What is CVE-2026-69149?

CVE-2026-69149 is a high-severity cross-site scripting (XSS) vulnerability in @angular/platform-server (npm), affecting versions >= 22.0.0-next.0, < 22.0.7. It is fixed in 22.0.7, 21.2.19, 20.3.27. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.

Which versions of @angular/platform-server are affected by CVE-2026-69149?

@angular/platform-server (npm) versions >= 22.0.0-next.0, < 22.0.7 is affected.

Is there a fix for CVE-2026-69149?

Yes. CVE-2026-69149 is fixed in 22.0.7, 21.2.19, 20.3.27. Upgrade to this version or later.

Is CVE-2026-69149 exploitable, and should I be worried?

Whether CVE-2026-69149 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-69149 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

CVE-2026-69149 in @angular/platform-server

Q: Which versions of @angular/platform-server are affected by CVE-2026-69149?

@angular/platform-server (npm) versions >= 22.0.0-next.0, < 22.0.7 is affected.

Q: Is there a fix for CVE-2026-69149?

Yes. CVE-2026-69149 is fixed in 22.0.7, 21.2.19, 20.3.27. Upgrade to this version or later.

Q: Is CVE-2026-69149 exploitable, and should I be worried?

Whether CVE-2026-69149 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-69149 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-69149?

Upgrade: @angular/platform-server to 22.0.7 or later, @angular/platform-server to 21.2.19 or later, @angular/platform-server to 20.3.27 or later.

Summary

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

A Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>).

When rendering dynamic text content inside fallback raw-content elements via template bindings, the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning these elements are treated as raw-text elements.

However, domino's serializer previously did not escape text nodes within fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>) during DOM serialization. As a result, any occurrence of closing tags in the bound dynamic text was not escaped.

The unescaped closing tag could be serialized directly into the output HTML. When parsed by a browser or re-parsed during SSR post-processing without preserving raw-content parser state, an injected closing tag closes the element early, allowing an injected script block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS).

Patched Versions

22.0.7
21.2.19
20.3.27

Workarounds

If you cannot immediately update your dependencies, you can mitigate this issue using any of the following approaches:

Disable critical CSS inlining: Critical CSS inlining in Angular SSR post-processes the rendered HTML using domino. Disabling this step prevents domino from re-parsing and re-serializing the HTML during server-side rendering.
- In angular.json, set inlineCritical to false under style optimization options:
```
{
  "projects": {
    "my-app": {
      "architect": {
        "build": {
          "builder": "@angular/build:application",
          "options": {
            "optimization": {
              "styles": {
                "inlineCritical": false
              }
            }
          }
        }
      }
    }
  }
}
```
- When rendering programmatically with CommonEngine, set inlineCriticalCss: false in your render options.
Avoid binding user-controlled values inside fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>).
Sanitize user input placed inside these elements to explicitly strip or escape closing tags before passing it to the template.

Impact

This vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>). This can lead to session hijacking, credentials theft, unauthorized actions on behalf of users, and defacement.

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

Affected versions

@angular/platform-server (>= 22.0.0-next.0, < 22.0.7) @angular/platform-server (>= 21.0.0-next.0, < 21.2.19) @angular/platform-server (>= 20.0.0-next.0, < 20.3.27) @angular/platform-server (<= 19.2.25)

Security releases

@angular/platform-server → 22.0.7 (npm) @angular/platform-server → 21.2.19 (npm) @angular/platform-server → 20.3.27 (npm)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade the following packages to resolve this vulnerability:

@angular/platform-server to 22.0.7 or later; @angular/platform-server to 21.2.19 or later; @angular/platform-server to 20.3.27 or later

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is CVE-2026-69149? CVE-2026-69149 is a high-severity cross-site scripting (XSS) vulnerability in @angular/platform-server (npm), affecting versions >= 22.0.0-next.0, < 22.0.7. It is fixed in 22.0.7, 21.2.19, 20.3.27. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
Which versions of @angular/platform-server are affected by CVE-2026-69149? @angular/platform-server (npm) versions >= 22.0.0-next.0, < 22.0.7 is affected.
Is there a fix for CVE-2026-69149? Yes. CVE-2026-69149 is fixed in 22.0.7, 21.2.19, 20.3.27. Upgrade to this version or later.
Is CVE-2026-69149 exploitable, and should I be worried? Whether CVE-2026-69149 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-69149 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-69149?
- Upgrade @angular/platform-server to 22.0.7 or later
- Upgrade @angular/platform-server to 21.2.19 or later
- Upgrade @angular/platform-server to 20.3.27 or later

Other vulnerabilities in @angular/platform-server

CVE-IDSeverityPackage summary