## @angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs, angular, github
- CVE: CVE-2026-111753
- 公開日時: 2026-10-20T20:37:57.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-jfgx-762w-99vr)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-jfgx-762w-99vr

影響: npm:@angular/common >= 21.0.0, < 21.0.3 → 21.0.3, npm:@angular/common >= 20.0.0, < 20.3.34 → 20.3.34, npm:@angular/common <= 19.2.25
An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37) (CVE-2025-66035) in @angular/common's HTTP Client (HttpClient) allows Cross-Site Request Forgery (XSRF) tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the browser's WHATWG URL parser. Technical Description To address CVE-2025-66035, xsrfInterceptorFn introduced a regular…