tocsin

CVE-2025-59052

3 advisories.

npm/@angular/platform-server CVE-2025-59052: high

Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

Action: Upgrade @angular/platform-server to 18.2.14 or later.

npm i @angular/platform-server@18.2.14
npm i @angular/platform-server@20.3.0
npm i @angular/platform-server@19.2.15
npm i @angular/platform-server@21.0.0-next.3

Affected

introducedfixedlast affected
16.0.0-next.018.2.14-
20.0.0-next.020.3.0-
19.0.0-next.019.2.15-
21.0.0-next.021.0.0-next.3-

Fixed versions

18.2.1420.3.019.2.1521.0.0-next.3

Sources

CVE-2025-59052 · published · modified · JSON

npm/@angular/ssr CVE-2025-59052: high

Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

Action: Upgrade @angular/ssr to 18.2.21 or later.

npm i @angular/ssr@18.2.21
npm i @angular/ssr@19.2.16
npm i @angular/ssr@20.3.0
npm i @angular/ssr@21.0.0-next.3

Affected

introducedfixedlast affected
17.0.0-next.018.2.21-
19.0.0-next.019.2.16-
20.0.0-next.020.3.0-
21.0.0-next.021.0.0-next.3-

Fixed versions

18.2.2119.2.1620.3.021.0.0-next.3

Sources

CVE-2025-59052 · published · modified · JSON

npm/@nguniversal/common CVE-2025-59052: high

Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

Action: No fix published. Pin and monitor.

Affected

introducedfixedlast affected
16.0.0-next.0-16.2.0

Fixed versions

No fixed version in the source.

Sources

CVE-2025-59052 · published · modified · JSON