{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"16.0.0-next.0","last_affected":"16.2.0"}],"component":"@nguniversal/common","cve_ids":["CVE-2025-59052"],"ecosystem":"npm","epss":0.00355,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-68x2-mx4q-78m7","id":"tcs_01M5KF6D0CQS4GQ7RH2NPWPJ4S","modified_at":"2025-09-10T22:28:44.074455Z","published_at":"2025-09-10T21:56:01Z","references":["https://osv.dev/vulnerability/GHSA-68x2-mx4q-78m7","https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7","https://nvd.nist.gov/vuln/detail/CVE-2025-59052","https://github.com/angular/angular-cli/pull/31108","https://github.com/angular/angular/pull/63562","https://github.com/angular/angular"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-68x2-mx4q-78m7#npm/@nguniversal/common","url":"https://osv.dev/vulnerability/GHSA-68x2-mx4q-78m7"},{"source":"nvd","source_id":"CVE-2025-59052","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59052"}],"summary":"Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage"}