CVE-2025-59052

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the "platform injector") to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state. In practical terms, this can lead to one request responding with data meant for a completely different request, leaking data or tokens included on the rendered page or in response headers. As long as an attacker had network access to send any traffic that received a rendered response, they may have been able to send a large number of requests and then inspect the responses for information leaks. The APIs `bootstrapApplication`, `getPlatform`, and `destroyPlatform` were vulnerable and required SSR-only breaking changes. The issue has been patched in all active release lines as well as in the v21 prerelease. Patched packages include `@angular/platform-server` 21.0.0-next.3, 20.3.0, 19.2.15, and 18.2.14 and `@angular/ssr` 21.0.0-next.3, 20.3.0, 19.2.16, and 18.2.21. Several workarounds are available. Disable SSR via Server Routes or builder options, remove any asynchronous behavior from custom `bootstrap` functions, remove uses of `getPlatform()` in application code, and/or ensure that the server build defines `ngJitMode` as false.

• CWE-362

• https://github.com/angular/angular-cli/pull/31108
• https://github.com/angular/angular/pull/63562
• https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7

Published

Sep 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59047matrix-sdk-base is the base component to build a Matrix clie…2.7
• CVE-2025-59048OpenBao's AWS Plugin generates AWS access credentials based …8.1
• CVE-2025-59049Mockoon provides way to design and run mock APIs. Prior to v…7.5
• CVE-2025-5905A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It h…8.8
• CVE-2025-59050Greenshot is an open source Windows screenshot utility. Gree…7.8
• CVE-2025-59051The FreePBX Endpoint Manager module includes a Network Scann…8.6
• CVE-2025-59053AIRI is a self-hosted, artificial intelligence based Grok Co…9.6
• CVE-2025-59054dstack is a software development kit (SDK) to simplify the d…8.5
• CVE-2025-59055InstantCMS is a free and open source content management syst…7.2
• CVE-2025-59056FreePBX is an open-source web-based graphical user interface…7.5
• CVE-2025-59057React Router is a router for React. In @remix-run/react vers…7.6
• CVE-2025-59058httpsig-rs is a Rust implementation of IETF RFC 9421 http me…5.9