PT-2026-26492

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.0-next.2 Angular versions prior to 21.2.3 Angular versions prior to 20.3.21 Description An Open Redirect issue exists in the Angular SSR tool due to an incomplete fix for a previously identified problem. The...

@manniwatch/client-desktop (>=0.30.0, <=0.30.1), @manniwatch/client-ng (>=0.30.0, <=0.30.1) +2 more potentially affected by CVE-2025-62427 via @angular/ssr (>=19.0.5, <=19.2.1)

@angular/ssr NPM version =19.0.5, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.20, =19.0.0-alpha.24 Source cves: CVE-2025-62427 Source advisory: OSV:GHSA-Q63Q-PGMF-MXHR...

@manniwatch/client-desktop (>=0.30.0, <=0.30.1), @manniwatch/client-ng (>=0.30.0, <=0.30.1) +2 more potentially affected by CVE-2025-62427 via @angular/ssr (>=19.0.5, <=19.2.1)

@angular/ssr NPM version =19.0.5, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.20, =19.0.0-alpha.24 Source cves: CVE-2025-62427 Source advisory: SNYK:JS-ANGULARSSR-13635722...

CVE-2025-62427: Server-Side Request Forgery (SSRF)

The Angular SSR is a server-rise rendering tool for Angular applications. The vulnerability is a Server-Side Request Forgery SSRF flaw within the URL resolution mechanism of Angular's Server-Side Rendering package @angular/ssr before 19.2.18, 20.3.6, and 21.0.0-next.8. The function createRequestU...

@manniwatch/client-desktop (>=0.30.0, <=0.30.1), @manniwatch/client-ng (>=0.30.0, <=0.30.1) +2 more potentially affected by CVE-2025-59052 via @angular/ssr (>=19.0.5, <=19.2.1)

@angular/ssr NPM version =19.0.5, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.20, =19.0.0-alpha.24 Source cves: CVE-2025-59052 Source advisory: OSV:GHSA-68X2-MX4Q-78M7...

@angularexpert/my-workspace (0.0.0), @cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4) +38 more potentially affected by CVE-2025-59052 via @angular/ssr (>=17.0.5, <=18.2.13)

@angular/ssr NPM version =17.0.5, =1.0.0, =0.0.1, =0.0.1, =8.0.0, =0.0.0, =0.0.2, =0.0.0, =0.0.1 and more Source cves: CVE-2025-59052 Source advisory: OSV:GHSA-68X2-MX4Q-78M7...

@manniwatch/client-desktop (>=0.30.0, <=0.30.1), @manniwatch/client-ng (>=0.30.0, <=0.30.1) +2 more potentially affected by CVE-2025-59052 via @angular/ssr (>=19.0.5, <=19.2.1)

@angular/ssr NPM version =19.0.5, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.20, =19.0.0-alpha.24 Source cves: CVE-2025-59052 Source advisory: SNYK:JS-ANGULARSSR-12613576...

@cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4) potentially affected by CVE-2025-59052 via @angular/ssr (18.2.13)

@angular/ssr NPM version 18.2.13 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/ssr and may be impacted: - @cosla/sensemaking-web-ui =1.0.0, =1.0.4 Source cves: CVE-2025-59052 Source advisory: SNYK:JS-ANGULARSSR-12613576...

@builder.io/angular (>=1.0.1, <=3.0.2), @gleb216/fn.nestjs.core.modules (>=0.0.127, <=0.0.158) +8 more potentially affected by CVE-2025-59052 via @nguniversal/common (>=16.0.0, <=16.2.0-rc.0)

@nguniversal/common NPM version =16.0.0, =1.0.1, =0.0.127, =7.0.2, =7.1.0, =16.0.0-next.0, =16.0.0-next.0, =0.3.2, =1.2.0 Source cves: CVE-2025-59052 Source advisory: SNYK:JS-NGUNIVERSALCOMMON-12613577...

CVE-2025-59052: Concurrent Execution using Shared Resource with Improper Synchronization

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container the "platform injector" to hold request-specific state during server-side rendering. For historical reasons, the container was stored as ...