{"action":"Upgrade @angular/ssr to 18.2.21 or later.","affected":[{"fixed":"18.2.21","introduced":"17.0.0-next.0"},{"fixed":"19.2.16","introduced":"19.0.0-next.0"},{"fixed":"20.3.0","introduced":"20.0.0-next.0"},{"fixed":"21.0.0-next.3","introduced":"21.0.0-next.0"}],"component":"@angular/ssr","cve_ids":["CVE-2025-59052"],"ecosystem":"npm","epss":0.00355,"exploited":false,"fixed_versions":["18.2.21","19.2.16","20.3.0","21.0.0-next.3"],"ghsa_id":"GHSA-68x2-mx4q-78m7","id":"tcs_01M5KF6CRXZYVDZWQZEDXP8EAW","modified_at":"2025-09-10T22:28:44.074455Z","published_at":"2025-09-10T21:56:01Z","references":["https://osv.dev/vulnerability/GHSA-68x2-mx4q-78m7","https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7","https://nvd.nist.gov/vuln/detail/CVE-2025-59052","https://github.com/angular/angular-cli/pull/31108","https://github.com/angular/angular/pull/63562","https://github.com/angular/angular"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-68x2-mx4q-78m7#npm/@angular/ssr","url":"https://osv.dev/vulnerability/GHSA-68x2-mx4q-78m7"},{"source":"nvd","source_id":"CVE-2025-59052","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59052"}],"summary":"Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage"}