How to use this reference
Editorial lesson: source authenticity and data validity are separate requirements when restoring state across a server/browser boundary. Cached content should retain its trust classification through later consumers. The linked patch restricts restoration to the expected container type. Review that source-selection invariant separately from safe rendering, and distinguish reading a patch from verifying its effectiveness in a deployment.
Before reading
- Server rendering, client hydration and response-cache concepts
- The distinction between data parsing, source trust and browser rendering
Context and limits
- For @angular/core, the advisory lists affected ranges >= 22.0.0-next.0 < 22.0.1, >= 21.0.0-next.0 < 21.2.17, >= 20.0.0-next.0 < 20.3.25, and <= 19.2.25. Listed fixes are 22.0.1, 21.2.17 and 20.3.25; the older range has no listed patch.
- Potential consequences are maintainer claims; reviewed evidence does not establish production compromise, account takeover or data theft.
- SkyZeroZx is credited as Reporter; alan-agius4 published the advisory and is a Remediation reviewer, alongside AndrewKushnir and JeanMeche. josephperrott is credited as Other. No narrative byline or individual award is established.
- The patch pull request opened June 1 and merged June 3, 2026. These are development events, not software-release dates or the selected advisory's publication date.
- The database records publication there on June 15 and an update on July 15, 2026. Neither replaces the June 10 primary publication. Software-release dates were not established in this review.
- The source explicitly identifies XSS; stored, reflected and blind subtypes are not established. This source-selection lesson is distinct from the library's output-serialization and host-binding context cases. Learning prerequisites and generalized guidance are editorial.
Sources and provenance
- Angular Client Hydration DOM Clobbering & Response-Cache Poisoning Angular maintainers · reviewed 2026-10-06
- Angular transfer-state restoration hardening, pull request 69064 Angular maintainers · reviewed 2026-10-06
- GitHub Advisory Database chronology for GHSA-rgjc-h3x7-9mwg GitHub Advisory Database · reviewed 2026-10-06
Record reviewed 2026-10-06. Snapshot cb017eaea66e. Open the complete JSON contract.