chore(deps): update dependency @angular/common to v20.3.14 [security] by renovate[bot] · Pull Request #2429 · ngxs/store

renovate · 2026-04-08T20:19:08Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@angular/common (source)	`20.3.2` → `20.3.14`

Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client

CVE-2025-66035 / GHSA-58c5-g7wp-6w37

More information

Details

The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain.

Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header.

Impact

The token leakage completely bypasses Angular's built-in CSRF protection, allowing an attacker to capture the user's valid XSRF token. Once the token is obtained, the attacker can perform arbitrary Cross-Site Request Forgery (CSRF) attacks against the victim user's session.

Attack Preconditions

The victim's Angular application must have XSRF protection enabled.
The attacker must be able to make the application send a state-changing HTTP request (e.g., POST) to a protocol-relative URL (e.g., //attacker.com) that they control.

Patches

19.2.16
20.3.14
21.0.1

Workarounds

Developers should avoid using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.

Severity

CVSS Score: 7.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

angular/angular (@angular/common)

`v20.3.14`

Compare Source

http

Commit	Type	Description
0276479e7d	fix	prevent XSRF token leakage to protocol-relative URLs

common

Commit	Type	Description
5047849a4a	fix	remove placeholder image listeners once view is removed

compiler

Commit	Type	Description
f9d0818087	fix	support arbitrary nesting in :host-context()
106b9040df	fix	support commas in :host() argument
9419ea348a	fix	support complex selectors in :nth-child()
036c5d2a07	fix	support one additional level of nesting in :host()

core

Commit	Type	Description
dcdd1bcdbb	fix	skip leave animations on view swaps

`v20.3.10`

Compare Source

compiler-cli

Commit	Description
	make required inputs diagnostic less noisy

migrations

Commit	Description
	Prevent removal of templates referenced with preceding whitespace characters

`v20.3.9`

Compare Source

`v20.3.7`

Compare Source

animations

Commit	Type	Description
bd38cd45a5	fix	account for `Element.animate` exceptions (#64506)

compiler

Commit	Type	Description
891f180262	fix	correctly compile long numeric HTML entities (#64297)

compiler-cli

Commit	Type	Description
371274bfc6	fix	missingStructuralDirective diagnostic produces false negatives (#64470)

core

Commit	Type	Description
4c89a267c3	fix	pass element removal property through in all locations (#64565)
2fad4d4ab6	fix	prevent duplicate nodes from being retained with fast `animate.leave`` calls (#64592)

router

Commit	Type	Description
cfd8ed3fff	fix	Fix outlet serialization and parsing with no primary children (#64505)
182fe78f91	fix	Surface parse errors in Router.parseUrl (#64503)

`v20.3.6`

Compare Source

core

Commit	Type	Description
911d6822cb	fix	update animation scheduling (#64441)

platform-browser

Commit	Type	Description
2ece42866d	fix	`DomEventsPlugin` should always be the last plugin to be called for `supports()`. (#50394)

`v20.3.5`

Compare Source

compiler-cli

Commit	Type	Description
8dec92ff9f	fix	capture metadata for undecorated fields (#63957) (#64317)
c2e817b0ef	perf	fix performance of "interpolated signal not invoked" check (#64410)

core

Commit	Type	Description
f15cfa4cc4	fix	fixes regression in `animate.leave` function bindings (#64413)
d54dd674ca	fix	Prevents early style pruning with leave animations (#64335)

migrations

Commit	Type	Description
554573e524	fix	migrating input with more than 1 usage in a method (#64367)
2c79ca0b57	fix	remove error for no matching files in control flow migration (#64253) (#64314)

router

Commit	Type	Description
6e4bcc7d22	fix	Scroll restoration should use instant scroll behavior for traversals (#64299)

`v20.3.4`

Compare Source

core

Commit	Type	Description
853ed169a8	fix	ensure missing leave animations don't queue leave animations (#64226)
6fed986b7a	fix	Fixes animations in conjunction with content projection (#63776)
76fe5599fe	fix	handle undefined CSS time values in parseCssTimeUnitsToMs function (#64181)
3b959105be	fix	prevent early exit from leave animations when multiple transitions are present (#64225)

migrations

Commit	Type	Description
65884895ff	fix	preserve component imports when pruning NgModules in standalone migration (#64186)

