PT-2025-37099 · Google · Angular

Alan-Agius4

·

Published

2025-09-10

·

Updated

2025-12-03

·

CVE-2025-59052

CVSS v4.0

7.1

High

VectorAV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions: Angular versions 18.2.14 through 18.2.21 Angular versions 19.2.15 through 19.2.16 Angular versions 20.3.0 Angular versions 21.0.0-next.3
Description: Angular uses a DI container to hold request-specific state during server-side rendering. Due to historical reasons, this container was stored as a JavaScript module-scoped global variable. Concurrent requests could inadvertently share or overwrite the global injector state, potentially leading to one request responding with data intended for another, resulting in data or token leaks. The APIs bootstrapApplication, getPlatform, and destroyPlatform were vulnerable.
Recommendations: Angular versions 18.2.14 through 18.2.21: Update to version 18.2.21. Angular versions 19.2.15 through 19.2.16: Update to version 19.2.16. Angular versions 20.3.0: Update to version 20.3.0. Angular versions 21.0.0-next.3: No specific recommendation is available. As a workaround, disable SSR via Server Routes or builder options. As a workaround, remove any asynchronous behavior from custom bootstrap functions. As a workaround, remove uses of getPlatform() in application code. As a workaround, ensure that the server build defines ngJitMode as false.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2025-59052
GHSA-68X2-MX4Q-78M7

Affected Products

Angular