Update dependency @angular/platform-server to v21.2.19 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/platform-server (source)	21.2.17 → 21.2.19

---

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

CVE-2026-69149 / GHSA-vpx6-8pjr-4g3v

More information

Details

A Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>).

When rendering dynamic text content inside fallback raw-content elements via template bindings, the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning these elements are treated as raw-text elements.

However, domino's serializer previously did not escape text nodes within fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>) during DOM serialization. As a result, any occurrence of closing tags in the bound dynamic text was not escaped.

The unescaped closing tag could be serialized directly into the output HTML. When parsed by a browser or re-parsed during SSR post-processing without preserving raw-content parser state, an injected closing tag closes the element early, allowing an injected script block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS).

Impact

This vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>). This can lead to session hijacking, credentials theft, unauthorized actions on behalf of users, and defacement.

Patched Versions

• 22.0.7
• 21.2.19
• 20.3.27

Workarounds

If you cannot immediately update your dependencies, you can mitigate this issue using any of the following approaches:

• Disable critical CSS inlining: Critical CSS inlining in Angular SSR post-processes the rendered HTML using domino. Disabling this step prevents domino from re-parsing and re-serializing the HTML during server-side rendering.
  • In angular.json, set inlineCritical to false under style optimization options:

    {
      "projects": {
        "my-app": {
          "architect": {
            "build": {
              "builder": "@angular/build:application",
              "options": {
                "optimization": {
                  "styles": {
                    "inlineCritical": false
                  }
                }
              }
            }
          }
        }
      }
    }

  • When rendering programmatically with CommonEngine, set inlineCriticalCss: false in your render options.
• Avoid binding user-controlled values inside fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>).
• Sanitize user input placed inside these elements to explicitly strip or escape closing tags before passing it to the template.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v
• https://github.com/angular/angular/pull/69675
• https://github.com/angular/angular/pull/69714
• https://github.com/angular/angular/pull/69929
• https://github.com/angular/angular/pull/69930
• https://github.com/angular/domino/pull/32
• https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56
• https://github.com/advisories/GHSA-vpx6-8pjr-4g3v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

angular/angular (@​angular/platform-server)

v21.2.19

Compare Source

compiler

Commit	Type	Description
e2660c3dee	fix	disallow i18n event attributes
7b884f585a	fix	restrict possible event handler check to property names longer than 2 characters

http

Commit	Type	Description
948a8d6831	fix	distinguish repeated transfer cache params
9949dccce1	fix	enable xsrf for root-provided HttpClient

platform-server

Commit	Type	Description
f34a93c946	fix	update domino to latest version

v21.2.18

Compare Source

compiler-cli

Commit	Type	Description
8d22cc953b	fix	update babel dependencies to latest v7

core

Commit	Type	Description
6bcce117fb	fix	avoid caching missing locale data
5a693bafcd	fix	reject dynamic script host elements

http

Commit	Type	Description
91df739b80	fix	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Type	Description
1804f73bec	fix	preserve referrer in asset requests
e86c31bf26	fix	preserve referrer policy in asset requests

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • Between 05:00 PM and 11:59 PM, Monday through Friday (* 17-23 * * 1-5)
  • Between 12:00 AM and 08:59 AM, Monday through Friday (* 0-8 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.