`v20.3.3`

Compare Source

compiler

Commit	Type	Description
f51ab32fb3	fix	recover template literals with broken expressions (#64150)

core

Commit	Type	Description
542cd0019a	fix	do not rename ARIA property bindings to attributes (#64089)
0e928fbc4a	fix	Fixes animations in conjunction with content projection (#63776)
e5157bd933	fix	prevents unintended early termination of leave animations and hoisting (#64088)

migrations

Commit	Type	Description
1710cbd7d4	fix	handle shorthand property declarations in NgModule (#64160)
77b6305a4b	fix	skip migration for inputs with 'this' references (#64142)

Configuration

📅 Schedule: (in timezone UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

nx-cloud · 2026-04-08T20:22:18Z

View your CI Pipeline Execution ↗ for commit 4ed8777

Command	Status	Duration	Result
`nx run-many --target=test --all --configuration...`	✅ Succeeded	1m 16s	View ↗
`nx run-many --target=lint --all --configuration...`	✅ Succeeded	1s	View ↗
`nx lint-types store`	✅ Succeeded	<1s	View ↗
`nx run-many --target=build --all`	✅ Succeeded	1m 11s	View ↗

☁️ Nx Cloud last updated this comment at 2026-06-02 19:51:55 UTC

pkg-pr-new · 2026-04-08T20:22:37Z

Open in StackBlitz

@ngxs/devtools-plugin

npm i https://pkg.pr.new/@ngxs/devtools-plugin@2429

@ngxs/form-plugin

npm i https://pkg.pr.new/@ngxs/form-plugin@2429

@ngxs/hmr-plugin

npm i https://pkg.pr.new/@ngxs/hmr-plugin@2429

@ngxs/router-plugin

npm i https://pkg.pr.new/@ngxs/router-plugin@2429

@ngxs/storage-plugin

npm i https://pkg.pr.new/@ngxs/storage-plugin@2429

@ngxs/store

npm i https://pkg.pr.new/@ngxs/store@2429

@ngxs/websocket-plugin

npm i https://pkg.pr.new/@ngxs/websocket-plugin@2429

commit: 4ed8777

bundlemon · 2026-04-08T20:28:51Z

BundleMon

Unchanged files (6)

Status	Path	Size	Limits
❌	fesm2022/ngxs-store.mjs	116.47KB	114KB / +0.5%
✅	fesm2022/ngxs-store-operators.mjs	15.7KB	16KB / +0.5%
✅	fesm2022/ngxs-store-internals.mjs	12.71KB	15KB / +0.5%
✅	fesm2022/ngxs-store-internals-testing.mjs	10.32KB	13KB / +0.5%
✅	fesm2022/ngxs-store-plugins.mjs	2.37KB	3KB / +0.5%
✅	fesm2022/ngxs-store-experimental.mjs	574B	2KB / +0.5%

No change in files bundle size

Unchanged groups (1)

Status	Path	Size	Limits
✅	@ngxs/store(fesm2022)[gzip] _{./fesm2022/*.mjs}	39.51KB	+1%

Final result: ❌

View report in BundleMon website ➡️

Current branch size history | Target branch size history

bundlemon · 2026-04-08T20:28:53Z

BundleMon (NGXS Plugins)

Unchanged files (9)

Status	Path	Size	Limits
✅	Plugins(fesm2022)[gzip] _{storage-plugin/fesm2022/ngxs-storage-plugin.m js}	4.17KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{router-plugin/fesm2022/ngxs-router-plugin.mjs}	3.43KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{hmr-plugin/fesm2022/ngxs-hmr-plugin.mjs}	2.78KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{websocket-plugin/fesm2022/ngxs-websocket-plug in.mjs}	2.61KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{form-plugin/fesm2022/ngxs-form-plugin.mjs}	2.51KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{devtools-plugin/fesm2022/ngxs-devtools-plugin .mjs}	2.26KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{logger-plugin/fesm2022/ngxs-logger-plugin.mjs}	2.07KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{storage-plugin/fesm2022/ngxs-storage-plugin-i nternals.mjs}	1004B	+0.5%
✅	Plugins(fesm2022)[gzip] _{router-plugin/fesm2022/ngxs-router-plugin-int ernals.mjs}	453B	+0.5%

