Angular 19

Comprehensive release notes and changelog for Angular 19, including security patches, bug fixes, and feature updates across all supported versions.

20 Patched Vulnerabilities

VEX Statements

Angular Core

v19.2.27 - July 8, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@19.2.25-angular-19.2.27
- @neverendingsupport/angular-common@19.2.25-angular-19.2.27
- @neverendingsupport/angular-compiler@19.2.25-angular-19.2.27
- @neverendingsupport/angular-compiler-cli@19.2.25-angular-19.2.27
- @neverendingsupport/angular-core@19.2.25-angular-19.2.27
- @neverendingsupport/angular-elements@19.2.25-angular-19.2.27
- @neverendingsupport/angular-forms@19.2.25-angular-19.2.27
- @neverendingsupport/angular-language-service@19.2.25-angular-19.2.27
- @neverendingsupport/angular-localize@19.2.25-angular-19.2.27
- @neverendingsupport/angular-platform-browser@19.2.25-angular-19.2.27
- @neverendingsupport/angular-platform-browser-dynamic@19.2.25-angular-19.2.27
- @neverendingsupport/angular-platform-server@19.2.25-angular-19.2.27
- @neverendingsupport/angular-router@19.2.25-angular-19.2.27
- @neverendingsupport/angular-service-worker@19.2.25-angular-19.2.27
- @neverendingsupport/angular-upgrade@19.2.25-angular-19.2.27

Security Fixes

service-worker: Strip sensitive headers on cross-origin redirects.
- This fixes a high-severity Information Exposure vulnerability (CVE-2026-54264).

v19.2.26 - June 15, 2026

Notes

This release contains no functional change from the OSS Angular v19.2.25.
This release mainlines OSS v19.2.25 into NES v19.2.26.
Full package name(s) and version(s):
- @neverendingsupport/angular-animations@19.2.25-angular-19.2.26
- @neverendingsupport/angular-common@19.2.25-angular-19.2.26
- @neverendingsupport/angular-compiler@19.2.25-angular-19.2.26
- @neverendingsupport/angular-compiler-cli@19.2.25-angular-19.2.26
- @neverendingsupport/angular-core@19.2.25-angular-19.2.26
- @neverendingsupport/angular-elements@19.2.25-angular-19.2.26
- @neverendingsupport/angular-forms@19.2.25-angular-19.2.26
- @neverendingsupport/angular-language-service@19.2.25-angular-19.2.26
- @neverendingsupport/angular-localize@19.2.25-angular-19.2.26
- @neverendingsupport/angular-platform-browser@19.2.25-angular-19.2.26
- @neverendingsupport/angular-platform-browser-dynamic@19.2.25-angular-19.2.26
- @neverendingsupport/angular-platform-server@19.2.25-angular-19.2.26
- @neverendingsupport/angular-router@19.2.25-angular-19.2.26
- @neverendingsupport/angular-service-worker@19.2.25-angular-19.2.26
- @neverendingsupport/angular-upgrade@19.2.25-angular-19.2.26

Security Fixes

common:
- Skip the HTTP TransferCache for cookie-bearing requests by default, and exclude withCredentials requests from the transfer cache.
  - This fixes a high-severity Information Exposure vulnerability (CVE-2026-50170).
- Add upper bounds for digitsInfo to prevent roundNumber from allocating a large array.
  - This fixes a high-severity Denial of Service (DoS) vulnerability (CVE-2026-50171).
compiler:
- Strip namespaced SVG script elements during template compilation.
  - This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
core:
- Reject script element as a dynamic component host.
  - This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-52725).
- Strip namespaced SVG script elements during template compilation.
  - This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
platform-server:
- Update the domino dependency to fix closing-tag escaping bugs in its server-side rendering serializer.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50555).
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50556).
- Reject untrusted request URLs that bypass the allowedHosts allowlist.
  - This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-50168).
service-worker:
- Preserve redirect policy on reconstructed asset requests.
  - This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50169).
- Preserve explicit credentials: 'omit' and HTTP cache mode in asset group requests.
  - This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50184).

