CVE-2026-23745 is affecting CLI versions < 21.0.0-rc.6

[twjacobsen]

Command

other

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

Running NPM Audit on a project using Angular CLI < 21.0.0-rc.6 will report this CVE: GHSA-8qq5-rm4j-mr97

It's related to the version of pacote < 21 using a vulnerable version of node-tar

Minimal Reproduction

Run npm audit on a project using Angular CLI < 21.0.0-rc.6

Exception or Error

Your Environment

@angular-devkit/architect            0.2003.14
@angular-devkit/build-angular        20.3.14
@angular-devkit/core                 20.3.14
@angular-devkit/schematics           20.3.14
@angular/cdk                         20.2.14
@angular/cli                         20.3.14
@angular/material                    20.2.14
@angular/material-date-fns-adapter   20.2.14
@angular/material-moment-adapter     20.2.14
@schematics/angular                  20.3.14
rxjs                                 7.8.2
typescript                           5.9.3
zone.js                              0.15.1

Anything else relevant?

No response

[bmrobson101]

There is also a similar issue with CVE-2026-22036 that affects versions of @angular/build >= 21.0.0-next.0

[prajapatijay95]

Could this issue also be addressed in version 19.2.x?

[f-r-gladson]

@prajapatijay95 I'm not sure they will be able to without breaking compatability with Node 18, since the current available package only supports 20+.

I was able to force update, and didn't notice a consequence:

Add to in your package.json, add a section of overides and add "pacote": "21.0.4".
NPM will not like this one bit, so you need to run npm update --force pacote.

I didn't suffer any build side effects, but YYMV.

[alan-agius4]

Upgrading pacote to version 21 within version 19 is not feasible. This update would break Node.js compatibility.

[daniemo2]

Does this break the LTS of Angular 19, which is meant to receive vulnerability fixes until May this year?

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}