No change in files bundle size

Unchanged groups (1)

Status	Path	Size	Limits
✅	All Plugins(fesm2022)[gzip] _{./-plugin/fesm2022/.mjs}	21.25KB	+0.5%

Final result: ✅

View report in BundleMon website ➡️

Current branch size history | Target branch size history

bundlemon · 2026-04-08T20:28:56Z

BundleMon (Integration Projects)

Unchanged files (1)

Status	Path	Size	Limits
✅	Main bundles(Gzip) _{hello-world-ng21/dist-integration/browser/mai n-(hash).js}	67.99KB	+1%

No change in files bundle size

Final result: ✅

View report in BundleMon website ➡️

Current branch size history | Target branch size history

renovate Bot enabled auto-merge (squash) April 8, 2026 20:19

renovate Bot requested review from Carniatto, arturovt, joaqcid, kuncevic, markwhitfeld, poloagustin and splincode as code owners April 8, 2026 20:19

renovate Bot force-pushed the renovate/npm-angular-common-vulnerability branch 8 times, most recently from 7f422de to c25e504 Compare April 27, 2026 13:18

renovate Bot changed the title ~~chore(deps): update dependency @angular/common to v20.3.14 [security]~~ chore(deps): update dependency @angular/common to v20.3.14 [security] - autoclosed Apr 27, 2026

renovate Bot closed this Apr 27, 2026

auto-merge was automatically disabled April 27, 2026 18:40
Pull request was closed

renovate Bot deleted the renovate/npm-angular-common-vulnerability branch April 27, 2026 18:40

renovate Bot changed the title ~~chore(deps): update dependency @angular/common to v20.3.14 [security] - autoclosed~~ chore(deps): update dependency @angular/common to v20.3.14 [security] Apr 27, 2026

renovate Bot reopened this Apr 27, 2026

renovate Bot force-pushed the renovate/npm-angular-common-vulnerability branch 2 times, most recently from c25e504 to 04c3010 Compare April 27, 2026 23:43

renovate Bot enabled auto-merge (squash) May 7, 2026 20:14

renovate Bot force-pushed the renovate/npm-angular-common-vulnerability branch 3 times, most recently from dc46568 to 20274ec Compare May 10, 2026 18:49

renovate Bot force-pushed the renovate/npm-angular-common-vulnerability branch 3 times, most recently from d314bd2 to 95761e7 Compare May 21, 2026 12:00

chore(deps): update dependency @angular/common to v20.3.14 [security]

4ed8777

renovate Bot force-pushed the renovate/npm-angular-common-vulnerability branch from 95761e7 to 4ed8777 Compare June 2, 2026 19:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency @angular/common to v20.3.14 [security]#2429

chore(deps): update dependency @angular/common to v20.3.14 [security]#2429
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-angular-common-vulnerability

renovate Bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

nx-cloud Bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

bundlemon Bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

bundlemon Bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

bundlemon Bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client

Details

Impact

Attack Preconditions

Patches

Workarounds

Severity

References

Release Notes

http

common

compiler

core

compiler-cli

migrations

animations

compiler

compiler-cli

core

router

core

platform-browser

compiler-cli

core

migrations

router

core

migrations

compiler

core

migrations

Configuration

Uh oh!

nx-cloud Bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bundlemon Bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

BundleMon

Uh oh!

bundlemon Bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

BundleMon (NGXS Plugins)

Uh oh!

bundlemon Bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

BundleMon (Integration Projects)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Apr 8, 2026 •

edited

Loading

nx-cloud Bot commented Apr 8, 2026 •

edited

Loading

pkg-pr-new Bot commented Apr 8, 2026 •

edited

Loading

bundlemon Bot commented Apr 8, 2026 •

edited

Loading

bundlemon Bot commented Apr 8, 2026 •

edited

Loading

bundlemon Bot commented Apr 8, 2026 •

edited

Loading