chore(deps): update dependency @angular/core to v21.2.17 [security]#398
chore(deps): update dependency @angular/core to v21.2.17 [security]#398renovate[bot] wants to merge 1 commit into
Conversation
|
|
This pull request is automatically built and testable in CodeSandbox. To see build info of the built libraries, click here or the icon next to each commit SHA. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
@1stg/app-config
@1stg/babel-preset
@1stg/browserslist-config
@1stg/commitlint-config
@1stg/common-config
@1stg/config
@1stg/eslint-config
@1stg/markuplint-config
@1stg/nano-staged
@1stg/postcss-config
@1stg/prettier-config
@1stg/remark-preset
@1stg/simple-git-hooks
@1stg/stylelint-config
@1stg/tsconfig
commit: |
This PR contains the following updates:
21.2.15→21.2.17Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
CVE-2026-54267 / GHSA-rgjc-h3x7-9mwg
More information
Details
To optimize client-side bootstrap in Server-Side Rendered (SSR) environments, Angular supports Hydration via
provideClientHydration(). During SSR, Angular serializes the application's runtime state (such as cachedHttpClientresponses) and outputs it into the HTML stream as a<script>tag with a predictable identifier:During client bootstrap, Angular recovers this state by looking up the element via
document.getElementById('ng-state')and parsing its text content.Because the DOM element lookup for the state container is predictable and relies solely on the ID selector (
ng-state), it is susceptible to DOM Clobbering.If the application binds untrusted user input or CMS content to element properties such as
id(e.g.,<div [id]="userInput">or<a id="ng-state">) before the genuine<script>tag is parsed by the browser, the attacker-controlled element takes precedence in the DOM lookup.During hydration, when Angular calls
document.getElementById('ng-state'), the browser returns the attacker's clobbered element. Angular then attempts to parse the text content or attributes of this clobbered element as JSON.Impact
By clobbering the state element, the attacker can inject a custom JSON payload into Angular's
TransferStatecache. The most critical exploitation vector is poisoning the HTTP Transfer Cache.ng-stateelement containing custom JSON.HttpClientchecksTransferStatebefore making requests. Finding the poisoned key,HttpClientreturns the forged response instantly instead of requesting the genuine backend API.Depending on how the application processes and renders the affected API response, this can lead to:
Patched Versions
Workarounds
If you cannot immediately update to a patched Angular version, apply the following workarounds:
A. Avoid Dynamic/User-Controlled IDs
Avoid binding raw user-supplied values or dynamic CMS IDs directly to element attributes. If dynamic IDs are required, sanitize them or prepend a static safe prefix:
B. Configure a Custom Application ID
Declaring a unique, non-predictable
APP_IDchanges the ID suffix of the state element, making it harder for attackers to predict and target:This changes the state element lookup ID from
ng-statetounique-obfuscated-app-id-state.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
angular/angular (@angular/core)
v21.2.17Compare Source
Deprecations
platform-server
@angular/platform-serveris deprecated. Use standardfetchAPIs instead.common
compiler
core
http
platform-server
service-worker
v21.2.16Compare Source
common
compiler
core
platform-server
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.