Read the docs
TI-2025-40561 Aliases CVE-2025-66035GHSA-58c5-g7wp-6w37

Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs

Priority MEDIUM 41CWE-201Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
None · None · None
Fix status
Partial Red Hat: 1 fixed, 11 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-201.

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00716 54th percentileScored 2026-11-07
Fix Partial angular (angular): 21.0.1, 20.3.14, 19.2.16@angular/common (npm): 21.0.1, 20.3.14, 19.2.16Red Hat: 1 advisoryRed Hat: 1 fixed, 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
angularangular21.0.0-next.0 to before 21.0.1; 20.0.0-next.0 to before 20.3.14; before 19.2.1621.0.1, 20.3.14, 19.2.16Patch availableCNA
—@angular/common (npm)21.0.0-next.0 to before 21.0.121.0.1Patch availableGHSA-58c5-g7wp-6w37
—@angular/common (npm)20.0.0-next.0 to before 20.3.1420.3.14Patch availableGHSA-58c5-g7wp-6w37
—@angular/common (npm)before 19.2.1619.2.16Patch availableGHSA-58c5-g7wp-6w37
  • angular Vendorangular Affected 21.0.0-next.0 to before 21.0.1; 20.0.0-next.0 to before 20.3.14; before 19.2.16 Fixed in 21.0.1, 20.3.14, 19.2.16 Patch available CNA
  • @angular/common (npm) Vendor— Affected 21.0.0-next.0 to before 21.0.1 Fixed in 21.0.1 Patch available GHSA-58c5-g7wp-6w37
  • @angular/common (npm) Vendor— Affected 20.0.0-next.0 to before 20.3.14 Fixed in 20.3.14 Patch available GHSA-58c5-g7wp-6w37
  • @angular/common (npm) Vendor— Affected before 19.2.16 Fixed in 19.2.16 Patch available GHSA-58c5-g7wp-6w37

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:angular:angular:*:*:*:*:*:*:*:*——angular
  • cpe:2.3:a:angular:angular:*:*:*:*:*:*:*:* Versions — — ·angular

Remediation

  • Fix · CNA angular (angular) Fixed in 21.0.1, 20.3.14, 19.2.16
  • Fix · GHSA-58c5-g7wp-6w37 @angular/common (npm) Fixed in 21.0.1 Advisory →
  • Fix · GHSA-58c5-g7wp-6w37 @angular/common (npm) Fixed in 20.3.14 Advisory →
  • Fix · GHSA-58c5-g7wp-6w37 @angular/common (npm) Fixed in 19.2.16 Advisory →

Red Hat 1 advisory

  • RHSA-2026:86618 Released 2026-10-21 · Red Hat rating Critical
    New container image: rhceph-9.2
    • Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Red Hat Ceph Storage 4AffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Ceph Storage 6AffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Ceph Storage 8AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 9.2Fixed RHSA-2026:86618
Not affected: 12 products
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ceph Storage 9.2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenStack Platform 16.2
  • Red Hat Quay 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66035
  2. 2026-10-03 Alias added: GHSA-58c5-g7wp-6w37
  3. 2026-10-08 EPSS moved to the 50th–90th percentile
  4. 2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
  5. 2026-10-21 Fix available: Red Hat Ceph Storage 9.2 · Red Hat

References

Advisory 1

Other 10

  • TI-2026-74069 Infinite loop in Angular SSR HTML parser allows denial of service CVSS 4.0HIGH 8.7
  • TI-2026-60076 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVSS 4.0HIGH 8.6
  • TI-2026-60080 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2026-60078 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2025-38694 Server-Side Request Forgery (SSRF) in Angular SSR CVSS 4.0HIGH 8.7
  • TI-2026-22098 Angular SSR has an Open Redirect via X-Forwarded-Prefix CVSS 4.0MEDIUM 6.9
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences