Read the docs
TI-2025-36694 Aliases CVE-2025-59052GHSA-68x2-mx4q-78m7

Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

Priority LOW 37CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the "platform injector") to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state. In practical terms, this can lead to one request responding with data meant for a completely different request, leaking data or tokens included on the rendered page or in response headers. As long as an attacker had network access to send any traffic that received a rendered response, they may have been able to send a large number of requests and then inspect the responses for information leaks. The APIs `bootstrapApplication`, `getPlatform`, and `destroyPlatform` were vulnerable and required SSR-only breaking changes. The issue has been patched in all active release lines as well as in the v21 prerelease. Patched packages include `@angular/platform-server` 21.0.0-next.3, 20.3.0, 19.2.15, and 18.2.14 and `@angular/ssr` 21.0.0-next.3, 20.3.0, 19.2.16, and 18.2.21. Several workarounds are available. Disable SSR via Server Routes or builder options, remove any asynchronous behavior from custom `bootstrap` functions, remove uses of `getPlatform()` in application code, and/or ensure that the server build defines `ngJitMode` as false.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00355 29th percentileScored 2026-11-07
Fix Partial @angular/platform-server (npm): 18.2.14, 20.3.0, 19.2.15 +1@angular/ssr (npm): 18.2.21, 19.2.16, 20.3.0 +1Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
angularangular@angular/platform-server >= 16.0.0-next.0, < 18.2.14; @angular/platform-server >= 20.0.0-next.0, < 20.3.0; @angular/platform-server >= 19.0.0-next.0, < 19.2.15; @angular/platform-server >= 21.0.0-next.0, < 21.0.0-next.3; @angular/ssr >= 17.0.0-next.0, < 18.2.21; @angular/ssr >= 19.0.0-next.0, < 19.2.16; @angular/ssr >= 20.0.0-next.0, < 20.3.0; @angular/ssr >= 21.0.0-next.0, < 21.0.0-next.3; @nguniversal/common >= 16.0.0-next.0, <= 16.2.0—No fix listedCNA
—@angular/platform-server (npm)16.0.0-next.0 to before 18.2.1418.2.14Patch availableGHSA-68x2-mx4q-78m7
—@angular/platform-server (npm)20.0.0-next.0 to before 20.3.020.3.0Patch availableGHSA-68x2-mx4q-78m7
—@angular/platform-server (npm)19.0.0-next.0 to before 19.2.1519.2.15Patch availableGHSA-68x2-mx4q-78m7
—@angular/platform-server (npm)21.0.0-next.0 to before 21.0.0-next.321.0.0-next.3Patch availableGHSA-68x2-mx4q-78m7
—@angular/ssr (npm)17.0.0-next.0 to before 18.2.2118.2.21Patch availableGHSA-68x2-mx4q-78m7
—@angular/ssr (npm)19.0.0-next.0 to before 19.2.1619.2.16Patch availableGHSA-68x2-mx4q-78m7
—@angular/ssr (npm)20.0.0-next.0 to before 20.3.020.3.0Patch availableGHSA-68x2-mx4q-78m7
—@angular/ssr (npm)21.0.0-next.0 to before 21.0.0-next.321.0.0-next.3Patch availableGHSA-68x2-mx4q-78m7
—@nguniversal/common (npm)16.0.0-next.0 – 16.2.0—No fix listedGHSA-68x2-mx4q-78m7
  • angular Vendorangular Affected @angular/platform-server >= 16.0.0-next.0, < 18.2.14; @angular/platform-server >= 20.0.0-next.0, < 20.3.0; @angular/platform-server >= 19.0.0-next.0, < 19.2.15; @angular/platform-server >= 21.0.0-next.0, < 21.0.0-next.3; @angular/ssr >= 17.0.0-next.0, < 18.2.21; @angular/ssr >= 19.0.0-next.0, < 19.2.16; @angular/ssr >= 20.0.0-next.0, < 20.3.0; @angular/ssr >= 21.0.0-next.0, < 21.0.0-next.3; @nguniversal/common >= 16.0.0-next.0, <= 16.2.0 Fixed in — No fix listed CNA
  • @angular/platform-server (npm) Vendor— Affected 16.0.0-next.0 to before 18.2.14 Fixed in 18.2.14 Patch available GHSA-68x2-mx4q-78m7
  • @angular/platform-server (npm) Vendor— Affected 20.0.0-next.0 to before 20.3.0 Fixed in 20.3.0 Patch available GHSA-68x2-mx4q-78m7
  • @angular/platform-server (npm) Vendor— Affected 19.0.0-next.0 to before 19.2.15 Fixed in 19.2.15 Patch available GHSA-68x2-mx4q-78m7
  • @angular/platform-server (npm) Vendor— Affected 21.0.0-next.0 to before 21.0.0-next.3 Fixed in 21.0.0-next.3 Patch available GHSA-68x2-mx4q-78m7
  • @angular/ssr (npm) Vendor— Affected 17.0.0-next.0 to before 18.2.21 Fixed in 18.2.21 Patch available GHSA-68x2-mx4q-78m7
  • @angular/ssr (npm) Vendor— Affected 19.0.0-next.0 to before 19.2.16 Fixed in 19.2.16 Patch available GHSA-68x2-mx4q-78m7
  • @angular/ssr (npm) Vendor— Affected 20.0.0-next.0 to before 20.3.0 Fixed in 20.3.0 Patch available GHSA-68x2-mx4q-78m7
  • @angular/ssr (npm) Vendor— Affected 21.0.0-next.0 to before 21.0.0-next.3 Fixed in 21.0.0-next.3 Patch available GHSA-68x2-mx4q-78m7
  • @nguniversal/common (npm) Vendor— Affected 16.0.0-next.0 – 16.2.0 Fixed in — No fix listed GHSA-68x2-mx4q-78m7

