Repository navigation
@angular/build@^21 depends on piscina@5.2.0 which is vulnerable to CVE-2026-102992 #34241
Description
Command
other
Is this a regression?
- Yes, this behavior used to work in the previous version
The previous version in which this bug was not present was
No response
Description
@angular/build v21.x.x depends on piscina@5.2.0 (locked on, no update allowed)
CVSS is 9.2!
Minimal Reproduction
- npm install @angular/build@21
- npm audit
Exception or Error
Your Environment
Angular CLI : 21.2.24
Angular : 21.2.24
Node.js : 24.21.0
Package Manager : npm 11.19.0
Operating System : linux x64
┌───────────────────────────┬───────────────────┬───────────────────┐
│ Package │ Installed Version │ Requested Version │
├───────────────────────────┼───────────────────┼───────────────────┤
│ @angular/build │ 21.2.24 │ ^21.2.21 │
│ @angular/cdk │ 21.2.14 │ ^21.2.14 │
│ @angular/cli │ 21.2.24 │ ^21.2.21 │
│ @angular/common │ 21.2.24 │ ^21.2.20 │
│ @angular/compiler │ 21.2.24 │ ^21.2.20 │
│ @angular/compiler-cli │ 21.2.24 │ ^21.2.20 │
│ @angular/core │ 21.2.24 │ ^21.2.20 │
│ @angular/elements │ 21.2.24 │ ^21.2.20 │
│ @angular/forms │ 21.2.24 │ ^21.2.20 │
│ @angular/platform-browser │ 21.2.24 │ ^21.2.20 │
│ @angular/router │ 21.2.24 │ ^21.2.20 │
│ @angular/service-worker │ 21.2.24 │ ^21.2.20 │
│ ng-packagr │ 21.2.7 │ ^21.2 │
│ rxjs │ 7.8.2 │ ^7.8.2 │
│ typescript │ 5.9.3 │ ^5.9.3 || ^6 │
│ vitest │ 4.1.11 │ ^4.1.7 │
│ zone.js │ 0.16.3 │ ^0.15 || ^0.16 │
└───────────────────────────┴───────────────────┴───────────────────┘
Anything else relevant?
No response
Activity
SvetlaGeorgieva commentedon Oct 2, 2026
same for the 20x versions
fix(@angular/build): bump piscina to 5.3.2
fix(@angular/build): bump piscina to 5.3.2