@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

影響: npm:@angular/common >= 21.0.0, < 21.0.3 → 21.0.3, npm:@angular/common >= 20.0.0, < 20.3.34 → 20.3.34, npm:@angular/common <= 19.2.25

An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37) (CVE-2025-66035) in @angular/common's HTTP Client (HttpClient) allows Cross-Site Request Forgery (XSRF) tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the browser's WHATWG URL parser. Technical Description To address CVE-2025-66035, xsrfInterceptorFn introduced a regular…

GitHub Advisory Databaseで読む

2026/10/21 05:37、GitHub Advisory Databaseが「@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: JavaScript / Node.js、Angular、GitHub。CVE: CVE-2026-111753。