v19.2.23 - June 3, 2026

Notes

This release contains no functional change from the OSS Angular v19.2.22.
This release mainlines OSS v19.2.22 into NES v19.2.23.
Full package name(s) and version(s):
- @neverendingsupport/angular-animations@19.2.22-angular-19.2.23
- @neverendingsupport/angular-common@19.2.22-angular-19.2.23
- @neverendingsupport/angular-compiler@19.2.22-angular-19.2.23
- @neverendingsupport/angular-compiler-cli@19.2.22-angular-19.2.23
- @neverendingsupport/angular-core@19.2.22-angular-19.2.23
- @neverendingsupport/angular-elements@19.2.22-angular-19.2.23
- @neverendingsupport/angular-forms@19.2.22-angular-19.2.23
- @neverendingsupport/angular-language-service@19.2.22-angular-19.2.23
- @neverendingsupport/angular-localize@19.2.22-angular-19.2.23
- @neverendingsupport/angular-platform-browser@19.2.22-angular-19.2.23
- @neverendingsupport/angular-platform-browser-dynamic@19.2.22-angular-19.2.23
- @neverendingsupport/angular-platform-server@19.2.22-angular-19.2.23
- @neverendingsupport/angular-router@19.2.22-angular-19.2.23
- @neverendingsupport/angular-service-worker@19.2.22-angular-19.2.23
- @neverendingsupport/angular-upgrade@19.2.22-angular-19.2.23

Security Fixes

platform-server: Add allowedHosts option to renderModule and renderApplication.
- This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-46417).

v19.2.22 - April 21, 2026

Notes

This release contains no functional change from the OSS Angular v19.2.21.
This release mainlines OSS v19.2.21 into NES v19.2.22.
Full package name(s) and version(s):
- @neverendingsupport/angular-animations@19.2.21-angular-19.2.22
- @neverendingsupport/angular-common@19.2.21-angular-19.2.22
- @neverendingsupport/angular-compiler@19.2.21-angular-19.2.22
- @neverendingsupport/angular-compiler-cli@19.2.21-angular-19.2.22
- @neverendingsupport/angular-core@19.2.21-angular-19.2.22
- @neverendingsupport/angular-elements@19.2.21-angular-19.2.22
- @neverendingsupport/angular-forms@19.2.21-angular-19.2.22
- @neverendingsupport/angular-language-service@19.2.21-angular-19.2.22
- @neverendingsupport/angular-localize@19.2.21-angular-19.2.22
- @neverendingsupport/angular-platform-browser@19.2.21-angular-19.2.22
- @neverendingsupport/angular-platform-browser-dynamic@19.2.21-angular-19.2.22
- @neverendingsupport/angular-platform-server@19.2.21-angular-19.2.22
- @neverendingsupport/angular-router@19.2.21-angular-19.2.22
- @neverendingsupport/angular-service-worker@19.2.21-angular-19.2.22
- @neverendingsupport/angular-upgrade@19.2.21-angular-19.2.22

Security Fixes

platform-server: Prevent SSRF bypasses via protocol-relative and backslash URLs.
- This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-41423).

v19.2.21 - March 27, 2026

Notes

This release contains no functional change from the OSS Angular v19.2.20.
This release mainlines OSS v19.2.20 into NES v19.2.21.
Full package name(s) and version(s):
- @neverendingsupport/angular-animations@19.2.20-angular-19.2.21
- @neverendingsupport/angular-common@19.2.20-angular-19.2.21
- @neverendingsupport/angular-compiler@19.2.20-angular-19.2.21
- @neverendingsupport/angular-compiler-cli@19.2.20-angular-19.2.21
- @neverendingsupport/angular-core@19.2.20-angular-19.2.21
- @neverendingsupport/angular-elements@19.2.20-angular-19.2.21
- @neverendingsupport/angular-forms@19.2.20-angular-19.2.21
- @neverendingsupport/angular-language-service@19.2.20-angular-19.2.21
- @neverendingsupport/angular-localize@19.2.20-angular-19.2.21
- @neverendingsupport/angular-platform-browser@19.2.20-angular-19.2.21
- @neverendingsupport/angular-platform-browser-dynamic@19.2.20-angular-19.2.21
- @neverendingsupport/angular-platform-server@19.2.20-angular-19.2.21
- @neverendingsupport/angular-router@19.2.20-angular-19.2.21
- @neverendingsupport/angular-service-worker@19.2.20-angular-19.2.21
- @neverendingsupport/angular-upgrade@19.2.20-angular-19.2.21

Security Fixes

core: Sanitize translated form attributes and attribute bindings with interpolations.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-32635).
compiler: Disallow translations of src attributes in iframes.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-32635).

