HeroDevs
Visit Angular NES Home Page

Angular 9

Comprehensive release notes and changelog for Angular 9, including security patches, bug fixes, and feature updates across all supported versions.

3 Patched Vulnerabilities
VEX Statements

Angular

v9.1.21 - February 24, 2026

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-common@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-compiler@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-compiler-cli@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-core@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-elements@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-forms@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-language-service@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-localize@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-platform-browser@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-platform-browser-dynamic@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-platform-server@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-platform-webworker@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-platform-webworker-dynamic@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-router@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-service-worker@9.1.13-angular-9.1.21
    • @neverendingsupport/angular-upgrade@9.1.13-angular-9.1.21
    • @neverendingsupport/zone.js@0.10.3-angular-9.1.21

Security Fixes

  • core: Sanitize sensitive attributes on SVG script elements.
    • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-22610).

v9.1.20 - December 19, 2025

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-common@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-compiler@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-compiler-cli@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-core@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-elements@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-forms@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-language-service@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-localize@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-platform-browser@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-platform-browser-dynamic@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-platform-server@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-platform-webworker@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-platform-webworker-dynamic@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-router@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-service-worker@9.1.13-angular-9.1.20
    • @neverendingsupport/angular-upgrade@9.1.13-angular-9.1.20
    • @neverendingsupport/zone.js@0.10.3-angular-9.1.20

Security Fixes

  • compiler: Prevent stored XSS via SVG animation attributeName and MathML/SVG URLs.
    • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2025-66412).

v9.1.19 - December 4, 2025

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-common@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-compiler@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-compiler-cli@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-core@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-elements@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-forms@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-language-service@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-localize@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-platform-browser@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-platform-browser-dynamic@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-platform-server@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-platform-webworker@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-platform-webworker-dynamic@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-router@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-service-worker@9.1.13-angular-9.1.19
    • @neverendingsupport/angular-upgrade@9.1.13-angular-9.1.19
    • @neverendingsupport/zone.js@0.10.3-angular-9.1.19

Security Fixes

  • common: Prevent Cross-Site Request Forgery (XSRF) token leakage to protocol-relative URLs.
    • This fixes a high-severity Information Exposure vulnerability (CVE-2025-66035).

v9.1.18 - June 16, 2025

Notes

  • This release contains no functional changes from NES v9.1.17.
  • This release implements a new package naming scheme for the Angular packages. More information about the change can be found in the NES Decoupled Namespace Specification.
  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-common@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-compiler@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-compiler-cli@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-core@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-elements@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-forms@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-language-service@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-localize@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-platform-browser@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-platform-browser-dynamic@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-platform-server@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-platform-webworker@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-platform-webworker-dynamic@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-router@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-service-worker@9.1.13-angular-9.1.18
    • @neverendingsupport/angular-upgrade@9.1.13-angular-9.1.18
    • @neverendingsupport/zone.js@0.10.3-angular-9.1.18

v9.1.17 - February 5, 2025

Notes

  • This release adds the following packages: elements, language-service, localize
  • This release contains metadata fixes and improvements: Updated licensing information.
  • Full Version: 9.1.13-{PACKAGE_NAME}-9.1.17

v9.1.16 - February 5, 2025

Notes

  • This release contains no functional changes from NES v9.1.15.
  • This release contains only metadata fixes and improvements: Updated peer dependency versions.
  • Full Version: 9.1.13-{PACKAGE_NAME}-9.1.16

v9.1.15 - February 5, 2025

Notes

  • This release contains no functional changes from NES v9.1.14.
  • This release contains only metadata fixes and improvements: Updated peer dependency versions.
  • Full Version: 9.1.15-{PACKAGE_NAME}

v9.1.14 - February 8, 2024

Notes

  • Full Version: 9.1.14-{PACKAGE_NAME}

Security Fixes

  • common: Use ContentType: application/json (instead of text/plain) for boolean values with HttpClient request body.
  • compiler: Do not unquote CSS values.
  • core:
    • Set style property value to empty string instead of an invalid value.
    • Harden attribute and property binding rules for iframe elements.
    • Ensure sanitizer works if DOMParser returns null body.
    • Fix possible XSS vulnerability in development through SSR.
  • platform-browser: Prevent memory leak of style nodes if shadow DOM encapsulation is used.

Angular CLI

9.1.19 (NES) - September 2025

Notes

  • Full package names and versions
    • @neverendingsupport/angular-cli@9.1.15-angular-cli-9.1.19
    • @neverendingsupport/angular-pwa@0.901.15-angular-cli-9.1.19
    • @neverendingsupport/angular-devkit-architect@0.901.15-angular-cli-9.1.19
    • @neverendingsupport/angular-devkit-architect-cli@0.901.15-angular-cli-9.1.19
    • @neverendingsupport/angular-devkit-build-angular@0.901.15-angular-cli-9.1.19
    • @neverendingsupport/angular-devkit-build-ng-packagr@0.901.15-angular-cli-9.1.19
    • @neverendingsupport/angular-devkit-build-optimizer@0.901.15-angular-cli-9.1.19
    • @neverendingsupport/angular-devkit-build-webpack@0.901.15-angular-cli-9.1.19
    • @neverendingsupport/angular-devkit-core@9.1.15-angular-cli-9.1.19
    • @neverendingsupport/angular-devkit-schematics@9.1.15-angular-cli-9.1.19
    • @neverendingsupport/angular-devkit-schematics-cli@0.901.15-angular-cli-9.1.19
    • @neverendingsupport/ngtools-webpack@9.1.15-angular-cli-9.1.19

Bug Fixes

  • Fixed build issues: updated peer dependency version numbers

9.1.18 (NES) - June 5, 2025

Notes

  • This release contains no functional changes from 9.1.17.
  • Full package names and versions
    • @neverendingsupport/angular-cli@9.1.15-angular-cli-9.1.18
    • @neverendingsupport/angular-pwa@0.901.15-angular-cli-9.1.18
    • @neverendingsupport/angular-devkit-architect@0.901.15-angular-cli-9.1.18
    • @neverendingsupport/angular-devkit-architect-cli@0.901.15-angular-cli-9.1.18
    • @neverendingsupport/angular-devkit-build-angular@0.901.15-angular-cli-9.1.18
    • @neverendingsupport/angular-devkit-build-ng-packagr@0.901.15-angular-cli-9.1.18
    • @neverendingsupport/angular-devkit-build-optimizer@0.901.15-angular-cli-9.1.18
    • @neverendingsupport/angular-devkit-build-webpack@0.901.15-angular-cli-9.1.18
    • @neverendingsupport/angular-devkit-core@9.1.15-angular-cli-9.1.18
    • @neverendingsupport/angular-devkit-schematics@9.1.15-angular-cli-9.1.18
    • @neverendingsupport/angular-devkit-schematics-cli@0.901.15-angular-cli-9.1.18
    • @neverendingsupport/ngtools-webpack@9.1.15-angular-cli-9.1.18

9.1.17 (NES) - February 5, 2025

Notes

  • Added @ngtools/webpack package, which was previously not included in the release
  • Full Version: 9.1.15-{PACKAGE_NAME}-9.1.17

9.1.16 (NES) - January 14, 2025

Notes

  • Added build-ng-packagr and build-optimizer packages, which were not previously in the release
  • Full Version: 9.1.15-{PACKAGE_NAME}-9.1.16