GeezerVison is showing github.com — @angular/build@^21 depends on [email protected] which is vulnerable to CVE-2026-102992 · Issue #34241 · angular/angular-cli
@angular/build@^21 depends on [email protected] which is vulnerable to CVE-2026-102992 #34241
Description
Command
other
Is this a regression?
- Yes, this behavior used to work in the previous version
The previous version in which this bug was not present was
No response
Description
See GHSA-67c8-pqhq-4rmx
@angular/build v21.x.x depends on [email protected] (locked on, no update allowed)
CVSS is 9.2!
Minimal Reproduction
- npm install @angular/build@21
- npm audit
Exception or Error
Your Environment
Angular CLI : 21.2.24
Angular : 21.2.24
Node.js : 24.21.0
Package Manager : npm 11.19.0
Operating System : linux x64
┌───────────────────────────┬───────────────────┬───────────────────┐
│ Package │ Installed Version │ Requested Version │
├───────────────────────────┼───────────────────┼───────────────────┤
│ @angular/build │ 21.2.24 │ ^21.2.21 │
│ @angular/cdk │ 21.2.14 │ ^21.2.14 │
│ @angular/cli │ 21.2.24 │ ^21.2.21 │
│ @angular/common │ 21.2.24 │ ^21.2.20 │
│ @angular/compiler │ 21.2.24 │ ^21.2.20 │
│ @angular/compiler-cli │ 21.2.24 │ ^21.2.20 │
│ @angular/core │ 21.2.24 │ ^21.2.20 │
│ @angular/elements │ 21.2.24 │ ^21.2.20 │
│ @angular/forms │ 21.2.24 │ ^21.2.20 │
│ @angular/platform-browser │ 21.2.24 │ ^21.2.20 │
│ @angular/router │ 21.2.24 │ ^21.2.20 │
│ @angular/service-worker │ 21.2.24 │ ^21.2.20 │
│ ng-packagr │ 21.2.7 │ ^21.2 │
│ rxjs │ 7.8.2 │ ^7.8.2 │
│ typescript │ 5.9.3 │ ^5.9.3 || ^6 │
│ vitest │ 4.1.11 │ ^4.1.7 │
│ zone.js │ 0.16.3 │ ^0.15 || ^0.16 │
└───────────────────────────┴───────────────────┴───────────────────┘
Anything else relevant?
No response
Activity
SvetlaGeorgieva commented on Oct 2, 2026
same for the 20x versions
Reacted by Mayhm and Stoyan Stratev
added 2 commits that reference this issue
on Oct 2, 2026This issue will close once commit 3e39e33 is merged into the 'main' branch.3e39e33 This issue will close once commit 7e6d2da is merged into the 'main' branch.7e6d2da angular-automatic-lock-bot commented on Nov 2, 2026
This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.
Read more about our automatic conversation locking policy.
This action has been performed automatically by a bot.
Metadata
Metadata
Development
No branches or pull requestsIssue actions