UpHeron
All vulnerabilities

Servers and applications

CVE-2025-59052

Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

Severity
High 7.1
Published
10 Sept 2025
Last changed
10 Sept 2025
Added to UpHeron
3 Nov 2026
Fixed in
18.2.14, 18.2.21, 19.2.15, 19.2.16, 20.3.0, 21.0.0-next.3
Also known as
GHSA-68x2-mx4q-78m7
Sources
Project advisories (GitHub)

Affected software

SoftwareAffected versions
AngularServers and applications · github:angular/angular
  • From 21.0.0-next.0 before 21.0.0-next.3
  • From 20.0.0-next.0 before 20.3.0
  • From 19.0.0-next.0 before 19.2.16
  • From 19.0.0-next.0 before 19.2.15
All 7 release lines
  • From 16.0.0-next.0 before 18.2.14
  • From 16.0.0-next.0 up to 16.2.0
  • From 17.0.0-next.0 before 18.2.21
  • From 19.0.0-next.0 before 19.2.15
  • From 19.0.0-next.0 before 19.2.16
  • From 20.0.0-next.0 before 20.3.0
  • From 21.0.0-next.0 before 21.0.0-next.3

References