GHSA-58c5-g7wp-6w37
NoneCVSS
—
EPSS
—
Published
Nov 26, 2025
CISA due date
—
The record
Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @angular/common | 0 | 19.2.16 |
| npm | @angular/common | 20.0.0-next.0 | 20.3.14 |
| npm | @angular/common | 21.0.0-next.0 | 21.0.1 |
Related vulnerabilities
- CVE-2025-66035 Angular is a development platform for building mobile and desktop web applications using… Same vulnerability
- CVE-2026-50170 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/common
- CVE-2026-50171 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/common
- CVE-2026-54268 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/common
- CVE-2026-54266 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/common
- GHSA-48r7-hpm6-gfxm @angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate) Also affects @angular/common
- GHSA-39pv-4j6c-2g6v @angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to… Also affects @angular/common
- GHSA-p3vc-36g9-x9gr @angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) Also affects @angular/common