Security Alert – CVE-2026-54267

[github-actions]

General Information

• Title: @angular/core: Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
• Category: vulnerabilities
• Severity: high
• Published date: 2026-06-22
• Short Description: @angular/core: Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

Affected Package

• Package name: @angular/core
• Fixed version: 22.0.1, 21.2.17, 20.3.25

Classification

• Rule: CVE-2026-54267
• Category: vulnerabilities
• Advisory URL: https://access.redhat.com/security/cve/CVE-2026-54267

References

• https://access.redhat.com/security/cve/CVE-2026-54267
• https://github.com/angular/angular
• angular/angular@6bde84f
• fix(core): harden TransferState restoration against DOM clobbering angular/angular#69064
• GHSA-rgjc-h3x7-9mwg
• https://nvd.nist.gov/vuln/detail/CVE-2026-54267
• https://www.cve.org/CVERecord?id=CVE-2026-54267