v19.2.20 - March 13, 2026

Notes

This release contains no functional change from the OSS Angular v19.2.19.
This release mainlines OSS v19.2.19 into NES v19.2.20.
Full package name(s) and version(s):
- @neverendingsupport/angular-animations@19.2.19-angular-19.2.20
- @neverendingsupport/angular-common@19.2.19-angular-19.2.20
- @neverendingsupport/angular-compiler@19.2.19-angular-19.2.20
- @neverendingsupport/angular-compiler-cli@19.2.19-angular-19.2.20
- @neverendingsupport/angular-core@19.2.19-angular-19.2.20
- @neverendingsupport/angular-elements@19.2.19-angular-19.2.20
- @neverendingsupport/angular-forms@19.2.19-angular-19.2.20
- @neverendingsupport/angular-language-service@19.2.19-angular-19.2.20
- @neverendingsupport/angular-localize@19.2.19-angular-19.2.20
- @neverendingsupport/angular-platform-browser@19.2.19-angular-19.2.20
- @neverendingsupport/angular-platform-browser-dynamic@19.2.19-angular-19.2.20
- @neverendingsupport/angular-platform-server@19.2.19-angular-19.2.20
- @neverendingsupport/angular-router@19.2.19-angular-19.2.20
- @neverendingsupport/angular-service-worker@19.2.19-angular-19.2.20
- @neverendingsupport/angular-upgrade@19.2.19-angular-19.2.20

Security Fixes

core: Block creation of sensitive URI attributes from ICU messages.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-27970).

Breaking Changes

core

Block creation of sensitive URI attributes from ICU messages:
Translators can no longer introduce URI attributes—attribute values are blocked to avoid malicious links, and sanitization now relies on an allowlist of known attributes (still sanitizing URI ones). Translated ICU content keeps only recognized attributes and drops everything else.

v19.2.19 - January 27, 2026

Notes

This release contains no functional change from the OSS Angular v19.2.18.
This release mainlines OSS v19.2.18 into NES v19.2.19.
Full package name(s) and version(s):
- @neverendingsupport/angular-animations@19.2.18-angular-19.2.19
- @neverendingsupport/angular-common@19.2.18-angular-19.2.19
- @neverendingsupport/angular-compiler@19.2.18-angular-19.2.19
- @neverendingsupport/angular-compiler-cli@19.2.18-angular-19.2.19
- @neverendingsupport/angular-core@19.2.18-angular-19.2.19
- @neverendingsupport/angular-elements@19.2.18-angular-19.2.19
- @neverendingsupport/angular-forms@19.2.18-angular-19.2.19
- @neverendingsupport/angular-language-service@19.2.18-angular-19.2.19
- @neverendingsupport/angular-localize@19.2.18-angular-19.2.19
- @neverendingsupport/angular-platform-browser@19.2.18-angular-19.2.19
- @neverendingsupport/angular-platform-browser-dynamic@19.2.18-angular-19.2.19
- @neverendingsupport/angular-platform-server@19.2.18-angular-19.2.19
- @neverendingsupport/angular-router@19.2.18-angular-19.2.19
- @neverendingsupport/angular-service-worker@19.2.18-angular-19.2.19
- @neverendingsupport/angular-upgrade@19.2.18-angular-19.2.19

Angular CLI

v19.2.29 - June 24, 2026

Notes

This release contains no functional change from the NES v19.2.28.
This release contains only metadata fixes and improvements: Fixed peer-dependency versions.
Full package name(s) and version(s):
- @neverendingsupport/angular-build@19.2.27-angular-cli-19.2.29
- @neverendingsupport/angular-cli@19.2.27-angular-cli-19.2.29
- @neverendingsupport/angular-create@19.2.27-angular-cli-19.2.29
- @neverendingsupport/angular-pwa@19.2.27-angular-cli-19.2.29
- @neverendingsupport/angular-ssr@19.2.27-angular-cli-19.2.29
- @neverendingsupport/angular-devkit-architect@0.1902.27-angular-cli-19.2.29
- @neverendingsupport/angular-devkit-architect-cli@0.1902.27-angular-cli-19.2.29
- @neverendingsupport/angular-devkit-build-angular@19.2.27-angular-cli-19.2.29
- @neverendingsupport/angular-devkit-build-webpack@0.1902.27-angular-cli-19.2.29
- @neverendingsupport/angular-devkit-core@19.2.27-angular-cli-19.2.29
- @neverendingsupport/angular-devkit-schematics@19.2.27-angular-cli-19.2.29
- @neverendingsupport/angular-devkit-schematics-cli@19.2.27-angular-cli-19.2.29
- @neverendingsupport/ngtools-webpack@19.2.27-angular-cli-19.2.29

