# What changed in @angular/localize

> 32 changes in @angular/localize 21 to 22 from its official release notes, upgrade guides and advisories: 31 security. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@angular/localize/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @angular/localize 22

### Security

- Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters (20.3.32, 21.2.24, 22.2.0) — [security advisory](https://github.com/advisories/GHSA-FF3F-86QR-9CV3)
- Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE (20.3.31, 21.2.23, 22.1.6) — [security advisory](https://github.com/advisories/GHSA-F67J-2JQW-JPQ7)
- Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements (20.3.30, 21.2.22, 22.1.4) — [security advisory](https://github.com/advisories/GHSA-J3R3-MXQP-R2P4)
- Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements (20.3.30, 21.2.22, 22.1.4) — [security advisory](https://github.com/advisories/GHSA-V3P8-WHQ6-R5JG)
- Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR (20.3.30, 21.2.22, 22.1.4) — [security advisory](https://github.com/advisories/GHSA-F6MR-PJWC-34M4)
- Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent` (20.3.28, 21.2.20, 22.1.1) — [security advisory](https://github.com/advisories/GHSA-P297-FM68-3Q8C)
- Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler (20.3.28, 21.2.20, 22.1.0) — [security advisory](https://github.com/advisories/GHSA-HH8M-FM6V-7CVG)
- Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS) (20.3.27, 21.2.19, 22.0.7) — [security advisory](https://github.com/advisories/GHSA-VPX6-8PJR-4G3V)
- Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning (20.3.27, 21.2.19, 22.0.2) — [security advisory](https://github.com/advisories/GHSA-JHPW-976M-542J)
- Angular Client Hydration DOM Clobbering & Response-Cache Poisoning (20.3.25, 21.2.17, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-RGJC-H3X7-9MWG)
- @angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate) (20.3.25, 21.2.17, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-48R7-HPM6-GFXM)
- @angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning (20.3.25, 21.2.17, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-39PV-4J6C-2G6V)
- @angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS) (20.3.25, 21.2.17, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-58W9-8G37-X9V5)
- Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes (20.3.27, 21.2.19, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-JJ27-H5HQ-8X99)
- @angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker (20.3.25, 21.2.17, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-QXH6-94W6-9R5P)

### Fixes and other changes

- Reserved characters are stripped from translations. (22.2.2) — [release notes](https://github.com/angular/angular/releases/tag/v22.2.2)

## @angular/localize 21

### Security

- @angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (19.2.25, 20.3.24, 21.2.16) — [security advisory](https://github.com/advisories/GHSA-HQR9-C56F-3X7F)
- @angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR (19.2.25, 20.3.24, 21.2.16) — [security advisory](https://github.com/advisories/GHSA-GXX4-3XCV-F8QX)
- @angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-P3VC-36G9-X9GR)
- @angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-Q6F4-QQRG-JV6X)
- @angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS) (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-692R-GRFM-V8X7)
- @angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-XRXM-CP7J-8XF6)
- Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-GV2Q-MQQV-365M)
- @angular/service-worker: Request Credential & Cache Policy Stripping (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-95QP-CMMW-MGQV)
- Angular: Template and Attribute Namespace Sanitization Bypass (XSS) (19.2.22, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-F3M7-GQXR-G87X)
- @angular/platform-server: SSRF via Hostname Hijacking (19.2.22, 20.3.21, 21.2.13) — [security advisory](https://github.com/advisories/GHSA-RFH7-FXQC-Q52V)
- Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server (19.2.21, 20.3.19, 21.2.9) — [security advisory](https://github.com/advisories/GHSA-45Q2-GJVG-7973)
- Angular vulnerable to XSS in i18n attribute bindings (19.2.20, 20.3.18, 21.2.4) — [security advisory](https://github.com/advisories/GHSA-G93W-MFHG-P222)
- Angular i18n vulnerable to Cross-Site Scripting (19.2.19, 20.3.17, 21.1.6) — [security advisory](https://github.com/advisories/GHSA-PRJF-86W9-MFQV)
- Angular has XSS Vulnerability via Unsanitized SVG Script Attributes (19.2.18, 20.3.16, 21.0.7) — [security advisory](https://github.com/advisories/GHSA-JRMJ-C5CX-3CW6)
- Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes (19.2.17, 20.3.15, 21.0.2) — [security advisory](https://github.com/advisories/GHSA-V4HV-RGFQ-GP49)
- Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client (19.2.16, 20.3.14, 21.0.1) — [security advisory](https://github.com/advisories/GHSA-58C5-G7WP-6W37)