@16.2.12-angular-16.2.21@neverendingsupport/angular-core@16.2.12-angular-16.2.21@neverendingsupport/angular-elements@16.2.12-angular-16.2.21@neverendingsupport/angular-forms@16.2.12-angular-16.2.21@neverendingsupport/angular-language-service@16.2.12-angular-16.2.21@neverendingsupport/angular-localize@16.2.12-angular-16.2.21@neverendingsupport/angular-platform-browser@16.2.12-angular-16.2.21@neverendingsupport/angular-platform-browser-dynamic@16.2.12-angular-16.2.21@neverendingsupport/angular-platform-server@16.2.12-angular-16.2.21@neverendingsupport/angular-router@16.2.12-angular-16.2.21@neverendingsupport/angular-service-worker@16.2.12-angular-16.2.21@neverendingsupport/angular-upgrade@16.2.12-angular-16.2.21
Security Fixes
- core: Block creation of sensitive URI attributes from ICU messages.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-27970).
Breaking Changes
core
- Block creation of sensitive URI attributes from ICU messages:
Translators can no longer introduce URI attributes—attribute values are blocked to avoid malicious links, and sanitization now relies on an allowlist of known attributes (still sanitizing URI ones). Translated ICU content keeps only recognized attributes and drops everything else.
v16.2.20 - January 22, 2026
Notes
- Full package name(s) and version(s):
@neverendingsupport/angular-animations@16.2.12-angular-16.2.20@neverendingsupport/angular-common@16.2.12-angular-16.2.20@neverendingsupport/angular-compiler@16.2.12-angular-16.2.20@neverendingsupport/angular-compiler-cli@16.2.12-angular-16.2.20@neverendingsupport/angular-core@16.2.12-angular-16.2.20@neverendingsupport/angular-elements@16.2.12-angular-16.2.20@neverendingsupport/angular-forms@16.2.12-angular-16.2.20@neverendingsupport/angular-language-service@16.2.12-angular-16.2.20@neverendingsupport/angular-localize@16.2.12-angular-16.2.20@neverendingsupport/angular-platform-browser@16.2.12-angular-16.2.20@neverendingsupport/angular-platform-browser-dynamic@16.2.12-angular-16.2.20@neverendingsupport/angular-platform-server@16.2.12-angular-16.2.20@neverendingsupport/angular-router@16.2.12-angular-16.2.20@neverendingsupport/angular-service-worker@16.2.12-angular-16.2.20@neverendingsupport/angular-upgrade@16.2.12-angular-16.2.20
Security Fixes
- core: Sanitize sensitive attributes on SVG script elements.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-22610).
v16.2.19 - December 15, 2025
Notes
- Full package name(s) and version(s):
@neverendingsupport/angular-animations@16.2.12-angular-16.2.19@neverendingsupport/angular-common@16.2.12-angular-16.2.19@neverendingsupport/angular-compiler@16.2.12-angular-16.2.19@neverendingsupport/angular-compiler-cli@16.2.12-angular-16.2.19@neverendingsupport/angular-core@16.2.12-angular-16.2.19@neverendingsupport/angular-elements@16.2.12-angular-16.2.19@neverendingsupport/angular-forms@16.2.12-angular-16.2.19@neverendingsupport/angular-language-service@16.2.12-angular-16.2.19@neverendingsupport/angular-localize@16.2.12-angular-16.2.19@neverendingsupport/angular-platform-browser@16.2.12-angular-16.2.19@neverendingsupport/angular-platform-browser-dynamic@16.2.12-angular-16.2.19@neverendingsupport/angular-platform-server@16.2.12-angular-16.2.19@neverendingsupport/angular-router@16.2.12-angular-16.2.19@neverendingsupport/angular-service-worker@16.2.12-angular-16.2.19@neverendingsupport/angular-upgrade@16.2.12-angular-16.2.19
Security Fixes
- compiler: Prevent stored XSS via SVG animation
attributeNameand MathML/SVG URLs.- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2025-66412).
