Angular critical CSS inlining Cross-site Scripting Vulnerability Advisory
Impact
Angular Universal applications on 16.1.0 and 16.1.1 using critical CSS inlining are vulnerable to a cross-site scripting (XSS) attack where an attacker can trick another user into visiting a page which injects malicious JavaScript.
Angular CLI applications without Universal do perform critical CSS inlining as well, however exploiting this requires a malicious actor to already have access to modify source code directly.
Patches
@nguniversal/common should be upgraded to 16.1.2 or higher. 16.2.0-rc.0 is safe.
Workarounds
The easiest solution is likely to upgrade Universal to 16.1.2 or downgrade to 16.0.x or lower. Alternatively you can override specifically the critters dependency with version 0.0.20 in your package.json.
{
"overrides": {
"critters": "0.0.20"
}
}References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @nguniversal/common | >= 16.1.0, < 16.1.2 | 16.1.2 |
References
- Weakness (CWE)
CWE-79- Platform
- npm
- Package
@nguniversal/common- Disclosed
- 09.08.2023
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-r3hf-q8q7-fv2p - CC BY 4.0
Vulnerability history: @nguniversal/common
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 08.2023 02.2026
- Without a fix
- 2
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 2
Disclosures per year
- 2023: 1
- 2024: 0
- 2025: 1
- 2026: 1
-
Angular critical CSS inlining Cross-site Scripting Vulnerability Advisory this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.