Angular SSR Vulnerability Allows Cross-Request Data Exposure (CVE-2025-59052)
Security Advisory: A high security flaw was discovered in Angular’s server-side rendering (SSR) functionality that could lead to cross-request data leakage due to a global race condition. This is identified as CVE-2025-59052, affects multiple versions of Angular’s @angular/platform-server, @angular/ssr and @nguniversal/common packages.
With data breaches at highest, Organizations using vulnerable Angular versions should update immediately or implement recommended workarounds to avoid potential data breaches.
| Severity | High |
| CVSS Score | 7.1 |
| CVEs | CVE-2025-59052 |
| POC Available | No |
| Actively Exploited | No |
| Exploited in Wild | No |
| Advisory Version | 1.0 |
Overview
Angular is a popular open-source web application framework developed by Google, used to build dynamic, single-page applications (SPAs) and server-rendered apps using HTML, TypeScript and JavaScript.
When multiple SSR requests are processed concurrently, sensitive state information may be inadvertently shared, potentially exposing user tokens or private data across unrelated sessions. The Angular has released patches across all active branches and urges developers to update immediately.
| Vulnerability Name | CVE ID | Product Affected | Severity | Fixed Version |
| Race condition vulnerability | CVE-2025-59052 | Angular platform-server, ssr | High | v18.2.14, v19.2.15/16, v20.3.0, v21.0.0-next.3 |
Technical Summary
Angular uses a dependency injection (DI) container called the platform injector during SSR to hold request-specific data. This container was implemented as a global module-scoped variable, introducing a race condition when multiple requests were processed simultaneously.
This flaw could cause data meant for one user to be sent in the response to another, potentially leaking authentication tokens, headers, or private content.
Affected APIs include bootstrapApplication, getPlatform, destroyPlatform. These changes introduce SSR-only breaking changes, with automatic migration schematics available through the Angular CLI update process.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2025-59052 | Angular SSR v16 to v21 | Race condition in global DI container during SSR could leak user data across requests | Cross-Request Data Leakage |
Recommendations:
Upgrade Angular packages to the latest patched versions:
| Package | Affected Versions | Fixed Versions |
| @angular/platform-server | >=16.0.0-next.0 <18.2.14 >=19.0.0-next.0 <19.2.15 >=20.0.0-next.0 <20.3.0 >=21.0.0-next.0 <21.0.0-next.3 | 18.2.14 19.2.15 20.3.0 21.0.0-next.3 |
| @angular/ssr | >=17.0.0-next.0 <18.2.21 >=19.0.0-next.0 <19.2.16 >=20.0.0-next.0 <20.3.0 >=21.0.0-next.0 <21.0.0-next.3 | 18.2.21 19.2.16 20.3.0 21.0.0-next.3 |
If Immediate Upgrade is Not Possible, you can follow the recommendations below
- Disable SSR via server routes or build configurations
- Remove asynchronous behavior from custom bootstrap functions
- Eliminate use of getPlatform() in server-side code
- Ensure ngJitMode is set to false in production builds
Conclusion:
The Angular SSR vulnerability CVE-2025-59052 is the high severity issue with global state management during concurrent request processing, resulting in potential cross-request data exposure.
Though not yet exploited in the wild, the risk is significant for SSR-enabled Angular apps. Developers are urged to apply updates promptly or follow the provided mitigation steps to secure their applications.
As per reports this vulnerability requires no special privileges or user interaction, making it both easy to exploit and dangerous in high-traffic applications.
References:
Hashtags
#Infosec #CyberSecurity #Angular #SecurityAdvisory #WebSecurity #Vulnerabilitymanagement #DevSecOps #PatchManagement #CISO #CXO #Intrucept
Recent Comments