HeroDevs
Visit Angular NES Home Page

Angular 4

Comprehensive release notes and changelog for Angular 4, including security patches, bug fixes, and feature updates across all supported versions.

8 Patched Vulnerabilities
VEX Statements

Angular

v4.4.16 - September 15, 2026

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@4.4.7-angular-4.4.16
    • @neverendingsupport/angular-common@4.4.7-angular-4.4.16
    • @neverendingsupport/angular-compiler@4.4.7-angular-4.4.16
    • @neverendingsupport/angular-compiler-cli@4.4.7-angular-4.4.16
    • @neverendingsupport/angular-core@4.4.7-angular-4.4.16
    • @neverendingsupport/angular-forms@4.4.7-angular-4.4.16
    • @neverendingsupport/angular-http@4.4.7-angular-4.4.16
    • @neverendingsupport/angular-language-service@4.4.7-angular-4.4.16
    • @neverendingsupport/angular-platform-browser@4.4.7-angular-4.4.16
    • @neverendingsupport/angular-platform-browser-dynamic@4.4.7-angular-4.4.16
    • @neverendingsupport/angular-platform-server@4.4.7-angular-4.4.16
    • @neverendingsupport/angular-platform-webworker@4.4.7-angular-4.4.16
    • @neverendingsupport/angular-platform-webworker-dynamic@4.4.7-angular-4.4.16
    • @neverendingsupport/angular-router@4.4.7-angular-4.4.16
    • @neverendingsupport/angular-tsc-wrapped@4.4.7-angular-4.4.16
    • @neverendingsupport/angular-upgrade@4.4.7-angular-4.4.16

Security Fixes

  • compiler:
    • Strip namespaced SVG script elements during template compilation.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
    • Sanitize dynamic href and xlink:href bindings on SVG elements.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
    • Normalize tag names with custom namespaces in DomElementSchemaRegistry.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
  • core:
    • Support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation.
    • Synchronize core sanitization schema with compiler.
    • Reject script element as a dynamic component host.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-52725).
    • Validate lowercase SVG animation attribute names.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-52725).

v4.4.15 - August 26, 2026

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@4.4.7-angular-4.4.15
    • @neverendingsupport/angular-common@4.4.7-angular-4.4.15
    • @neverendingsupport/angular-compiler@4.4.7-angular-4.4.15
    • @neverendingsupport/angular-compiler-cli@4.4.7-angular-4.4.15
    • @neverendingsupport/angular-core@4.4.7-angular-4.4.15
    • @neverendingsupport/angular-forms@4.4.7-angular-4.4.15
    • @neverendingsupport/angular-http@4.4.7-angular-4.4.15
    • @neverendingsupport/angular-language-service@4.4.7-angular-4.4.15
    • @neverendingsupport/angular-platform-browser@4.4.7-angular-4.4.15
    • @neverendingsupport/angular-platform-browser-dynamic@4.4.7-angular-4.4.15
    • @neverendingsupport/angular-platform-server@4.4.7-angular-4.4.15
    • @neverendingsupport/angular-platform-webworker@4.4.7-angular-4.4.15
    • @neverendingsupport/angular-platform-webworker-dynamic@4.4.7-angular-4.4.15
    • @neverendingsupport/angular-router@4.4.7-angular-4.4.15
    • @neverendingsupport/angular-tsc-wrapped@4.4.7-angular-4.4.15
    • @neverendingsupport/angular-upgrade@4.4.7-angular-4.4.15

Security Fixes

  • core:
    • Sanitize sensitive attributes on SVG script elements.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-22610).

v4.4.14 - August 18, 2026

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@4.4.7-angular-4.4.14
    • @neverendingsupport/angular-common@4.4.7-angular-4.4.14
    • @neverendingsupport/angular-compiler@4.4.7-angular-4.4.14
    • @neverendingsupport/angular-compiler-cli@4.4.7-angular-4.4.14
    • @neverendingsupport/angular-core@4.4.7-angular-4.4.14
    • @neverendingsupport/angular-forms@4.4.7-angular-4.4.14
    • @neverendingsupport/angular-http@4.4.7-angular-4.4.14
    • @neverendingsupport/angular-language-service@4.4.7-angular-4.4.14
    • @neverendingsupport/angular-platform-browser@4.4.7-angular-4.4.14
    • @neverendingsupport/angular-platform-browser-dynamic@4.4.7-angular-4.4.14
    • @neverendingsupport/angular-platform-server@4.4.7-angular-4.4.14
    • @neverendingsupport/angular-platform-webworker@4.4.7-angular-4.4.14
    • @neverendingsupport/angular-platform-webworker-dynamic@4.4.7-angular-4.4.14
    • @neverendingsupport/angular-router@4.4.7-angular-4.4.14
    • @neverendingsupport/angular-tsc-wrapped@4.4.7-angular-4.4.14
    • @neverendingsupport/angular-upgrade@4.4.7-angular-4.4.14

Security Fixes

  • common:
    • Limit date format string length to 256 characters.
      • This fixes a high-severity Denial of Service (DoS) vulnerability (CVE-2026-54268).
  • compiler:
    • Reject i18n translation of event-handler attributes on the View Engine path.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69151).