v19.2.28 - June 16, 2026

Notes

This release contains no functional change from the OSS Angular CLI v19.2.27.
This release mainlines OSS v19.2.27 into NES v19.2.28.
Full package name(s) and version(s):
- @neverendingsupport/angular-build@19.2.27-angular-cli-19.2.28
- @neverendingsupport/angular-cli@19.2.27-angular-cli-19.2.28
- @neverendingsupport/angular-create@19.2.27-angular-cli-19.2.28
- @neverendingsupport/angular-pwa@19.2.27-angular-cli-19.2.28
- @neverendingsupport/angular-ssr@19.2.27-angular-cli-19.2.28
- @neverendingsupport/angular-devkit-architect@0.1902.27-angular-cli-19.2.28
- @neverendingsupport/angular-devkit-architect-cli@0.1902.27-angular-cli-19.2.28
- @neverendingsupport/angular-devkit-build-angular@19.2.27-angular-cli-19.2.28
- @neverendingsupport/angular-devkit-build-webpack@0.1902.27-angular-cli-19.2.28
- @neverendingsupport/angular-devkit-core@19.2.27-angular-cli-19.2.28
- @neverendingsupport/angular-devkit-schematics@19.2.27-angular-cli-19.2.28
- @neverendingsupport/angular-devkit-schematics-cli@19.2.27-angular-cli-19.2.28
- @neverendingsupport/ngtools-webpack@19.2.27-angular-cli-19.2.28

Compatibility Fixes

ssr: Add support for configuring trusted proxy headers via environment variable to align with upstream Angular v19.2.26 proxy header handling changes.

v19.2.27 - June 3, 2026

Notes

This release contains no functional change from the OSS Angular CLI v19.2.26.
This release mainlines OSS v19.2.26 into NES v19.2.27.
Full package name(s) and version(s):
- @neverendingsupport/angular-build@19.2.26-angular-cli-19.2.27
- @neverendingsupport/angular-cli@19.2.26-angular-cli-19.2.27
- @neverendingsupport/angular-create@19.2.26-angular-cli-19.2.27
- @neverendingsupport/angular-pwa@19.2.26-angular-cli-19.2.27
- @neverendingsupport/angular-ssr@19.2.26-angular-cli-19.2.27
- @neverendingsupport/angular-devkit-architect@0.1902.26-angular-cli-19.2.27
- @neverendingsupport/angular-devkit-architect-cli@0.1902.26-angular-cli-19.2.27
- @neverendingsupport/angular-devkit-build-angular@19.2.26-angular-cli-19.2.27
- @neverendingsupport/angular-devkit-build-webpack@0.1902.26-angular-cli-19.2.27
- @neverendingsupport/angular-devkit-core@19.2.26-angular-cli-19.2.27
- @neverendingsupport/angular-devkit-schematics@19.2.26-angular-cli-19.2.27
- @neverendingsupport/angular-devkit-schematics-cli@19.2.26-angular-cli-19.2.27
- @neverendingsupport/ngtools-webpack@19.2.26-angular-cli-19.2.27

Compatibility Fixes

ssr: Allow all hosts in common engine rendering options to prevent validation errors caused by upstream Angular v19.2.23 host validation changes.

v19.2.26 - May 8, 2026

Notes

This release contains no functional change from the OSS Angular CLI v19.2.25.
This release mainlines OSS v19.2.25 into NES v19.2.26.
Full package name(s) and version(s):
- @neverendingsupport/angular-build@19.2.25-angular-cli-19.2.26
- @neverendingsupport/angular-cli@19.2.25-angular-cli-19.2.26
- @neverendingsupport/angular-create@19.2.25-angular-cli-19.2.26
- @neverendingsupport/angular-pwa@19.2.25-angular-cli-19.2.26
- @neverendingsupport/angular-ssr@19.2.25-angular-cli-19.2.26
- @neverendingsupport/angular-devkit-architect@0.1902.25-angular-cli-19.2.26
- @neverendingsupport/angular-devkit-architect-cli@0.1902.25-angular-cli-19.2.26
- @neverendingsupport/angular-devkit-build-angular@19.2.25-angular-cli-19.2.26
- @neverendingsupport/angular-devkit-build-webpack@0.1902.25-angular-cli-19.2.26
- @neverendingsupport/angular-devkit-core@19.2.25-angular-cli-19.2.26
- @neverendingsupport/angular-devkit-schematics@19.2.25-angular-cli-19.2.26
- @neverendingsupport/angular-devkit-schematics-cli@19.2.25-angular-cli-19.2.26
- @neverendingsupport/ngtools-webpack@19.2.25-angular-cli-19.2.26

Security Fixes

ssr: Introduce trustProxyHeaders option to safely validate and sanitize proxy headers.
- This fixes a medium-severity Open Redirect vulnerability (CVE-2026-44437).

