tocsin

npm/@angular/ssr CVE-2025-59052: high 7.1, EPSS 0.36%

Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

Action: Upgrade @angular/ssr to 18.2.21 or later.

npm i @angular/ssr@18.2.21
npm i @angular/ssr@19.2.16
npm i @angular/ssr@20.3.0
npm i @angular/ssr@21.0.0-next.3

Affected

introducedfixedlast affected
17.0.0-next.018.2.21-
19.0.0-next.019.2.16-
20.0.0-next.020.3.0-
21.0.0-next.021.0.0-next.3-

Fixed versions

18.2.2119.2.1620.3.021.0.0-next.3

Sources

CVE-2025-59052 · published · modified · JSON