Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

🗓️ 10 Sep 2025 21:56:01Reported by GitHub Advisory DatabaseType

Angular SSR fixes a global platform injector race condition to prevent cross-request data leakage.

Reporter	Title	Published	Views	Family All 20
GithubExploit	Exploit for Server-Side Request Forgery in Svelte Sveltekit	17 Dec 202522:50	–	githubexploit
Circl	CVE-2025-59052	10 Sep 202523:46	–	circl
CNNVD	Angular 竞争条件问题漏洞	10 Sep 202500:00	–	cnnvd
CVE	CVE-2025-59052	10 Sep 202520:13	–	cve
Cvelist	CVE-2025-59052 Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage	10 Sep 202520:13	–	cvelist
NVD	CVE-2025-59052	10 Sep 202521:15	–	nvd
OSV	CVE-2025-59052 Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage	10 Sep 202520:13	–	osv
OSV	GHSA-68X2-MX4Q-78M7 Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage	10 Sep 202521:56	–	osv
Positive Technologies	PT-2025-37099	10 Sep 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-59052	10 Sep 202521:19	–	redhatcve

Vulners

Node

nguniversal commonRange16.0.0-next.0–16.2.0npm

angular ssrRange21.0.0-next.0–21.0.0-next.3npm

angular ssrRange20.0.0-next.0–20.3.0npm

angular ssrRange19.0.0-next.0–19.2.16npm

angular ssrRange17.0.0-next.0–18.2.21npm

angular platform-serverRange21.0.0-next.0–21.0.0-next.3npm

angular platform-serverRange19.0.0-next.0–19.2.15npm

angular platform-serverRange20.0.0-next.0–20.3.0npm

angular platform-serverRange16.0.0-next.0–18.2.14npm

Source	Link
github	www.github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-59052
github	www.github.com/angular/angular-cli/pull/31108
github	www.github.com/angular/angular/pull/63562
github	www.github.com/advisories/GHSA-68x2-mx4q-78m7

10 Sep 2025 21:56Current

6.6Medium risk

Vulners AI Score6.6

CVSS 47.1

EPSS0.00073

SSVC