CVE-2026-54267 Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
Attackers can hijack Angular SSR hydration state via DOM clobbering to inject malicious scripts or poison cached responses, requiring specific binding patterns.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-54267?
CVE-2026-54267 is a high-severity cross-site scripting vulnerability in angular, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, to optimize client-side bootstrap in Server-Side Rendered (SSR) environments, Angular supports Hydration via provideClientHydration(). During SSR, Angular serializes the application's runtime state (such as cached HttpClient responses) and outputs it into the HTML stream as a <script> tag with a predictable identifier. During client bootstrap, Angular recovers this state by looking up the element via document.getElementById('ng-state') and parsing its text content. Because the DOM element lookup for the state container is predictable and relies solely on the ID selector (ng-state), it is susceptible to DOM Clobbering. If the application binds untrusted user input or CMS content to element properties such as id (e.g., <div [id]="userInput"> or <a id="ng-state">) before the genuine <script> tag is parsed by the browser, the attacker-controlled element takes precedence in the DOM lookup. During hydration, when Angular calls document.getElementById('ng-state'), the browser returns the attacker's clobbered element. Angular then attempts to parse the text content or attributes of this clobbered element as JSON. This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.
Which versions are affected by CVE-2026-54267?
8 open source packages ship an affected version, including @angular/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@angular/core npm | All versions to 19.2.25 | None |
@angular/core npm | All versions to 19.2.25 | None |
@angular/core npm | From 20.0.0-next.0 | 20.3.25 |
@angular/core npm | From 20.0.0-next.0 | 20.3.25 |
@angular/core npm | From 21.0.0-next.0 | 21.2.17 |
@angular/core npm | From 21.0.0-next.0 | 21.2.17 |
2 more packages
@angular/core npm | From 22.0.0-next.0 | 22.0.1 |
@angular/core npm | From 22.0.0-next.0 | 22.0.1 |
Products include Angular Angular.
How do I fix CVE-2026-54267?
Upgrade @angular/core to a fixed version for your release line: 20.3.25, 21.2.17 or 22.0.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-54267 being exploited?
There is no known exploitation of CVE-2026-54267 in the wild and no public exploit code.
Other vulnerabilities in angular
- CVE-2026-68945 Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
- CVE-2026-46417 Angular: SSRF via Hostname Hijacking in @angular/platform-server
- CVE-2026-50168 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass
- CVE-2026-54266 Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
- CVE-2026-41423 Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
Sources
Also known as CLSA-2026-1791202115, CLSA-2026-1791202437, CLSA-2026-1791202982, CLSA-2026-1792160934, CLSA-2026-1792161412, CLSA-2026-1792161413 and 42 more.