v16.2.18 - December 1, 2025
Notes
- Full package name(s) and version(s):
@neverendingsupport/angular-animations@16.2.12-angular-16.2.18@neverendingsupport/angular-common@16.2.12-angular-16.2.18@neverendingsupport/angular-compiler@16.2.12-angular-16.2.18@neverendingsupport/angular-compiler-cli@16.2.12-angular-16.2.18@neverendingsupport/angular-core@16.2.12-angular-16.2.18@neverendingsupport/angular-elements@16.2.12-angular-16.2.18@neverendingsupport/angular-forms@16.2.12-angular-16.2.18@neverendingsupport/angular-language-service@16.2.12-angular-16.2.18@neverendingsupport/angular-localize@16.2.12-angular-16.2.18@neverendingsupport/angular-platform-browser@16.2.12-angular-16.2.18@neverendingsupport/angular-platform-browser-dynamic@16.2.12-angular-16.2.18@neverendingsupport/angular-platform-server@16.2.12-angular-16.2.18@neverendingsupport/angular-router@16.2.12-angular-16.2.18@neverendingsupport/angular-service-worker@16.2.12-angular-16.2.18@neverendingsupport/angular-upgrade@16.2.12-angular-16.2.18
Security Fixes
- common: Prevent Cross-Site Request Forgery (XSRF) token leakage to protocol-relative URLs.
- This fixes a high-severity Information Exposure vulnerability (CVE-2025-66035).
v16.2.17 - October 10, 2025
Notes
- Full package name(s) and version(s):
@neverendingsupport/angular-animations@16.2.12-angular-16.2.17@neverendingsupport/angular-common@16.2.12-angular-16.2.17@neverendingsupport/angular-compiler@16.2.12-angular-16.2.17@neverendingsupport/angular-compiler-cli@16.2.12-angular-16.2.17@neverendingsupport/angular-core@16.2.12-angular-16.2.17@neverendingsupport/angular-elements@16.2.12-angular-16.2.17@neverendingsupport/angular-forms@16.2.12-angular-16.2.17@neverendingsupport/angular-language-service@16.2.12-angular-16.2.17@neverendingsupport/angular-localize@16.2.12-angular-16.2.17@neverendingsupport/angular-platform-browser@16.2.12-angular-16.2.17@neverendingsupport/angular-platform-browser-dynamic@16.2.12-angular-16.2.17@neverendingsupport/angular-platform-server@16.2.12-angular-16.2.17@neverendingsupport/angular-router@16.2.12-angular-16.2.17@neverendingsupport/angular-service-worker@16.2.12-angular-16.2.17@neverendingsupport/angular-upgrade@16.2.12-angular-16.2.17
Security Fixes
- core: Introduce
BootstrapContextfor improved server bootstrapping.- This fixes a high-severity Information Exposure vulnerability (CVE-2025-59052).
Breaking Changes
core
- Introduce
BootstrapContextfor improved server bootstrapping:
The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector and avoid potential exposure of sensitive data from other sessions.
In addition,getPlatform()anddestroyPlatform()will now returnnulland be a no-op respectively, when running in a server environment.
Before:const bootstrap = () => bootstrapApplication(AppComponent, config);
After:const bootstrap = (context: BootstrapContext) => bootstrapApplication(AppComponent, config, context);
v16.2.16 - June 16, 2025
Notes
- This release contains no functional changes from NES v16.2.15.
- This release implements a new package naming scheme for the Angular packages. More information about the change can be found in the NES Decoupled Namespace Specification.
- Full package name(s) and version(s):
@neverendingsupport/angular-animations@16.2.12-angular-16.2.16@neverendingsupport/angular-common@16.2.12-angular-16.2.16@neverendingsupport/angular-compiler@16.2.12-angular-16.2.16@neverendingsupport/angular-compiler-cli@16.2.12-angular-16.2.16@neverendingsupport/angular-core@16.2.12-angular-16.2.16@neverendingsupport/angular-elements@16.2.12-angular-16.2.16@neverendingsupport/angular-forms@16.2.12-angular-16.2.16@neverendingsupport/angular-language-service@16.2.12-angular-16.2.16@neverendingsupport/angular-localize@16.2.12-angular-16.2.16@neverendingsupport/angular-platform-browser@16.2.12-angular-16.2.16@neverendingsupport/angular-platform-browser-dynamic@16.2.12-angular-16.2.16@neverendingsupport/angular-platform-server@16.2.12-angular-16.2.16@neverendingsupport/angular-router@16.2.12-angular-16.2.16@neverendingsupport/angular-service-worker@16.2.12-angular-16.2.16@neverendingsupport/angular-upgrade@16.2.12-angular-16.2.16
v16.2.15 - January 30, 2025
Notes
- This release contains no functional changes from NES v16.2.14.