v4.4.13 - December 19, 2025

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@4.4.7-angular-4.4.13
    • @neverendingsupport/angular-common@4.4.7-angular-4.4.13
    • @neverendingsupport/angular-compiler@4.4.7-angular-4.4.13
    • @neverendingsupport/angular-compiler-cli@4.4.7-angular-4.4.13
    • @neverendingsupport/angular-core@4.4.7-angular-4.4.13
    • @neverendingsupport/angular-forms@4.4.7-angular-4.4.13
    • @neverendingsupport/angular-http@4.4.7-angular-4.4.13
    • @neverendingsupport/angular-language-service@4.4.7-angular-4.4.13
    • @neverendingsupport/angular-platform-browser@4.4.7-angular-4.4.13
    • @neverendingsupport/angular-platform-browser-dynamic@4.4.7-angular-4.4.13
    • @neverendingsupport/angular-platform-server@4.4.7-angular-4.4.13
    • @neverendingsupport/angular-platform-webworker@4.4.7-angular-4.4.13
    • @neverendingsupport/angular-platform-webworker-dynamic@4.4.7-angular-4.4.13
    • @neverendingsupport/angular-router@4.4.7-angular-4.4.13
    • @neverendingsupport/angular-tsc-wrapped@4.4.7-angular-4.4.13
    • @neverendingsupport/angular-upgrade@4.4.7-angular-4.4.13

Security Fixes

  • compiler:
    • Prevent stored XSS via SVG animation attributeName and MathML/SVG URLs.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2025-66412).

v4.4.12 - December 10, 2025

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@4.4.7-angular-4.4.12
    • @neverendingsupport/angular-common@4.4.7-angular-4.4.12
    • @neverendingsupport/angular-compiler@4.4.7-angular-4.4.12
    • @neverendingsupport/angular-compiler-cli@4.4.7-angular-4.4.12
    • @neverendingsupport/angular-core@4.4.7-angular-4.4.12
    • @neverendingsupport/angular-forms@4.4.7-angular-4.4.12
    • @neverendingsupport/angular-http@4.4.7-angular-4.4.12
    • @neverendingsupport/angular-language-service@4.4.7-angular-4.4.12
    • @neverendingsupport/angular-platform-browser@4.4.7-angular-4.4.12
    • @neverendingsupport/angular-platform-browser-dynamic@4.4.7-angular-4.4.12
    • @neverendingsupport/angular-platform-server@4.4.7-angular-4.4.12
    • @neverendingsupport/angular-platform-webworker@4.4.7-angular-4.4.12
    • @neverendingsupport/angular-platform-webworker-dynamic@4.4.7-angular-4.4.12
    • @neverendingsupport/angular-router@4.4.7-angular-4.4.12
    • @neverendingsupport/angular-tsc-wrapped@4.4.7-angular-4.4.12
    • @neverendingsupport/angular-upgrade@4.4.7-angular-4.4.12

Security Fixes

  • common:
    • Prevent Cross-Site Request Forgery (XSRF) token leakage to protocol-relative URLs.
      • This fixes a high-severity Information Exposure vulnerability (CVE-2025-66035).

v4.4.11 - June 16, 2025

Notes

  • This release contains no functional changes from NES v4.4.10.
  • This release implements a new package naming scheme for the Angular packages. More information about the change can be found in the NES Decoupled Namespace Specification.
  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@4.4.7-angular-4.4.11
    • @neverendingsupport/angular-common@4.4.7-angular-4.4.11
    • @neverendingsupport/angular-compiler@4.4.7-angular-4.4.11
    • @neverendingsupport/angular-compiler-cli@4.4.7-angular-4.4.11
    • @neverendingsupport/angular-core@4.4.7-angular-4.4.11
    • @neverendingsupport/angular-forms@4.4.7-angular-4.4.11
    • @neverendingsupport/angular-http@4.4.7-angular-4.4.11
    • @neverendingsupport/angular-language-service@4.4.7-angular-4.4.11
    • @neverendingsupport/angular-platform-browser@4.4.7-angular-4.4.11
    • @neverendingsupport/angular-platform-browser-dynamic@4.4.7-angular-4.4.11
    • @neverendingsupport/angular-platform-server@4.4.7-angular-4.4.11
    • @neverendingsupport/angular-platform-webworker@4.4.7-angular-4.4.11
    • @neverendingsupport/angular-platform-webworker-dynamic@4.4.7-angular-4.4.11
    • @neverendingsupport/angular-router@4.4.7-angular-4.4.11
    • @neverendingsupport/angular-tsc-wrapped@4.4.7-angular-4.4.11
    • @neverendingsupport/angular-upgrade@4.4.7-angular-4.4.11

v4.4.10 - February 6, 2025

Notes

  • This release contains no functional changes from NES v4.4.9.
  • This release contains metadata fixes and improvements: Updated licensing information.
  • Full Version: 4.4.7-{PACKAGE_NAME}-4.4.10

v4.4.9 - January 10, 2025

Notes

  • This release adds the tsc-wrapped package.
  • Full Version: 4.4.7-{PACKAGE_NAME}-4.4.9

v4.4.8 - June 25, 2024

Notes

  • Full Version: 4.4.7-{PACKAGE_NAME}-4.4.8

Security Fixes

  • common:
    • Use ContentType: application/json (instead of text/plain) for boolean values with HttpClient request body.
  • core:
    • Fix possible XSS vulnerability in development through SSR.
      • This fixes a low-severity Cross-Site Scripting (XSS) vulnerability (CVE-2021-4231).
  • platform-browser:
    • Prevent memory leak of style nodes if shadow DOM encapsulation is used.