Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-4cvr-kruz-sfbu
Vulnerability ID VCID-4cvr-kruz-sfbu
Aliases CVE-2025-59052
GHSA-68x2-mx4q-78m7
Summary Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the "platform injector") to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state. In practical terms, this can lead to one request responding with data meant for a completely different request, leaking data or tokens included on the rendered page or in response headers. As long as an attacker had network access to send any traffic that received a rendered response, they may have been able to send a large number of requests and then inspect the responses for information leaks. The APIs `bootstrapApplication`, `getPlatform`, and `destroyPlatform` were vulnerable and required SSR-only breaking changes. The issue has been patched in all active release lines as well as in the v21 prerelease. Patched packages include `@angular/platform-server` 21.0.0-next.3, 20.3.0, 19.2.15, and 18.2.14 and `@angular/ssr` 21.0.0-next.3, 20.3.0, 19.2.16, and 18.2.21. Several workarounds are available. Disable SSR via Server Routes or builder options, remove any asynchronous behavior from custom `bootstrap` functions, remove uses of `getPlatform()` in application code, and/or ensure that the server build defines `ngJitMode` as false.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-59052.json
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2025-59052
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2025-59052
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2025-59052
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2025-59052
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-68x2-mx4q-78m7
cvssv4 7.1 https://github.com/angular/angular
generic_textual HIGH https://github.com/angular/angular
cvssv4 7.1 https://github.com/angular/angular-cli/pull/31108
generic_textual HIGH https://github.com/angular/angular-cli/pull/31108
ssvc Track https://github.com/angular/angular-cli/pull/31108
cvssv4 7.1 https://github.com/angular/angular/pull/63562
generic_textual HIGH https://github.com/angular/angular/pull/63562
ssvc Track https://github.com/angular/angular/pull/63562
cvssv3.1_qr HIGH https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7
cvssv4 7.1 https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7
generic_textual HIGH https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7
ssvc Track https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7
cvssv4 7.1 https://nvd.nist.gov/vuln/detail/CVE-2025-59052
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2025-59052
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-59052.json
https://api.first.org/data/v1/epss?cve=CVE-2025-59052
https://github.com/angular/angular
https://nvd.nist.gov/vuln/detail/CVE-2025-59052
2394458 https://bugzilla.redhat.com/show_bug.cgi?id=2394458
31108 https://github.com/angular/angular-cli/pull/31108
63562 https://github.com/angular/angular/pull/63562
GHSA-68x2-mx4q-78m7 https://github.com/advisories/GHSA-68x2-mx4q-78m7
GHSA-68x2-mx4q-78m7 https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-59052.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/angular/angular
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/angular/angular-cli/pull/31108
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-09-10T20:24:52Z/ Found at https://github.com/angular/angular-cli/pull/31108
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/angular/angular/pull/63562
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-09-10T20:24:52Z/ Found at https://github.com/angular/angular/pull/63562
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-09-10T20:24:52Z/ Found at https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-59052
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.24003
EPSS Score 0.00082
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:03:56.806703+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/59xxx/CVE-2025-59052.json 38.6.0