XSRF token leakage in Angular HttpClient via URL parsing mismatch
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-201.
Summary
Angular through 19.2.25, from 20.0.0 before 20.3.34 and from 21.0.0 before 21.0.3 is affected, as is the @angular/common npm package. HttpClient's XSRF interceptor parses URLs differently from the browser, so a cross-origin URL with backslashes, control characters or whitespace can be treated as same-origin. A user's mutating request to such a URL sends the X-XSRF-TOKEN header to the other host. With permissive CORS for the custom header, an attacker can read the token and forge requests in the victim's session.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| angular | angular | up to 19.2.25; 20.0.0 to before 20.3.34; 21.0.0 to before 21.0.3 | 20.3.34, 21.0.3 | Patch available | CNA |
| — | @angular/common (npm) | 21.0.0 to before 21.0.3 | 21.0.3 | Patch available | GHSA-jfgx-762w-99vr |
| — | @angular/common (npm) | 20.0.0 to before 20.3.34 | 20.3.34 | Patch available | GHSA-jfgx-762w-99vr |
| — | @angular/common (npm) | up to 19.2.25 | — | No fix listed | GHSA-jfgx-762w-99vr |
- angular Vendorangular Affected up to 19.2.25; 20.0.0 to before 20.3.34; 21.0.0 to before 21.0.3 Fixed in 20.3.34, 21.0.3 Patch available CNA
- @angular/common (npm) Vendor— Affected 21.0.0 to before 21.0.3 Fixed in 21.0.3 Patch available GHSA-jfgx-762w-99vr
- @angular/common (npm) Vendor— Affected 20.0.0 to before 20.3.34 Fixed in 20.3.34 Patch available GHSA-jfgx-762w-99vr
- @angular/common (npm) Vendor— Affected up to 19.2.25 Fixed in — No fix listed GHSA-jfgx-762w-99vr
Remediation
Upgrade angular to 20.3.34 or 21.0.3 and @angular/common to 20.3.34 or 21.0.3. The sources list no fixed version for @angular/common 19.2.25 and earlier.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA angular (angular) Fixed in 20.3.34, 21.0.3
- Fix · GHSA-jfgx-762w-99vr @angular/common (npm) Fixed in 21.0.3 Advisory →
- Fix · GHSA-jfgx-762w-99vr @angular/common (npm) Fixed in 20.3.34 Advisory →
Vendor assessments
Timeline
- 2026-11-05 Threatist record created from CVE-2026-111753
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Other 10
- https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr
- https://github.com/angular/angular/issues/71294
- https://github.com/angular/angular/pull/65683
- https://github.com/angular/angular/pull/71295
- https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b
- https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e
- https://github.com/angular/angular/releases/tag/21.0.3
- https://github.com/angular/angular/releases/tag/v20.3.34
- https://github.com/angular/angular/commit/0659d11c854c9c6b886a2e925afef98d70bb005f
- https://github.com/angular/angular
More angular vulnerabilities
- TI-2026-74069 Infinite loop in Angular SSR HTML parser allows denial of service CVSS 4.0HIGH 8.7
- TI-2026-60076 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVSS 4.0HIGH 8.6
- TI-2026-60080 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
- TI-2026-60078 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
- TI-2025-38694 Server-Side Request Forgery (SSRF) in Angular SSR CVSS 4.0HIGH 8.7
- TI-2026-22098 Angular SSR has an Open Redirect via X-Forwarded-Prefix CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-111753 · CVE Program
- CVE-2026-111753 · NVD
- FIRST EPSS
- CVE-2026-111753 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences