CVE-2025-59052

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-59052", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-08T16:19:26.172Z", "datePublished": "2025-09-10T20:13:56.965Z", "dateUpdated": "2025-09-10T20:25:32.147Z"}, "containers": {"cna": {"title": "Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage", "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "lang": "en", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7"}, {"name": "https://github.com/angular/angular-cli/pull/31108", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular-cli/pull/31108"}, {"name": "https://github.com/angular/angular/pull/63562", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/pull/63562"}], "affected": [{"vendor": "angular", "product": "angular", "versions": [{"version": "@angular/platform-server >= 16.0.0-next.0, < 18.2.14", "status": "affected"}, {"version": "@angular/platform-server >= 20.0.0-next.0, < 20.3.0", "status": "affected"}, {"version": "@angular/platform-server >= 19.0.0-next.0, < 19.2.15", "status": "affected"}, {"version": "@angular/platform-server >= 21.0.0-next.0, < 21.0.0-next.3", "status": "affected"}, {"version": "@angular/ssr >= 17.0.0-next.0, < 18.2.21", "status": "affected"}, {"version": "@angular/ssr >= 19.0.0-next.0, < 19.2.16", "status": "affected"}, {"version": "@angular/ssr >= 20.0.0-next.0, < 20.3.0", "status": "affected"}, {"version": "@angular/ssr >= 21.0.0-next.0, < 21.0.0-next.3", "status": "affected"}, {"version": "@nguniversal/common >= 16.0.0-next.0, <= 16.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-10T20:13:56.965Z"}, "descriptions": [{"lang": "en", "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the \"platform injector\") to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state. In practical terms, this can lead to one request responding with data meant for a completely different request, leaking data or tokens included on the rendered page or in response headers. As long as an attacker had network access to send any traffic that received a rendered response, they may have been able to send a large number of requests and then inspect the responses for information leaks. The APIs `bootstrapApplication`, `getPlatform`, and `destroyPlatform` were vulnerable and required SSR-only breaking changes.\nThe issue has been patched in all active release lines as well as in the v21 prerelease. Patched packages include `@angular/platform-server` 21.0.0-next.3, 20.3.0, 19.2.15, and 18.2.14 and `@angular/ssr` 21.0.0-next.3, 20.3.0, 19.2.16, and 18.2.21. Several workarounds are available. Disable SSR via Server Routes or builder options, remove any asynchronous behavior from custom `bootstrap` functions, remove uses of `getPlatform()` in application code, and/or ensure that the server build defines `ngJitMode` as false."}], "source": {"advisory": "GHSA-68x2-mx4q-78m7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-10T20:24:52.001731Z", "id": "CVE-2025-59052", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T20:25:32.147Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59052", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-10T20:24:52.001731Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T20:24:58.361Z"}}], "cna": {"title": "Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage", "source": {"advisory": "GHSA-68x2-mx4q-78m7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "angular", "product": "angular", "versions": [{"status": "affected", "version": "@angular/platform-server >= 16.0.0-next.0, < 18.2.14"}, {"status": "affected", "version": "@angular/platform-server >= 20.0.0-next.0, < 20.3.0"}, {"status": "affected", "version": "@angular/platform-server >= 19.0.0-next.0, < 19.2.15"}, {"status": "affected", "version": "@angular/platform-server >= 21.0.0-next.0, < 21.0.0-next.3"}, {"status": "affected", "version": "@angular/ssr >= 17.0.0-next.0, < 18.2.21"}, {"status": "affected", "version": "@angular/ssr >= 19.0.0-next.0, < 19.2.16"}, {"status": "affected", "version": "@angular/ssr >= 20.0.0-next.0, < 20.3.0"}, {"status": "affected", "version": "@angular/ssr >= 21.0.0-next.0, < 21.0.0-next.3"}, {"status": "affected", "version": "@nguniversal/common >= 16.0.0-next.0, <= 16.2.0"}]}], "references": [{"url": "https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7", "name": "https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/angular/angular-cli/pull/31108", "name": "https://github.com/angular/angular-cli/pull/31108", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/angular/angular/pull/63562", "name": "https://github.com/angular/angular/pull/63562", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the \"platform injector\") to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state. In practical terms, this can lead to one request responding with data meant for a completely different request, leaking data or tokens included on the rendered page or in response headers. As long as an attacker had network access to send any traffic that received a rendered response, they may have been able to send a large number of requests and then inspect the responses for information leaks. The APIs `bootstrapApplication`, `getPlatform`, and `destroyPlatform` were vulnerable and required SSR-only breaking changes.\nThe issue has been patched in all active release lines as well as in the v21 prerelease. Patched packages include `@angular/platform-server` 21.0.0-next.3, 20.3.0, 19.2.15, and 18.2.14 and `@angular/ssr` 21.0.0-next.3, 20.3.0, 19.2.16, and 18.2.21. Several workarounds are available. Disable SSR via Server Routes or builder options, remove any asynchronous behavior from custom `bootstrap` functions, remove uses of `getPlatform()` in application code, and/or ensure that the server build defines `ngJitMode` as false."