@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +28 more potentially affected by CVE-2025-61925 via astro (>=5.0.0-beta.5, <=5.14.1)

astro NPM version =5.0.0-beta.5, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.0-dev-20250414184926, =1.13.2, =0.0.1, =0.0.1, =1.0.21, =1.0.22 and more Source cves: CVE-2025-61925 Source advisory: SNYK:JS-ASTRO-13535085...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +28 more potentially affected by CVE-2025-61925 via astro (>=5.0.0-beta.5, <=5.14.1)

astro NPM version =5.0.0-beta.5, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.0-dev-20250414184926, =1.13.2, =0.0.1, =0.0.1, =1.0.21, =1.0.22 and more Source cves: CVE-2025-61925 Source advisory: OSV:GHSA-5FF5-9FCW-VG88...

EUVD-2024-2469

Malicious code in bioql PyPI...

EUVD-2022-1563

Malicious code in bioql PyPI...

EUVD-2024-2530

Malicious code in bioql PyPI...

EUVD-2022-1359

Malicious code in bioql PyPI...

EUVD-2022-6441

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2025-59052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container...

@nestjs/ng-universal (>=7.1.0, <=7.1.1), @nguniversal/builders (>=16.0.0-next.0, <=16.1.3) +1 more potentially affected by CVE-2025-59052 via @nguniversal/common (>=16.0.0, <=16.1.3)

@nguniversal/common NPM version =16.0.0, =7.1.0, =16.0.0-next.0, =16.0.0-next.0, =16.1.3 Source cves: CVE-2025-59052 Source advisory: OSV:GHSA-68X2-MX4Q-78M7...

@angularexpert/my-workspace (0.0.0), @cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4) +47 more potentially affected by CVE-2025-59052 via @angular/platform-server (>=16.2.12, <=18.2.13)

@angular/platform-server NPM version =16.2.12, =1.0.0, =0.0.1, =1.4.1, =1.1.1, =0.1.0, =13.1.0, =0.0.0, =2.1.0, =0.0.2, =0.0.11 and more Source cves: CVE-2025-59052 Source advisory: OSV:GHSA-68X2-MX4Q-78M7...

GHSA-68X2-MX4Q-78M7 Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

Impact Angular uses a DI container the "platform injector" to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share...

@angularexpert/my-workspace (0.0.0), @cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4) +38 more potentially affected by CVE-2025-59052 via @angular/ssr (>=17.0.5, <=18.2.13)

@angular/ssr NPM version =17.0.5, =1.0.0, =0.0.1, =0.0.1, =8.0.0, =0.0.0, =0.0.2, =0.0.0, =0.0.1 and more Source cves: CVE-2025-59052 Source advisory: OSV:GHSA-68X2-MX4Q-78M7...

Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

Impact Angular uses a DI container the "platform injector" to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share...

CVE-2025-59052

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container the "platform injector" to hold request-specific state during server-side rendering. For historical reasons, the container was stored as ...

Race Condition

Overview @nguniversal/common is an Angular Universal module that is common across server-side rendering app irrespective of the rendering engine Affected versions of this package are vulnerable to Race Condition between multiple concurrent requests in the global platform injector, when using the...

CVE-2025-59052 Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container the "platform injector" to hold request-specific state during server-side rendering. For historical reasons, the container was stored as ...

CVE-2025-59052

CVE-2025-59052: Angular SSR race condition in the platform injector can cause cross-request data leaks due to a global injector state shared across concurrent SSR requests. Affected: Angular SSR/server rendering path using bootstrapApplication, getPlatform, or destroyPlatform. Patched in all acti...

CVE-2025-59052 Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container the "platform injector" to hold request-specific state during server-side rendering. For historical reasons, the container was stored as ...

PT-2025-37099

Name of the Vulnerable Software and Affected Versions: Angular versions 18.2.14 through 18.2.21 Angular versions 19.2.15 through 19.2.16 Angular versions 20.3.0 Angular versions 21.0.0-next.3 Description: Angular uses a DI container to hold request-specific state during server-side rendering. Due...

@adhd/react-hooks (2.2.1), @adhd/ui-react-base-hooks (>=2.2.1, <=2.3.1) +462 more potentially affected by CVE-2025-58752 via vite (>=5.0.0, <=5.4.19)

vite NPM version =5.0.0, =2.2.1, =0.0.1, =0.7.9, =4.23.1-prerelease.0, =17.1.0-next.0, =18.0.0-next.3, =1.0.25-beta.0, =0.0.1-alpha.0, =0.5.0, =2.0.0-beta.0, =3.0.0-beta.1 and more Source cves: CVE-2025-58752 Source advisory: OSV:GHSA-JQFW-VQ24-V9C3...