{"action":"Upgrade @angular/common to 20.3.34 or later.","affected":[{"fixed":"21.0.3","introduced":"21.0.0"},{"fixed":"20.3.34","introduced":"20.0.0"},{"introduced":"0","last_affected":"19.2.25"}],"component":"@angular/common","cve_ids":["CVE-2026-111753"],"ecosystem":"npm","exploited":false,"fixed_versions":["21.0.3","20.3.34"],"ghsa_id":"GHSA-jfgx-762w-99vr","id":"tcs_01M5JK8Z5R0NG7W81MSQAH6GVX","modified_at":"2026-10-20T20:45:05.952939259Z","published_at":"2026-10-20T20:37:57Z","references":["https://osv.dev/vulnerability/GHSA-jfgx-762w-99vr","https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr","https://github.com/angular/angular/pull/65683","https://github.com/angular/angular/pull/71295","https://github.com/angular/angular/commit/0659d11c854c9c6b886a2e925afef98d70bb005f","https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b","https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e","https://github.com/angular/angular"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-jfgx-762w-99vr","url":"https://osv.dev/vulnerability/GHSA-jfgx-762w-99vr"}],"summary":"@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)"}