@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

影響: npm:@angular/common >= 21.0.0, < 21.0.3 → 21.0.3, npm:@angular/common >= 20.0.0, < 20.3.34 → 20.3.34, npm:@angular/common <= 19.2.25

An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37) (CVE-2025-66035) in @angular/common's HTTP Client (HttpClient) allows Cross-Site Request Forgery (XSRF) tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the browser's WHATWG URL parser. Technical Description To address CVE-2025-66035, xsrfInterceptorFn introduced a regular…

在 GitHub Advisory Database 阅读

2026/10/21 05:37，GitHub Advisory Database 发布了“@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js、Angular、GitHub。CVE：CVE-2026-111753。