@manniwatch/client-desktop (>=0.30.0, <=0.30.1), @manniwatch/client-ng (>=0.30.0, <=0.30.1) +2 more potentially affected by CVE-2025-59052 via @angular/ssr (>=19.0.5, <=19.2.1)

@angular/ssr NPM version =19.0.5, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.20, =19.0.0-alpha.24 Source cves: CVE-2025-59052 Source advisory: OSV:GHSA-68X2-MX4Q-78M7...

@angularexpert/my-workspace (0.0.0), @cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4) +38 more potentially affected by CVE-2025-59052 via @angular/ssr (>=17.0.5, <=18.2.13)

@angular/ssr NPM version =17.0.5, =1.0.0, =0.0.1, =0.0.1, =8.0.0, =0.0.0, =0.0.2, =0.0.0, =0.0.1 and more Source cves: CVE-2025-59052 Source advisory: OSV:GHSA-68X2-MX4Q-78M7...

@manniwatch/client-desktop (>=0.30.0, <=0.30.1), @manniwatch/client-ng (>=0.30.0, <=0.30.1) +2 more potentially affected by CVE-2025-59052 via @angular/ssr (>=19.0.5, <=19.2.1)

@angular/ssr NPM version =19.0.5, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.20, =19.0.0-alpha.24 Source cves: CVE-2025-59052 Source advisory: SNYK:JS-ANGULARSSR-12613576...

@builder.io/angular (>=1.0.1, <=3.0.2), @gleb216/fn.nestjs.core.modules (>=0.0.127, <=0.0.158) +8 more potentially affected by CVE-2025-59052 via @nguniversal/common (>=16.0.0, <=16.2.0-rc.0)

@nguniversal/common NPM version =16.0.0, =1.0.1, =0.0.127, =7.0.2, =7.1.0, =16.0.0-next.0, =16.0.0-next.0, =0.3.2, =1.2.0 Source cves: CVE-2025-59052 Source advisory: SNYK:JS-NGUNIVERSALCOMMON-12613577...

@cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4) potentially affected by CVE-2025-59052 via @angular/ssr (18.2.13)

@angular/ssr NPM version 18.2.13 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/ssr and may be impacted: - @cosla/sensemaking-web-ui =1.0.0, =1.0.4 Source cves: CVE-2025-59052 Source advisory: SNYK:JS-ANGULARSSR-12613576...

CVE-2025-59052: Concurrent Execution using Shared Resource with Improper Synchronization

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container the "platform injector" to hold request-specific state during server-side rendering. For historical reasons, the container was stored as ...