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:angular:angular:*:*:*:*:*:*:*:*——angular
  • cpe:2.3:a:angular:angular:*:*:*:*:*:*:*:* Versions — — ·angular

Remediation

  • Fix · GHSA-68x2-mx4q-78m7 @angular/platform-server (npm) Fixed in 18.2.14 Advisory →
  • Fix · GHSA-68x2-mx4q-78m7 @angular/platform-server (npm) Fixed in 20.3.0 Advisory →
  • Fix · GHSA-68x2-mx4q-78m7 @angular/platform-server (npm) Fixed in 19.2.15 Advisory →
  • Fix · GHSA-68x2-mx4q-78m7 @angular/platform-server (npm) Fixed in 21.0.0-next.3 Advisory →
  • Fix · GHSA-68x2-mx4q-78m7 @angular/ssr (npm) Fixed in 18.2.21 Advisory →
  • Fix · GHSA-68x2-mx4q-78m7 @angular/ssr (npm) Fixed in 19.2.16 Advisory →
  • Fix · GHSA-68x2-mx4q-78m7 @angular/ssr (npm) Fixed in 20.3.0 Advisory →
  • Fix · GHSA-68x2-mx4q-78m7 @angular/ssr (npm) Fixed in 21.0.0-next.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59052
  2. 2026-10-03 Alias added: GHSA-68x2-mx4q-78m7

References

Advisory 1

Other 4

  • TI-2026-74069 Infinite loop in Angular SSR HTML parser allows denial of service CVSS 4.0HIGH 8.7
  • TI-2026-60076 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVSS 4.0HIGH 8.6
  • TI-2026-60080 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2026-60078 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2025-38694 Server-Side Request Forgery (SSRF) in Angular SSR CVSS 4.0HIGH 8.7
  • TI-2026-22098 Angular SSR has an Open Redirect via X-Forwarded-Prefix CVSS 4.0MEDIUM 6.9
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences