{"action":"Upgrade @angular/platform-server to 18.2.14 or later.","affected":[{"fixed":"18.2.14","introduced":"16.0.0-next.0"},{"fixed":"20.3.0","introduced":"20.0.0-next.0"},{"fixed":"19.2.15","introduced":"19.0.0-next.0"},{"fixed":"21.0.0-next.3","introduced":"21.0.0-next.0"}],"component":"@angular/platform-server","cve_ids":["CVE-2025-59052"],"ecosystem":"npm","epss":0.00355,"exploited":false,"fixed_versions":["18.2.14","20.3.0","19.2.15","21.0.0-next.3"],"ghsa_id":"GHSA-68x2-mx4q-78m7","id":"tcs_01M5KF6CHA1VYN29F3V31Y0AJF","modified_at":"2025-09-10T22:28:44.074455Z","published_at":"2025-09-10T21:56:01Z","references":["https://osv.dev/vulnerability/GHSA-68x2-mx4q-78m7","https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7","https://nvd.nist.gov/vuln/detail/CVE-2025-59052","https://github.com/angular/angular-cli/pull/31108","https://github.com/angular/angular/pull/63562","https://github.com/angular/angular"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-68x2-mx4q-78m7","url":"https://osv.dev/vulnerability/GHSA-68x2-mx4q-78m7"},{"source":"nvd","source_id":"CVE-2025-59052","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59052"}],"summary":"Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage"}