v19.2.25 - April 22, 2026

Notes

This release contains no functional change from the OSS Angular CLI v19.2.24.
This release mainlines OSS v19.2.24 into NES v19.2.25.
Full package name(s) and version(s):
- @neverendingsupport/angular-build@19.2.24-angular-cli-19.2.25
- @neverendingsupport/angular-cli@19.2.24-angular-cli-19.2.25
- @neverendingsupport/angular-create@19.2.24-angular-cli-19.2.25
- @neverendingsupport/angular-pwa@19.2.24-angular-cli-19.2.25
- @neverendingsupport/angular-ssr@19.2.24-angular-cli-19.2.25
- @neverendingsupport/angular-devkit-architect@0.1902.24-angular-cli-19.2.25
- @neverendingsupport/angular-devkit-architect-cli@0.1902.24-angular-cli-19.2.25
- @neverendingsupport/angular-devkit-build-angular@19.2.24-angular-cli-19.2.25
- @neverendingsupport/angular-devkit-build-webpack@0.1902.24-angular-cli-19.2.25
- @neverendingsupport/angular-devkit-core@19.2.24-angular-cli-19.2.25
- @neverendingsupport/angular-devkit-schematics@19.2.24-angular-cli-19.2.25
- @neverendingsupport/angular-devkit-schematics-cli@19.2.24-angular-cli-19.2.25
- @neverendingsupport/ngtools-webpack@19.2.24-angular-cli-19.2.25

Security Fixes

picomatch: Every instance of picomatch was updated to v4.0.4 to address CVE-2026-33671.

v19.2.23 - March 27, 2026

Notes

This release contains no functional change from the OSS Angular CLI v19.2.22.
This release mainlines OSS v19.2.22 into NES v19.2.23.
Full package name(s) and version(s):
- @neverendingsupport/angular-build@19.2.22-angular-cli-19.2.23
- @neverendingsupport/angular-cli@19.2.22-angular-cli-19.2.23
- @neverendingsupport/angular-create@19.2.22-angular-cli-19.2.23
- @neverendingsupport/angular-pwa@19.2.22-angular-cli-19.2.23
- @neverendingsupport/angular-ssr@19.2.22-angular-cli-19.2.23
- @neverendingsupport/angular-devkit-architect@0.1902.22-angular-cli-19.2.23
- @neverendingsupport/angular-devkit-architect-cli@0.1902.22-angular-cli-19.2.23
- @neverendingsupport/angular-devkit-build-angular@19.2.22-angular-cli-19.2.23
- @neverendingsupport/angular-devkit-build-webpack@0.1902.22-angular-cli-19.2.23
- @neverendingsupport/angular-devkit-core@19.2.22-angular-cli-19.2.23
- @neverendingsupport/angular-devkit-schematics@19.2.22-angular-cli-19.2.23
- @neverendingsupport/angular-devkit-schematics-cli@19.2.22-angular-cli-19.2.23
- @neverendingsupport/ngtools-webpack@19.2.22-angular-cli-19.2.23

Security Fixes

ssr: Prevent open redirect via X-Forwarded-Prefix header.
- This fixes a medium-severity Open Redirect vulnerability (CVE-2026-27738).
ssr: Validate host headers to prevent header-based SSRF.
- This fixes a critical-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-27739).

v19.2.20 - January 29, 2026

Notes

This release contains no functional change from the OSS Angular CLI v19.2.19.
This release mainlines OSS v19.2.19 into NES v19.2.20.
Full package name(s) and version(s):
- @neverendingsupport/angular-build@19.2.19-angular-cli-19.2.20
- @neverendingsupport/angular-cli@19.2.19-angular-cli-19.2.20
- @neverendingsupport/angular-create@19.2.19-angular-cli-19.2.20
- @neverendingsupport/angular-pwa@19.2.19-angular-cli-19.2.20
- @neverendingsupport/angular-ssr@19.2.19-angular-cli-19.2.20
- @neverendingsupport/angular-devkit-architect@0.1902.19-angular-cli-19.2.20
- @neverendingsupport/angular-devkit-architect-cli@0.1902.19-angular-cli-19.2.20
- @neverendingsupport/angular-devkit-build-angular@19.2.19-angular-cli-19.2.20
- @neverendingsupport/angular-devkit-build-webpack@0.1902.19-angular-cli-19.2.20
- @neverendingsupport/angular-devkit-core@19.2.19-angular-cli-19.2.20
- @neverendingsupport/angular-devkit-schematics@19.2.19-angular-cli-19.2.20
- @neverendingsupport/angular-devkit-schematics-cli@19.2.19-angular-cli-19.2.20
- @neverendingsupport/ngtools-webpack@19.2.19-angular-cli-19.2.20