CVE-2026-54267: Angular DOM Clobbering in SSR Hydration

Technical summary

CVE-2026-54267 exploits a predictable DOM element lookup pattern in Angular's hydration mechanism. Angular's provideClientHydration() optimization serializes the runtime application state (HttpClient cache, component state, etc.) into a <script id="ng-state"> element during SSR. On the client, Angular uses document.getElementById('ng-state') to recover this serialized state. The vulnerability arises from DOM Clobbering: if an application binds untrusted user input to element IDs before the script tag is parsed (e.g., <div [id]="userInput">), an attacker can inject an element with id="ng-state". Since DOM queries are case-insensitive and element references are prioritized, the attacker's element shadows the legitimate script tag. When Angular's hydration logic parses this clobbered element's text content or attributes as JSON, it processes attacker-controlled data as trusted application state. The root cause is the reliance on a predictable, unvalidated ID selector without additional integrity checks. Affected versions: Angular prior to 22.0.1, 21.2.17, and 20.3.25.

Business impact

This vulnerability primarily threatens applications that combine three conditions: SSR with hydration, user-controllable content that can set element IDs, and reliance on hydrated state (cached HTTP responses, form data, authentication tokens). The impact ranges from information disclosure (exposing cached data to other users or attackers) to application state manipulation (altering cached responses, bypassing client-side logic). For organizations deploying Angular SSR in content management systems, forums, or multi-tenant platforms where user input influences the DOM, this creates a cross-user or cross-session attack vector. The CVSS score of 6.1 (Medium) reflects the requirement for user interaction and network access, but the susceptibility affects any Angular SSR application without input sanitization controls.

Affected systems

Angular applications versions prior to 22.0.1, 21.2.17, and 20.3.25 that use server-side rendering with the provideClientHydration() feature are in scope. The vulnerability does not affect Angular applications that: (1) do not use SSR; (2) use SSR without hydration; or (3) strictly validate and sanitize all user input that could influence element IDs. Organizations running Angular LTS versions (20.x, 21.x) or the latest 22.x should verify their patch status. Custom Angular applications in production environments, especially those accepting user-generated content or CMS integration, face the highest risk.

Exploitability

Exploitation requires two preconditions: (1) the target application must bind untrusted input to element ID attributes, and (2) that input must reach the DOM before the legitimate ng-state script tag is parsed. The attack does not require authentication, elevated privileges, or complex technical payloads—basic HTML injection or CMS field manipulation suffices. However, the attacker must understand that the target uses Angular SSR with hydration, narrowing the surface compared to generic XSS. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network accessibility and low attack complexity, though user interaction is required (likely clicking a link or viewing a page). In public-facing Angular SSR applications with CMS or user-comment features, this is a realistic threat. Internal or closed applications have lower exposure.

Remediation

Upgrade Angular to version 22.0.1, 21.2.17, or 20.3.25 (or later patch releases). The fix modifies the hydration state lookup to be resilient against DOM Clobbering, likely by adding integrity validation, type checking, or alternative DOM traversal that bypasses the predictable ID lookup. Organizations unable to patch immediately should implement strict input validation and sanitization for any user input that influences element IDs—explicitly forbid id attributes in user-controlled content or use Angular's built-in sanitization APIs. Content Security Policy (CSP) headers with script-src directives can mitigate some injection vectors, though they do not directly address DOM Clobbering. Review and test thoroughly before patching production systems.

Patch guidance

Verify your Angular version using ng version or package.json. For Angular 22.x, update to 22.0.1 or later. For Angular 21.x, update to 21.2.17 or later. For Angular 20.x, update to 20.3.25 or later. Angular 19.x and earlier are out of support and should be migrated to a supported version. Test patches in a staging environment that mirrors your SSR setup before production deployment. Patch management should prioritize this update for any public-facing Angular SSR applications, especially those accepting user input that influences the DOM. Verify that provideClientHydration() is still functioning correctly post-patch and that cached state is properly recovered.

Detection guidance

Monitor for suspicious DOM elements with id="ng-state" that do not originate from legitimate Angular SSR serialization. In application logs, look for JSON parse errors or unexpected state values during hydration that suggest clobbered data. Network traffic inspection may reveal unusual script tag ordering or duplicate ng-state elements in HTML responses. Implement application-layer validation: log attempts to set user-controlled IDs to 'ng-state' or similar reserved names, and alert if hydration state does not match expected signatures. Automated testing of SSR pages with user-input payloads that attempt to inject id="ng-state" can detect vulnerable configurations before production exposure.

Why prioritize this

Although rated CVSS 6.1 (Medium), this vulnerability warrants prioritization because: (1) it affects a widely-used framework (Angular); (2) exploitation is straightforward and requires only HTML injection rather than complex payloads; (3) it impacts the integrity and confidentiality of application state, including cached authentication and user data; (4) public-facing SSR applications are common targets; and (5) patches are readily available. Organizations running Angular 20.x, 21.x, or early 22.x should prioritize this update. It is not rated Critical or High due to the requirement for user interaction and the relative rarity of applications that both use SSR/hydration and bind untrusted input to element IDs without sanitization.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a Medium severity rating based on: (1) Attack Vector: Network (AV:N) — the attack is delivered over the network; (2) Attack Complexity: Low (AC:L) — no special conditions are required; (3) Privileges Required: None (PR:N) — no authentication needed; (4) User Interaction: Required (UI:R) — the user must view a malicious page; (5) Scope: Changed (S:C) — the vulnerability affects resources beyond the vulnerable component; (6) Confidentiality: Low (C:L) — cached data may be exposed; (7) Integrity: Low (I:L) — application state may be altered; (8) Availability: None (A:N) — no denial of service. The Medium rating is appropriate because user interaction is required and the impact is bounded to state manipulation rather than system compromise.

Frequently asked questions