CVE-2026-111753

The @angular/common package's HttpClient function xsrfInterceptorFn is vulnerable to XSRF token leakage due to a URL parsing discrepancy between a regular expression and the browser's WHATWG URL parser . Because the regex does not normalize certain characters—such as backslashes, control characte...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor via the xsrfInterceptorFn in packages/common/http/src/xsrf.ts, where the XSRF interceptor skips token injection for all absolute URLs, including those that share the same...