- This release contains only metadata fixes and improvements: Updated licensing information.
- Full Version:
16.2.12-{PACKAGE_NAME}-16.2.15
v16.2.14 - January 7, 2025
Notes
- This release contains only metadata fixes and improvements.
- Full Version:
16.2.12-{PACKAGE_NAME}-16.2.14
v16.2.12 - January 7, 2025
Notes
- This release contains no functional change from the OSS Angular v16.2.12.
- This release mainlines OSS v16.2.12 into NES v16.2.12.
- Full Version:
16.2.12-{PACKAGE_NAME}
Angular CLI
16.2.19 (NES) - September, 2025
Notes
- Full package names and versions:
@neverendingsupport/angular-cli@16.2.16-angular-cli-16.2.19@neverendingsupport/angular-create@16.2.16-angular-cli-16.2.19@neverendingsupport/angular-pwa@16.2.16-angular-cli-16.2.19@neverendingsupport/angular-devkit-architect@0.1602.16-angular-cli-16.2.19@neverendingsupport/angular-devkit-architect-cli@0.1602.16-angular-cli-16.2.19@neverendingsupport/angular-devkit-build-angular@16.2.16-angular-cli-16.2.19@neverendingsupport/angular-devkit-build-webpack@0.1602.16-angular-cli-16.2.19@neverendingsupport/angular-devkit-core@16.2.16-angular-cli-16.2.19@neverendingsupport/angular-devkit-schematics@16.2.16-angular-cli-16.2.19@neverendingsupport/angular-devkit-schematics-cli@16.2.16-angular-cli-16.2.19@neverendingsupport/ngtools-webpack@16.2.16-angular-cli-16.2.19
Bug Fixes
- Fixed build issues: updated peer dependency version numbers
16.2.18 (NES) - June 5, 2025
Notes
- This release contains no functional changes from NES v16.2.17.
- Full package names and versions:
@neverendingsupport/angular-cli@16.2.16-angular-cli-16.2.18@neverendingsupport/angular-create@16.2.16-angular-cli-16.2.18@neverendingsupport/angular-pwa@16.2.16-angular-cli-16.2.18@neverendingsupport/angular-devkit-architect@0.1602.16-angular-cli-16.2.18@neverendingsupport/angular-devkit-architect-cli@0.1602.16-angular-cli-16.2.18@neverendingsupport/angular-devkit-build-angular@16.2.16-angular-cli-16.2.18@neverendingsupport/angular-devkit-build-webpack@0.1602.16-angular-cli-16.2.18@neverendingsupport/angular-devkit-core@16.2.16-angular-cli-16.2.18@neverendingsupport/angular-devkit-schematics@16.2.16-angular-cli-16.2.18@neverendingsupport/angular-devkit-schematics-cli@16.2.16-angular-cli-16.2.18@neverendingsupport/ngtools-webpack@16.2.16-angular-cli-16.2.18
16.2.17 (NES) - February 25, 2025
Notes
- This is the initial release of the NES Angular CLI 16.2.x series.
Angular Universal
16.2.1 (NES) - October, 2025
Notes
- This is the initial release of NES for Angular Universal based on the OSS universal v16.2.0.
- Full package names and versions:
@neverendingsupport/nguniversal-builders@16.2.0-universal-16.2.1@neverendingsupport/nguniversal-common@16.2.0-universal-16.2.1@neverendingsupport/nguniversal-express-engine@16.2.0-universal-16.2.1
Breaking Changes
- The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
- This fixes a high-severity Information Exposure vulnerability (CVE-2025-59052).
Before:const bootstrap = () => bootstrapApplication(AppComponent, config);
After:const bootstrap = (context: BootstrapContext) => bootstrapApplication(AppComponent, config, context);