CVE-2026-69149

CVE-2026-69149 is a cross-site scripting vulnerability in domino, a server-side DOM implementation that powers Angular's SSR (server-side rendering) capabilities. The flaw specifically affects how domino serializes "fallback raw-content elements" — <iframe>, <noembed>, <noframes>, and <noscript> — during the SSR pipeline. If an attacker can inject malicious content into any of these elements before it passes through Angular's SSR serialization, that payload can be reflected unsanitized into the rendered HTML response sent to victims. The severity score (8.6) creates a misleading impression of urgency. The EPSS score of 0.0034 places this in low-exploitation-probability territory — roughly 10-50x lower than vulnerabilities with comparable CVSS scores. This gap is real and meaningful, but don't let it lull you into ignoring the issue. The exploitation surface is narrower than typical XSS (it requires injecting into specific legacy elements that survive the SSR pipeline), which explains the low EPSS. However, the blast radius potential is substantially larger than the exploitation difficulty suggests. The critical risk you should be modeling is cache amplification. SSR output gets cached aggressively — by CDNs, by API gateways, in prerendered static files, and in distributed rendering systems. A successful injection doesn't just affect the next request; it poisons every downstream consumer of that cached content. The poisoned payload persists until cache invalidation occurs, which is a manual operation separate from patching. Check your dependency tree for @angular/platform-server and confirm which domino version it pulls. The fix shipped across Angular 20.x, 21.x, and 22.x — you need the version corresponding to your release track. After applying the patch, you must rebuild your SSR bundle and explicitly flush CDN/caching layers; simply deploying the patched code won't automatically purge poisoned cache entries. This remediation chain — patch → rebuild → deploy → cache invalidation — is why SSR XSS vulnerabilities tend to have longer mean-time-to-remediation than client-side equivalents. If you're not using Angular SSR (only client-side Angular), you're not affected. If you are using SSR, prioritize inventorying which of your applications render these four raw-content elements server-side, because that's where your exposure lives.

Reviewed through automated stages and approved by a human before publication.