CVE-2025-59052: 
JavaScript vulnerability analysis and mitigation

CVE-2025-59052 is a race condition vulnerability in Angular's server-side rendering (SSR) subsystem, formally titled "Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage." The vulnerability affects @angular/platform-server (versions ≥16.0.0-next.0 < 18.2.14, ≥19.0.0-next.0 < 19.2.15, ≥20.0.0-next.0 < 20.3.0, ≥21.0.0-next.0 < 21.0.0-next.3), @angular/ssr (versions ≥17.0.0-next.0 < 18.2.21, ≥19.0.0-next.0 < 19.2.16, ≥20.0.0-next.0 < 20.3.0, ≥21.0.0-next.0 < 21.0.0-next.3), and @nguniversal/common (≥16.0.0-next.0 ≤16.2.0, with no patch available for this package). It was disclosed and patched on September 10, 2025. The CVSS v4.0 base score is 7.1 (High) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-362 (Race Condition): Angular's dependency injection (DI) container — the "platform injector" — was stored as a JavaScript module-scoped global variable for historical reasons. During server-side rendering, when multiple HTTP requests are processed concurrently, they can inadvertently share or overwrite this global injector state, causing one request to receive rendered output or response headers intended for a different request. The vulnerable APIs are bootstrapApplication (which implicitly retrieved the last-created platform injector), getPlatform (which returned the last platform instance), and destroyPlatform (which destroyed the last platform instance). An additional trigger existed in local development (ng serve), where Angular CLI activated a JIT codepath on the server that introduced async behavior between platform creation and bootstrap, triggering the race condition even without explicit use of getPlatform or custom async logic (GitHub Advisory, Angular PR #63562).

Successful exploitation allows an unauthenticated network attacker to receive server-rendered responses containing data — including authentication tokens, session identifiers, or other sensitive page content — intended for a completely different user's request. The primary impact is high confidentiality loss, with a low integrity impact due to potential state corruption between requests; availability is not affected. Because the leaked data can include authentication tokens, there is a risk of session hijacking or unauthorized access to user accounts on affected applications (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.036–0.082%, placing it in the 24th percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is probabilistic by nature — an attacker must send a high volume of concurrent requests and statistically receive a response containing another user's data, making reliable exploitation non-trivial but feasible against high-traffic SSR applications.

1. Reconnaissance: Identify Angular SSR-enabled web applications running unpatched versions of @angular/platform-server or @angular/ssr. This can be done by inspecting HTTP response headers (e.g., X-Powered-By, framework-specific headers) or JavaScript bundle fingerprints.
2. Confirm SSR is active: Send a standard HTTP GET request to the target and verify that the server returns fully server-rendered HTML (not a client-side shell), confirming SSR is in use.
3. Send high-volume concurrent requests: Use a tool such as curl, ab (Apache Bench), wrk, or a custom script to flood the target server with a large number of simultaneous HTTP requests. The goal is to maximize the probability that two requests overlap during the platform injector lifecycle.
4. Inspect responses for cross-request data: Analyze the returned HTML pages and response headers for data that does not match the attacker's own session — such as authentication tokens, CSRF tokens, user-specific content, or session cookies embedded in the rendered page.
5. Leverage leaked credentials: Use any captured tokens or session identifiers to authenticate as the victim user, potentially enabling account takeover or access to sensitive application data (GitHub Advisory, Angular PR #63562).

• Network: Unusually high volumes of concurrent HTTP GET requests to SSR-rendered endpoints from a single IP or a small set of IPs; requests with no meaningful user session context (e.g., no cookies) arriving in rapid bursts.
• Logs: Server access logs showing a spike in concurrent requests to the same SSR route from the same source IP; anomalous response sizes that vary significantly for identical unauthenticated requests (indicating cross-request state leakage).
• Application Behavior: Reports from users of receiving pages or tokens belonging to other users; authentication failures or unexpected session behavior following high-traffic periods.

The Angular team has released patches across all active release lines. Upgrade to the following versions:

• @angular/platform-server: 18.2.14, 19.2.15, 20.3.0, or 21.0.0-next.3
• @angular/ssr: 18.2.21, 19.2.16, 20.3.0, or 21.0.0-next.3

Upgrade using the Angular CLI migration schematic, which automatically updates main.server.ts to pass the new BootstrapContext argument:

ng update @angular/cli @angular/core        # v20
ng update @angular/cli@19 @angular/core@19  # v19
ng update @angular/cli@18 @angular/core@18  # v18

If immediate upgrade is not possible, apply one or more of these workarounds: (1) disable SSR via Server Routes (v19+) or builder options; (2) remove all asynchronous behavior from custom bootstrap functions; (3) remove uses of getPlatform() from application code; (4) ensure the server build defines ngJitMode as false. Note that @nguniversal/common ≤16.2.0 has no patch available and users should migrate away from it (GitHub Advisory, Angular PR #31108).

The Angular team (credited contributors: alan-agius4, jelbourn, josephperrott, hybrist, atscott, thePunderWoman) coordinated the fix and published the advisory on September 10, 2025, alongside automatic migration schematics to ease the breaking change (GitHub Advisory). Security news outlets including SecurityOnline, GBHackers, and CyberPress covered the disclosure, highlighting the token leakage risk for SSR applications. Community discussion on Reddit (r/angular) noted a broader trend of Angular CVEs in 2025, and HeroDevs published blog posts contextualizing this vulnerability alongside other recent Angular security issues. The Ninja Squad blog also covered the fix as part of the Angular 20.3 release notes.