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-10T20:13:56.965Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59052", "state": "PUBLISHED", "dateUpdated": "2025-09-10T20:25:32.147Z", "dateReserved": "2025-09-08T16:19:26.172Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-10T20:13:56.965Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "angular", "vendor": "angular", "versions": [{"status": "affected", "version": "@angular/platform-server >= 16.0.0-next.0, < 18.2.14"}, {"status": "affected", "version": "@angular/platform-server >= 20.0.0-next.0, < 20.3.0"}, {"status": "affected", "version": "@angular/platform-server >= 19.0.0-next.0, < 19.2.15"}, {"status": "affected", "version": "@angular/platform-server >= 21.0.0-next.0, < 21.0.0-next.3"}, {"status": "affected", "version": "@angular/ssr >= 17.0.0-next.0, < 18.2.21"}, {"status": "affected", "version": "@angular/ssr >= 19.0.0-next.0, < 19.2.16"}, {"status": "affected", "version": "@angular/ssr >= 20.0.0-next.0, < 20.3.0"}, {"status": "affected", "version": "@angular/ssr >= 21.0.0-next.0, < 21.0.0-next.3"}, {"status": "affected", "version": "@nguniversal/common >= 16.0.0-next.0, <= 16.2.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the \"platform injector\") to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state. In practical terms, this can lead to one request responding with data meant for a completely different request, leaking data or tokens included on the rendered page or in response headers. As long as an attacker had network access to send any traffic that received a rendered response, they may have been able to send a large number of requests and then inspect the responses for information leaks. The APIs `bootstrapApplication`, `getPlatform`, and `destroyPlatform` were vulnerable and required SSR-only breaking changes.\nThe issue has been patched in all active release lines as well as in the v21 prerelease. Patched packages include `@angular/platform-server` 21.0.0-next.3, 20.3.0, 19.2.15, and 18.2.14 and `@angular/ssr` 21.0.0-next.3, 20.3.0, 19.2.16, and 18.2.21. Several workarounds are available. Disable SSR via Server Routes or builder options, remove any asynchronous behavior from custom `bootstrap` functions, remove uses of `getPlatform()` in application code, and/or ensure that the server build defines `ngJitMode` as false."}, {"lang": "es", "value": "Angular es una plataforma de desarrollo para construir aplicaciones web m\u00f3viles y de escritorio usando TypeScript/JavaScript y otros lenguajes. Angular usa un contenedor DI (el 'inyector de plataforma') para mantener el estado espec\u00edfico de la solicitud durante la renderizaci\u00f3n del lado del servidor. Por razones hist\u00f3ricas, el contenedor se almacenaba como una variable global con alcance de m\u00f3dulo de JavaScript. Cuando se procesan m\u00faltiples solicitudes concurrentemente, estas podr\u00edan compartir o sobrescribir inadvertidamente el estado global del inyector. En t\u00e9rminos pr\u00e1cticos, esto puede llevar a que una solicitud responda con datos destinados a una solicitud completamente diferente, filtrando datos o tokens incluidos en la p\u00e1gina renderizada o en los encabezados de respuesta. Mientras un atacante tuviera acceso a la red para enviar cualquier tr\u00e1fico que recibiera una respuesta renderizada, podr\u00eda haber sido capaz de enviar un gran n\u00famero de solicitudes y luego inspeccionar las respuestas en busca de fugas de informaci\u00f3n. Las APIs 'bootstrapApplication', 'getPlatform' y 'destroyPlatform' eran vulnerables y requer\u00edan cambios disruptivos solo para SSR.\nEl problema ha sido parcheado en todas las l\u00edneas de lanzamiento activas, as\u00ed como en la versi\u00f3n preliminar v21. Los paquetes parcheados incluyen '@angular/platform-server' 21.0.0-next.3, 20.3.0, 19.2.15 y 18.2.14 y '@angular/ssr' 21.0.0-next.3, 20.3.0, 19.2.16 y 18.2.21. Varias soluciones alternativas est\u00e1n disponibles. Deshabilite SSR a trav\u00e9s de Rutas del Servidor u opciones del constructor, elimine cualquier comportamiento as\u00edncrono de las funciones 'bootstrap' personalizadas, elimine los usos de 'getPlatform()' en el c\u00f3digo de la aplicaci\u00f3n, y/o aseg\u00farese de que la compilaci\u00f3n del servidor defina 'ngJitMode' como falso."}], "id": "CVE-2025-59052", "lastModified": "2026-06-17T09:45:30.480", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59052", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-10T20:24:52.001731Z", "version": "2.0.3"}}]}, "published": "2025-09-10T21:15:37.283", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/angular/angular-cli/pull/31108"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/pull/63562"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "@angular/ssr: @angular/platform-server: @nguniversal/common: Angular Cross-Request Data Leakage", "id": "2394458", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2394458"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-362", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-59052", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "dotnet5.0-build-reference-packages", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2025-09-10T20:13:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-59052\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59052\nhttps://github.com/angular/angular-cli/pull/31108\nhttps://github.com/angular/angular/pull/63562\nhttps://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7"], "threat_severity": "Important"}

{"created": "2025-09-11T10:42:41.317478+00:00", "updated": "2025-09-11T10:42:41.317553+00:00", "vendors": ["angular", "angular$PRODUCT$angular"]}