{"id":"ghsa-ghsa-jfgx-762w-99vr","seq":2388,"kind":"advisory","title":"@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)","url":"https://github.com/advisories/GHSA-jfgx-762w-99vr","permalink":"https://vulnpulse.app/items/ghsa-ghsa-jfgx-762w-99vr","summary":"影響: npm:@angular/common >= 21.0.0, < 21.0.3 → 21.0.3, npm:@angular/common >= 20.0.0, < 20.3.34 → 20.3.34, npm:@angular/common <= 19.2.25\nAn incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37) (CVE-2025-66035) in @angular/common's HTTP Client (HttpClient) allows Cross-Site Request Forgery (XSRF) tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the browser's WHATWG URL parser. Technical Description To address CVE-2025-66035, xsrfInterceptorFn introduced a regular…","severity":"medium","techs":["nodejs","angular","github"],"cves":["CVE-2026-111753"],"tags":["GHSA-jfgx-762w-99vr","@angular/common","@angular/common","@angular/common"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T20:37:57.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}